feat: Add generic red-team adversarial testing stage (Promptfoo)

Docs/konflux-integration-guide.md

@@ -6,12 +6,14 @@ Bundles that can evaluate A2A agents, MCP servers, and skills.
 
 ## Architecture
 
-ABEvalFlow publishes **7 core tasks** as Tekton Bundles:
+ABEvalFlow publishes **8 core tasks** as Tekton Bundles:
 
 ```
-parse-snapshot → prepare → test → evaluate → analyze-scorecard → store → emit-result
+parse-snapshot → prepare → test → [red-team] → evaluate → analyze-scorecard → store → emit-result
 ```
 
+The `red-team` task is opt-in (controlled by `ENABLE_RED_TEAM` parameter, default `false`).
+
 These tasks handle the entire evaluation lifecycle:
 
 | Task | Purpose |
@@ -320,6 +322,7 @@ The core tasks are published as Tekton Bundles to Quay.io:
 | `quay.io/rh-ee-ikrispin/abevalflow-task-evaluate:0.1` | evaluate |
 | `quay.io/rh-ee-ikrispin/abevalflow-task-analyze-scorecard:0.1` | analyze-scorecard |
 | `quay.io/rh-ee-ikrispin/abevalflow-task-store:0.1` | store |
+| `quay.io/rh-ee-ikrispin/abevalflow-task-red-team:0.1` | red-team (opt-in) |
 | `quay.io/rh-ee-ikrispin/abevalflow-task-emit-result:0.1` | emit-result |
 
 To rebuild bundles after editing task YAML:

config/konflux/secrets-template.yaml

@@ -12,6 +12,7 @@
 #   ab-eval-db-credentials : Store results in PostgreSQL
 #   minio-credentials      : Upload artifacts to MinIO/S3
 #   monitoring-slack-webhook: Send degradation alerts to Slack
+#   promptfoo-cloud-credentials: Share red-team results to Promptfoo Cloud (optional)
 ---
 # workload-cluster-credentials
 # ONLY required when EVAL_MODE=remote (cross-cluster evaluation).
@@ -53,3 +54,16 @@ metadata:
 type: Opaque
 stringData:
   token: "<REPLACE_WITH_COMPASS_API_TOKEN>"
+---
+# promptfoo-cloud-credentials (OPTIONAL)
+# API key for Promptfoo Cloud to share red-team results.
+# If not configured, red-team runs locally without cloud sharing.
+# Only relevant when ENABLE_RED_TEAM=true.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: promptfoo-cloud-credentials
+  namespace: <YOUR-KONFLUX-TENANT-NAMESPACE>
+type: Opaque
+stringData:
+  api-key: "<REPLACE_WITH_PROMPTFOO_API_KEY>"

pipeline/integration/Makefile

@@ -2,7 +2,7 @@ QUAY_NS ?= quay.io/rh-ee-ikrispin
 VERSION ?= 0.1
 TASKS_DIR := ../tasks/konflux
 
-TASKS = parse-snapshot prepare test evaluate analyze-scorecard store emit-result
+TASKS = parse-snapshot prepare test red-team evaluate analyze-scorecard store emit-result
 
 .PHONY: bundles login list clean help
 

pipeline/integration/konflux-eval-pipelinerun.yaml

@@ -104,6 +104,22 @@ spec:
           Name of the Secret containing 'token' key for the workload cluster.
           Only used when EVAL_MODE=remote.
 
+      # === Red team (adversarial testing) ===
+      - name: ENABLE_RED_TEAM
+        type: string
+        default: "false"
+        description: "Enable red team adversarial evaluation (runs Promptfoo against the target)"
+      - name: RED_TEAM_MODE
+        type: string
+        default: "smoke"
+        description: >-
+          "smoke" generates a quick suite from metadata (~25 tests, basic strategy, ~2 min).
+          "full" generates comprehensive attacks with all strategies (~1750 tests, ~90 min).
+      - name: RED_TEAM_CONCURRENCY
+        type: string
+        default: "12"
+        description: Number of parallel Promptfoo evaluations
+
       # === Pipeline repo (for scripts) ===
       - name: PIPELINE_REPO_URL
         type: string
@@ -220,11 +236,58 @@ spec:
           - name: source
             workspace: shared-workspace
 
+      # ================================================================
+      # Stage 3.5: Red Team (adversarial testing, optional)
+      # ================================================================
+      - name: red-team
+        runAfter: [test]
+        when:
+          - input: $(params.ENABLE_RED_TEAM)
+            operator: in
+            values: ["true"]
+        taskRef:
+          resolver: bundles
+          params:
+            - name: name
+              value: red-team
+            - name: bundle
+              value: quay.io/rh-ee-ikrispin/abevalflow-task-red-team:0.1
+            - name: kind
+              value: task
+        params:
+          - name: eval-engine
+            value: $(params.EVAL_ENGINE)
+          - name: submission-dir
+            value: $(params.SUBMISSION_DIR)
+          - name: submission-name
+            value: $(tasks.prepare.results.submission-name)
+          - name: agent-endpoint
+            value: $(params.AGENT_ENDPOINT)
+          - name: mcp-url
+            value: $(params.MCP_URL)
+          - name: red-team-mode
+            value: $(params.RED_TEAM_MODE)
+          - name: llm-api-base
+            value: $(params.LLM_API_BASE)
+          - name: llm-model
+            value: $(params.LLM_MODEL)
+          - name: pipeline-run-id
+            value: $(context.pipelineRun.name)
+          - name: pipeline-repo-url
+            value: $(params.PIPELINE_REPO_URL)
+          - name: pipeline-repo-revision
+            value: $(params.PIPELINE_REPO_REVISION)
+          - name: concurrency
+            value: $(params.RED_TEAM_CONCURRENCY)
+        workspaces:
+          - name: source
+            workspace: shared-workspace
+
       # ================================================================
       # Stage 4: Evaluate
       # ================================================================
       - name: evaluate
-        runAfter: [test]
+        runAfter: [red-team, test]
         timeout: "3h"
         taskRef:
           resolver: bundles