fix(tekton): resolve optional hooks deterministically

.github/workflows/intercept-e2e.yml

@@ -83,7 +83,7 @@ jobs:
           else
             echo "No E2E SSH key configured; public application repositories will use HTTPS."
           fi
-          kubectl create secret generic git-ssh-key \
+          kubectl create secret generic ssh-key-secret \
             -n tekton-pipelines \
             "${secret_args[@]}" \
             --dry-run=client -o yaml | kubectl apply -f -

libs/tekton-dag-common/tests/test_m17_intercept_automation.py

@@ -18,6 +18,7 @@ def test_intercept_workflow_has_explicit_backend_cadence_and_evidence():
     assert "E2E_GIT_SSH_PRIVATE_KEY" in workflow
     assert "Require E2E SSH credential" not in workflow
     assert "public application repositories will use HTTPS" in workflow
+    assert "kubectl create secret generic ssh-key-secret" in workflow
     assert "pod-security.kubernetes.io/enforce=privileged" in workflow
     assert "run-product-intercept-e2e.sh" in workflow
     assert "if: always()" in workflow
@@ -36,6 +37,7 @@ def test_product_script_covers_trigger_stackrun_tests_and_cleanup():
     assert "status.pipelineRunName" in script
     assert "pipeline-results.json" in script
     assert "tekton.dev/pipelineTask=run-tests" in script
+    assert 'pipeline_status" == "False"' in script
     assert "pr-traffic-evidence.log" in script
     assert "kubectl delete pipelinerun" in script
     assert "kubectl delete stackrun" in script

libs/tekton-dag-common/tests/test_pipeline_hook_taskrefs.py

@@ -37,6 +37,17 @@ def test_hook_tasks_use_cluster_resolver():
     found = set()
     for rel in PIPELINES:
         data = yaml.safe_load((ROOT / rel).read_text())
+        hook_params = {
+            param["name"]: param.get("default")
+            for param in data["spec"].get("params") or []
+            if param["name"] in {
+                "pre-build-task",
+                "post-build-task",
+                "pre-test-task",
+                "post-test-task",
+            }
+        }
+        assert all(value == "tekton-dag-hook-noop" for value in hook_params.values())
         for task in _iter_pipeline_tasks(data.get("spec") or {}):
             if task.get("name") not in HOOK_TASKS:
                 continue
@@ -48,4 +59,18 @@ def test_hook_tasks_use_cluster_resolver():
             params = {p["name"]: p.get("value") for p in ref.get("params") or []}
             assert params.get("kind") == "task"
             assert params.get("name", "").startswith("$(params.")
+            assert task["when"][0]["values"] == ["tekton-dag-hook-noop"]
     assert found == HOOK_TASKS
+
+
+def test_hook_noop_sentinel_is_installed_and_accepts_all_hook_inputs():
+    task = yaml.safe_load((ROOT / "tasks/tekton-dag-hook-noop.yaml").read_text())
+
+    assert task["metadata"]["name"] == "tekton-dag-hook-noop"
+    assert {param["name"] for param in task["spec"]["params"]} == {
+        "stack-json",
+        "build-apps",
+        "built-images",
+        "image-registry",
+    }
+    assert task["spec"]["workspaces"] == [{"name": "source", "optional": True}]

pipeline/stack-bootstrap-pipeline.yaml

@@ -45,11 +45,11 @@ spec:
       description: "Max concurrent Kaniko pods for containerize. 0 = unlimited."
       default: "0"
     - name: pre-build-task
-      description: "Optional Tekton Task to run after clone, before compile. Empty = skip."
-      default: ""
+      description: "Optional Tekton Task to run after clone, before compile."
+      default: "tekton-dag-hook-noop"
     - name: post-build-task
-      description: "Optional Tekton Task to run after containerize, before deploy. Empty = skip."
-      default: ""
+      description: "Optional Tekton Task to run after containerize, before deploy."
+      default: "tekton-dag-hook-noop"
   workspaces:
     - name: shared-workspace
     - name: ssh-key
@@ -123,7 +123,7 @@ spec:
       when:
         - input: $(params.pre-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       # Tekton v1.6+ validates taskRef.name as a DNS label before param
       # substitution, so $(params.*) cannot be the name field. Cluster
       # resolver takes the Task name as a param (skipped when empty).
@@ -282,7 +282,7 @@ spec:
       when:
         - input: $(params.post-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:

pipeline/stack-merge-pipeline.yaml

@@ -51,11 +51,11 @@ spec:
       description: "Image for Composer/PHP compile step"
       default: ""
     - name: pre-build-task
-      description: "Optional Tekton Task to run after clone, before compile. Empty = skip."
-      default: ""
+      description: "Optional Tekton Task to run after clone, before compile."
+      default: "tekton-dag-hook-noop"
     - name: post-build-task
-      description: "Optional Tekton Task to run after containerize, before tag-release. Empty = skip."
-      default: ""
+      description: "Optional Tekton Task to run after containerize, before tag-release."
+      default: "tekton-dag-hook-noop"
 
