Fix Tekton multi-PVC compile TaskRuns

.github/workflows/cluster-regression.yml

@@ -6,6 +6,12 @@
 name: cluster regression
 
 on:
+  pull_request:
+    paths:
+      - ".github/workflows/cluster-regression.yml"
+      - "helm/tekton-dag/**"
+      - "scripts/bootstrap-namespace.sh"
+      - "scripts/run-cluster-ci.sh"
   workflow_dispatch:
     inputs:
       isolation_repeats:
@@ -112,20 +118,39 @@ jobs:
           if [[ "${{ github.event.inputs.skip_newman || false }}" == "true" ]]; then
             extra+=(--skip-newman)
           fi
+          # RBAC/chart PRs need the deterministic Tekton Phase 2 + Newman gate.
+          # Isolation benchmarking remains part of nightly/manual/tag runs.
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            extra+=(--skip-isolation)
+          fi
           # Script defaults WITH_OPERATOR=true. Honor dispatch uncheck only.
           if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.with_operator }}" == "false" ]]; then
             extra+=(--skip-operator)
           fi
           bash scripts/run-cluster-ci.sh --isolation-repeats "$ISOLATION_EVAL_REPEATS" \
             --out "$ISOLATION_EVAL_OUT" "${extra[@]}" 2>&1 | tee cluster-ci.log
 
-      - name: Upload cluster CI log and CSV
+      - name: Collect cluster failure diagnostics
+        if: failure()
+        run: |
+          kubectl logs deployment/tekton-dag-orchestrator -n tekton-pipelines \
+            --all-containers --tail=-1 > orchestrator.log 2>&1 || true
+          kubectl auth can-i --list \
+            --as=system:serviceaccount:tekton-pipelines:tekton-pr-sa \
+            > pipeline-rbac.log 2>&1 || true
+          kubectl get stackruns,pipelineruns -n tekton-pipelines -o yaml \
+            > execution-resources.yaml 2>&1 || true
+
+      - name: Upload cluster CI diagnostics
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: cluster-ci-${{ github.sha }}
           path: |
             cluster-ci.log
             isolation-eval-measured.csv
+            orchestrator.log
+            pipeline-rbac.log
+            execution-resources.yaml
           if-no-files-found: warn
           retention-days: 30

.github/workflows/intercept-e2e.yml

@@ -0,0 +1,133 @@
+name: intercept product E2E
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/intercept-e2e.yml"
+      - "helm/tekton-dag/**"
+      - "scripts/bootstrap-namespace.sh"
+      - "scripts/run-product-intercept-e2e.sh"
+  workflow_dispatch:
+  schedule:
+    # Weekly product-path evidence on the default branch.
+    - cron: "43 7 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: intercept-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  product-path:
+    name: ${{ matrix.backend }} trigger-to-traffic
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        backend: [telepresence, mirrord]
+    env:
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/artifacts/${{ matrix.backend }}
+      E2E_GIT_SSH_PRIVATE_KEY: ${{ secrets.E2E_GIT_SSH_PRIVATE_KEY }}
+      INTERCEPT_E2E_TIMEOUT: "2100"
+      KIND_VERSION: "v0.27.0"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+
+      - name: Install Kind and Newman
+        run: |
+          curl -fsSL -o /tmp/kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"
+          echo "a6875aaea358acf0ac07786b1a6755d08fd640f4c79b7a2e46681cc13f49a04b  /tmp/kind" | sha256sum -c -
+          chmod +x /tmp/kind
+          sudo mv /tmp/kind /usr/local/bin/kind
+          npm install -g newman@6.2.1
+          ./scripts/bootstrap-regression-venv.sh
+
+      - name: Install cluster control plane
+        env:
+          CLUSTER_CI_GIT_REVISION: ${{ github.sha }}
+          CLUSTER_CI_GIT_URL: https://github.com/${{ github.repository }}.git
+        run: |
+          set -o pipefail
+          bash scripts/run-cluster-ci.sh --skip-isolation 2>&1 | tee cluster-setup.log
+
+      - name: Install application clone credential
+        run: |
+          kubectl create namespace staging --dry-run=client -o yaml | kubectl apply -f -
+          kubectl label namespace staging \
+            pod-security.kubernetes.io/enforce=privileged \
+            pod-security.kubernetes.io/audit=privileged \
+            pod-security.kubernetes.io/warn=privileged \
+            --overwrite
+          secret_args=()
+          if [[ -n "$E2E_GIT_SSH_PRIVATE_KEY" ]]; then
+            install -d -m 700 /tmp/e2e-ssh
+            printf '%s\n' "$E2E_GIT_SSH_PRIVATE_KEY" > /tmp/e2e-ssh/id_ed25519
+            chmod 600 /tmp/e2e-ssh/id_ed25519
+            secret_args+=(--from-file=id_ed25519=/tmp/e2e-ssh/id_ed25519)
+          else
+            echo "No E2E SSH key configured; public application repositories will use HTTPS."
+          fi
+          kubectl create secret generic ssh-key-secret \
+            -n tekton-pipelines \
+            "${secret_args[@]}" \
+            --dry-run=client -o yaml | kubectl apply -f -
+          rm -rf /tmp/e2e-ssh
+
+      - name: Build pipeline tool images
+        run: |
+          set -o pipefail
+          bash build-images/build-and-push.sh localhost:5000 latest 2>&1 | tee build-images.log
+
+      - name: Install Telepresence traffic manager
+        if: matrix.backend == 'telepresence'
+        run: ./scripts/install-telepresence-traffic-manager.sh
+
+      - name: Run authenticated product path
+        env:
+          PR_NUMBER: ${{ github.run_number }}
+        run: |
+          set -o pipefail
+          bash scripts/run-product-intercept-e2e.sh \
+            --intercept-backend "${{ matrix.backend }}" \
+            --pr "$PR_NUMBER" 2>&1 | tee "intercept-${{ matrix.backend }}.log"
+
+      - name: Collect failure diagnostics
+        if: failure()
+        run: |
+          mkdir -p "$E2E_ARTIFACT_DIR"
+          kubectl get stackrun,pipelinerun,taskrun -A -o yaml \
+            > "$E2E_ARTIFACT_DIR/all-tekton-resources.yaml" 2>&1 || true
+          kubectl get pods,deployments,services -A -o wide \
+            > "$E2E_ARTIFACT_DIR/all-workloads.txt" 2>&1 || true
+          kubectl logs -n tekton-pipelines -l app=tekton-dag-operator \
+            --all-containers=true --prefix=true \
+            > "$E2E_ARTIFACT_DIR/operator.log" 2>&1 || true
+
+      - name: Upload product-path evidence
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: intercept-e2e-${{ matrix.backend }}-${{ github.sha }}
+          path: |
+            artifacts/${{ matrix.backend }}/
+            cluster-setup.log
+            build-images.log
+            intercept-${{ matrix.backend }}.log
+          if-no-files-found: warn
+          retention-days: 30

