All resource including output resources are now checked

[mymasse]

Summary

This was raised as a discussion item: https://github.com/concourse/concourse/discussions/7808

Basically when this PR https://github.com/concourse/concourse/pull/7208 was merged in 7.6.0 the resource checker started checking all resources and not just input resource as per documentation here https://concourse-ci.org/checker.html

On every interval tick, the resource checker will see if there are any resources that need to be checked. It does this by first finding resources which are used as inputs to jobs, and then comparing the current time against the last time each resource was checked.

Steps to reproduce

Using this pipeline:

---
resource_types:
  - name: registry-tag
    type: registry-image
    source:
      repository: ghcr.io/tlwr/registry-tag-resource
      tag: a711814d6f5b1c41e21e41ac90fd43550fc86f06

resources:
  - name: pipeline-tasks
    type: git
    icon: bitbucket
    source:
      uri: [email protected]:trecnoc/concourse.git
      branch: master
      private_key: ((bitbucket.private_key))
  - name: docker-repo
    type: git
    icon: bitbucket
    source:
      uri: [email protected]:trecnoc/docker.git
      branch: master
      private_key: ((bitbucket.private_key))
  - name: debian-release
    type: registry-tag
    icon: tag
    source:
      uri: https://hub.docker.com/v2/repositories/library/debian
      regexp: ^buster-\d+-slim$
      pages: 10
      tags_per_page: 10
      sort:
        method: alphabetical
  - name: debian-update-repo
    type: git
    icon: bitbucket
    source:
      uri: [email protected]:trecnoc/docker.git
      branch: azure-cli-image-update-debian-to-((.:debian_version))
      private_key: ((bitbucket.private_key))
jobs:
  - name: update-debian
    build_log_retention:
      builds: 2
      minimum_succeeded_builds: 1
    plan:
      - in_parallel:
          - get: pipeline-tasks
          - get: docker-repo
          - get: debian-release
      - load_var: debian_version
        file: debian-release/tag
      - task: update-dockerfile
        file: pipeline-tasks/tasks/search-and-replace-file.yml
        input_mapping:
          input-repo: docker-repo
        output_mapping:
          output-repo: debian-updated-repo
        params:
          FILE: azure-cli/Dockerfile
          SEARCH: ARG DEBIAN_VERSION=.*
          REPLACEMENT: ARG DEBIAN_VERSION=((.:debian_version))
          COMMIT_MESSAGE: "Update azure-cli image with debian version ((.:debian_version))"
          COMMIT_USER: ((bitbucket.user))
          COMMIT_EMAIL: ((bitbucket.email))
      - put: debian-update-repo
        params:
          repository: debian-updated-repo

Expected results

Only the pipeline-tasks, docker-repo and debian-release are checked

Actual results

From the logs

{"timestamp":"2021-11-17T15:33:26.347687918Z","level":"info","source":"atc","message":"atc.tracker-imb.run.running","data":{"build":"check","pipeline":"test-new","pre_build_id":1,"resource":"debian-update-repo","session":"22.1","team":"main"}}
{"timestamp":"2021-11-17T15:33:26.348573490Z","level":"info","source":"atc","message":"atc.tracker-imb.run.running","data":{"build":"check","pipeline":"test-new","pre_build_id":2,"resource":"docker-repo","session":"22.2","team":"main"}}
{"timestamp":"2021-11-17T15:33:26.356414847Z","level":"info","source":"atc","message":"atc.tracker-imb.run.running","data":{"build":"check","pipeline":"test-new","pre_build_id":3,"resource":"debian-release","session":"22.3","team":"main"}}
{"timestamp":"2021-11-17T15:33:26.364576602Z","level":"info","source":"atc","message":"atc.tracker-imb.run.running","data":{"build":"check","pipeline":"test-new","pre_build_id":4,"resource":"pipeline-tasks","session":"22.4","team":"main"}}

Additional context

In version 7.5.0 for the same pipeline the logs would have contained:

{"timestamp":"2021-11-17T15:31:52.199359921Z","level":"info","source":"atc","message":"atc.scanner.notify.created-build","data":{"build":"check","build_id":29,"pipeline":"test-new","resource":"pipeline-tasks","session":"22.11","team":"main"}}
{"timestamp":"2021-11-17T15:31:52.199578770Z","level":"info","source":"atc","message":"atc.scanner.notify.created-build","data":{"build":"check","build_id":30,"pipeline":"test-new","resource":"docker-repo","session":"22.11","team":"main"}}
{"timestamp":"2021-11-17T15:31:52.200338637Z","level":"info","source":"atc","message":"atc.scanner.notify.created-build","data":{"build":"check","build_id":31,"pipeline":"test-new","resource":"debian-release","session":"22.11","team":"main"}}

Triaging info

• Concourse version: 7.6.0
• Browser (if applicable):
• Did this used to work? Yes

[xtremerui]

I think the problem is how concourse finds out put-only resources (as in job outputs) that need check here https://github.com/concourse/concourse/blob/master/atc/db/check_factory.go#L157-L162

[mymasse]

This issue now manifests itself in the UI also:

This is from a different pipeline than the provided example but it is also for a put resource only with the following configuration:

  - name: bosh-image-prod-update-repo
    type: git
    icon: bitbucket
    source:
      uri: [email protected]:trecnoc/terraform.git
      branch: update-prod-bosh-image-to-((.:bosh-image_version))
      private_key: ((bitbucket.private_key))

[mymasse]

Any idea when this will be looked at, this is causing a lot of unnecessary log entries and calls to vault for fetching local variables which always return no result.