   workspaces:
     - name: shared-workspace
@@ -156,7 +156,7 @@ spec:
       when:
         - input: $(params.pre-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:
@@ -308,7 +308,7 @@ spec:
       when:
         - input: $(params.post-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:

pipeline/stack-pr-pipeline.yaml

@@ -77,17 +77,17 @@ spec:
       description: "Max concurrent Kaniko pods for containerize. 0 = unlimited."
       default: "0"
     - name: pre-build-task
-      description: "Optional Tekton Task name to run after clone, before compile (e.g. code-gen, license-scan). Empty = skip."
-      default: ""
+      description: "Optional Tekton Task name to run after clone, before compile (e.g. code-gen, license-scan)."
+      default: "tekton-dag-hook-noop"
     - name: post-build-task
-      description: "Optional Tekton Task name to run after containerize, before deploy (e.g. image-scan, SBOM). Empty = skip."
-      default: ""
+      description: "Optional Tekton Task name to run after containerize, before deploy (e.g. image-scan, SBOM)."
+      default: "tekton-dag-hook-noop"
     - name: pre-test-task
-      description: "Optional Tekton Task name to run after deploy, before tests (e.g. seed-data). Empty = skip."
-      default: ""
+      description: "Optional Tekton Task name to run after deploy, before tests (e.g. seed-data)."
+      default: "tekton-dag-hook-noop"
     - name: post-test-task
-      description: "Optional Tekton Task name to run in finally block after tests (e.g. slack-notify). Empty = skip."
-      default: ""
+      description: "Optional Tekton Task name to run in finally block after tests (e.g. slack-notify)."
+      default: "tekton-dag-hook-noop"
     - name: max-retries
       description: >
         Preferred retry count for infrastructure-sensitive tasks (compile/containerize).
@@ -197,7 +197,7 @@ spec:
       when:
         - input: $(params.pre-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:
@@ -362,7 +362,7 @@ spec:
       when:
         - input: $(params.post-build-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:
@@ -483,7 +483,7 @@ spec:
       when:
         - input: $(params.pre-test-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:
@@ -550,7 +550,7 @@ spec:
       when:
         - input: $(params.post-test-task)
           operator: notin
-          values: [""]
+          values: ["tekton-dag-hook-noop"]
       taskRef:
         resolver: cluster
         params:

scripts/run-product-intercept-e2e.sh

@@ -145,6 +145,7 @@ trigger_run() {
 
 wait_for_stackrun() {
   local stackrun="$1" label="$2" elapsed=0 phase="" pipeline_run=""
+  local pipeline_status="" pipeline_reason=""
   while (( elapsed < TIMEOUT )); do
     phase="$(kubectl get stackrun "$stackrun" -n "$NAMESPACE" \
       -o jsonpath='{.status.phase}' 2>/dev/null || true)"
@@ -158,6 +159,16 @@ wait_for_stackrun() {
         die "$label StackRun $stackrun failed with phase $phase"
         ;;
     esac
+    if [[ -n "$pipeline_run" ]]; then
+      pipeline_status="$(kubectl get pipelinerun "$pipeline_run" -n "$NAMESPACE" \
+        -o jsonpath='{.status.conditions[?(@.type=="Succeeded")].status}' 2>/dev/null || true)"
+      pipeline_reason="$(kubectl get pipelinerun "$pipeline_run" -n "$NAMESPACE" \
+        -o jsonpath='{.status.conditions[?(@.type=="Succeeded")].reason}' 2>/dev/null || true)"
+      if [[ "$pipeline_status" == "False" ]]; then
+        collect_run_evidence "$stackrun" "$label"
+        die "$label PipelineRun $pipeline_run failed with reason ${pipeline_reason:-Unknown}"
+      fi
+    fi
     sleep "$POLL_INTERVAL"
     elapsed=$((elapsed + POLL_INTERVAL))
   done

tasks/tekton-dag-hook-noop.yaml

@@ -0,0 +1,29 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: tekton-dag-hook-noop
+  labels:
+    app.kubernetes.io/part-of: tekton-job-standardization
+    app.kubernetes.io/version: "1.0.0"
+spec:
+  description: >
+    Resolvable sentinel for optional remote hook references. Pipelines skip this
+    Task with a when expression; its contract keeps validation deterministic.
+  params:
+    - name: stack-json
+      default: ""
+    - name: build-apps
+      default: ""
+    - name: built-images
+      default: "{}"
+    - name: image-registry
+      default: ""
+  workspaces:
+    - name: source
+      optional: true
+  steps:
+    - name: noop
+      image: alpine:3.20
+      script: |
+        #!/bin/sh
+        echo "Optional hook not configured"