b12dd07410Namespace every PipelineRun under a single forgejo-mcp- prefix so runs
are unambiguous in shared op1st-pipelines (code-scans, on-pull-request,
on-push-to-main, on-tag-push-release, openspec-validate-{pr,push},
release-tools-on-{pull-request-build,tag-publish}). PaC matches on
annotations, not name, so triggering is unaffected.
70 lines
1.7 KiB
YAML
70 lines
1.7 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: PipelineRun
|
|
metadata:
|
|
name: forgejo-mcp-code-scans
|
|
annotations:
|
|
pipelinesascode.tekton.dev/on-event: "[push, pull_request]"
|
|
pipelinesascode.tekton.dev/on-target-branch: "[main]"
|
|
pipelinesascode.tekton.dev/task: "[git-clone]"
|
|
pipelinesascode.tekton.dev/max-keep-runs: "5"
|
|
pipelinesascode.tekton.dev/cancel-in-progress: "true"
|
|
spec:
|
|
params:
|
|
- name: repo_url
|
|
value: "{{ repo_url }}"
|
|
- name: revision
|
|
value: "{{ revision }}"
|
|
pipelineSpec:
|
|
params:
|
|
- name: repo_url
|
|
- name: revision
|
|
workspaces:
|
|
- name: source
|
|
tasks:
|
|
- name: fetch-source
|
|
taskRef:
|
|
name: git-clone
|
|
workspaces:
|
|
- name: output
|
|
workspace: source
|
|
params:
|
|
- name: url
|
|
value: $(params.repo_url)
|
|
- name: revision
|
|
value: $(params.revision)
|
|
|
|
- name: gitleaks-version
|
|
taskSpec:
|
|
steps:
|
|
- name: gitleaks
|
|
image: ghcr.io/gitleaks/gitleaks:v8.30.1
|
|
args:
|
|
- version
|
|
|
|
- name: gitleaks
|
|
runAfter:
|
|
- fetch-source
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
taskSpec:
|
|
workspaces:
|
|
- name: source
|
|
steps:
|
|
- name: gitleaks
|
|
image: ghcr.io/gitleaks/gitleaks:v8.30.1
|
|
workingDir: $(workspaces.source.path)
|
|
args:
|
|
- git
|
|
- $(workspaces.source.path)
|
|
- --verbose
|
|
|
|
workspaces:
|
|
- name: source
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|