b12dd07410Namespace every PipelineRun under a single forgejo-mcp- prefix so runs
are unambiguous in shared op1st-pipelines (code-scans, on-pull-request,
on-push-to-main, on-tag-push-release, openspec-validate-{pr,push},
release-tools-on-{pull-request-build,tag-publish}). PaC matches on
annotations, not name, so triggering is unaffected.
88 lines
2.7 KiB
YAML
88 lines
2.7 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: PipelineRun
|
|
metadata:
|
|
name: forgejo-mcp-release-tools-on-pull-request-build
|
|
annotations:
|
|
pipelinesascode.tekton.dev/on-event: "[pull_request]"
|
|
pipelinesascode.tekton.dev/on-target-branch: "[main]"
|
|
# A4 patch: files.exists (CEL list macro) — fires when ANY changed file
|
|
# is under the release-tools trees. files.all would silently skip hybrid
|
|
# PRs (image change + unrelated typo fix elsewhere).
|
|
pipelinesascode.tekton.dev/on-cel-expression: |
|
|
event == "pull_request" && target_branch == "main" &&
|
|
files.exists(p, p.matches("^(image/release-tools/|\\.tekton/release-tools).*"))
|
|
pipelinesascode.tekton.dev/task: "[git-clone, .tekton/release-tools/tasks/build-image.yaml, .tekton/release-tools/tasks/verify-image-tools.yaml, .tekton/release-tools/tasks/syft-scan-image.yaml]"
|
|
pipelinesascode.tekton.dev/max-keep-runs: "5"
|
|
pipelinesascode.tekton.dev/cancel-in-progress: "true"
|
|
spec:
|
|
params:
|
|
- name: repo_url
|
|
value: "{{ repo_url }}"
|
|
- name: revision
|
|
value: "{{ revision }}"
|
|
pipelineSpec:
|
|
params:
|
|
- name: repo_url
|
|
- name: revision
|
|
workspaces:
|
|
- name: source
|
|
tasks:
|
|
- name: fetch-source
|
|
taskRef:
|
|
name: git-clone
|
|
workspaces:
|
|
- name: output
|
|
workspace: source
|
|
params:
|
|
- name: url
|
|
value: $(params.repo_url)
|
|
- name: revision
|
|
value: $(params.revision)
|
|
|
|
- name: build-image
|
|
taskRef:
|
|
name: release-tools-build-image
|
|
runAfter:
|
|
- fetch-source
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
params:
|
|
- name: IMAGE
|
|
value: "release-tools:pr-$(context.pipelineRun.name)"
|
|
- name: CONTEXT
|
|
value: image/release-tools
|
|
- name: CONTAINERFILE
|
|
value: Containerfile
|
|
|
|
- name: verify-tools
|
|
taskRef:
|
|
name: release-tools-verify-image-tools
|
|
runAfter:
|
|
- build-image
|
|
params:
|
|
- name: IMAGE_REF
|
|
value: $(tasks.build-image.results.IMAGE_REF)
|
|
|
|
- name: scan-sbom
|
|
taskRef:
|
|
name: release-tools-syft-scan-image
|
|
runAfter:
|
|
- verify-tools
|
|
workspaces:
|
|
- name: source
|
|
workspace: source
|
|
params:
|
|
- name: IMAGE_REF
|
|
value: $(tasks.build-image.results.IMAGE_REF)
|
|
|
|
workspaces:
|
|
- name: source
|
|
volumeClaimTemplate:
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
# Image build workspace: full repo checkout + buildah layer cache.
|
|
storage: 10Gi
|