.github/workflows/local-regression.yml

@@ -56,6 +56,18 @@ jobs:
           go-version: "1.23"
           cache-dependency-path: operator/go.sum
 
+      - name: Install Helm
+        env:
+          HELM_VERSION: v4.3.0
+          HELM_SHA256: 86584a54def73570558f66f5111cc53dfed56689637ae32c1201205d494f54fb
+        run: |
+          archive="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+          curl -fsSLo "/tmp/${archive}" "https://get.helm.sh/${archive}"
+          echo "${HELM_SHA256}  /tmp/${archive}" | sha256sum -c -
+          tar -xzf "/tmp/${archive}" -C /tmp
+          sudo install /tmp/linux-amd64/helm /usr/local/bin/helm
+          helm version
+
       - name: Bootstrap Python venv
         run: ./scripts/bootstrap-regression-venv.sh
 

.github/workflows/operator.yml

@@ -4,11 +4,13 @@ on:
   pull_request:
     paths:
       - "operator/**"
+      - "scripts/install-tekton.sh"
       - ".github/workflows/operator.yml"
   push:
     branches: [main]
     paths:
       - "operator/**"
+      - "scripts/install-tekton.sh"
       - ".github/workflows/operator.yml"
   workflow_dispatch:
 
@@ -29,22 +31,78 @@ jobs:
         working-directory: operator
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: operator/go.mod
           cache-dependency-path: operator/go.sum
 
       - name: Check formatting
         run: test -z "$(gofmt -l .)"
 
+      - name: Lint
+        env:
+          # golangci-lint v2.13.2 is built with Go 1.26; setup-go otherwise
+          # forces GOTOOLCHAIN=local at the module's Go 1.23 version.
+          GOTOOLCHAIN: auto
+        run: make lint
+
       - name: Unit tests
         run: go test ./internal/pipeline/ ./internal/controller/ ./api/... -race -coverprofile=unit-cover.out
 
-      - name: Envtest
+      - name: Envtest domain integration
         run: make test-envtest
 
       - name: Generated files are current
         run: git diff --exit-code
+
+  kind-domain:
+    name: Kind StackRun domain E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Install pinned Kind
+        run: |
+          curl -fsSL -o /tmp/kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
+          echo "a6875aaea358acf0ac07786b1a6755d08fd640f4c79b7a2e46681cc13f49a04b  /tmp/kind" | sha256sum -c -
+          chmod +x /tmp/kind
+          sudo mv /tmp/kind /usr/local/bin/kind
+
+      - name: Reconcile sample StackRun in Kind
+        env:
+          CLUSTER_CI_GIT_REVISION: ${{ github.sha }}
+          CLUSTER_CI_GIT_URL: https://github.com/${{ github.repository }}.git
+        run: |
+          set -o pipefail
+          bash scripts/run-cluster-ci.sh \
+            --skip-isolation --skip-phase2 --skip-newman 2>&1 | tee operator-kind-e2e.log
+
+      - name: Collect operator failure diagnostics
+        if: failure()
+        run: |
+          kubectl get stack,stackrun,pipelinerun -A -o yaml > operator-resources.yaml 2>&1 || true
+          kubectl get pods,deployments -A -o wide > operator-workloads.txt 2>&1 || true
+          kubectl logs -n tekton-pipelines -l app=tekton-dag-operator \
+            --all-containers=true --prefix=true > operator-controller.log 2>&1 || true
+          kubectl get events -A --sort-by=.lastTimestamp > operator-events.txt 2>&1 || true
+
+      - name: Upload Kind E2E diagnostics
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: operator-kind-e2e-${{ github.sha }}
+          path: |
+            operator-kind-e2e.log
+            operator-resources.yaml
+            operator-workloads.txt
+            operator-controller.log
+            operator-events.txt
+          if-no-files-found: warn
+          retention-days: 14