apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: forgejo-mcp-code-scans
  annotations:
    pipelinesascode.tekton.dev/on-event: "[push, pull_request]"
    pipelinesascode.tekton.dev/on-target-branch: "[main]"
    pipelinesascode.tekton.dev/task: "[git-clone]"
    pipelinesascode.tekton.dev/max-keep-runs: "5"
    pipelinesascode.tekton.dev/cancel-in-progress: "true"
spec:
  params:
    - name: repo_url
      value: "{{ repo_url }}"
    - name: revision
      value: "{{ revision }}"
  pipelineSpec:
    params:
      - name: repo_url
      - name: revision
    workspaces:
      - name: source
    tasks:
      - name: fetch-source
        taskRef:
          name: git-clone
        workspaces:
          - name: output
            workspace: source
        params:
          - name: url
            value: $(params.repo_url)
          - name: revision
            value: $(params.revision)

      - name: gitleaks-version
        taskSpec:
          steps:
            - name: gitleaks
              image: ghcr.io/gitleaks/gitleaks:v8.30.1
              args:
                - version

      - name: gitleaks
        runAfter:
          - fetch-source
        workspaces:
          - name: source
            workspace: source
        taskSpec:
          workspaces:
            - name: source
          steps:
            - name: gitleaks
              image: ghcr.io/gitleaks/gitleaks:v8.30.1
              workingDir: $(workspaces.source.path)
              args:
                - git
                - $(workspaces.source.path)
                - --verbose

  workspaces:
    - name: source
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 2Gi