From 3e1166e714e58c2e2446017ef1a82c8b15309e61 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 16 Sep 2026 17:40:36 +0000 Subject: [PATCH 1/2] Disable Tekton multi-PVC coschedule on default-branch CI Scheduled intercept and Dependabot Action bumps fail on main because compile TaskRuns bind source and build-cache PVCs. Patch feature-flags to coschedule=disabled, keep Action pin tests digest-agnostic, and limit github-actions Dependabot to minor/patch. Co-authored-by: jmjava --- .github/dependabot.yml | 3 +++ .../tests/test_m17_intercept_automation.py | 7 +++++++ .../tests/test_m17_operator_ci.py | 17 ++++++++++++++--- scripts/install-tekton.sh | 6 ++++++ 4 files changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 22afe4d..e0221c3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,9 @@ updates: groups: github-actions: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: gomod directory: /operator diff --git a/libs/tekton-dag-common/tests/test_m17_intercept_automation.py b/libs/tekton-dag-common/tests/test_m17_intercept_automation.py index fcfa74f..2f97a0e 100644 --- a/libs/tekton-dag-common/tests/test_m17_intercept_automation.py +++ b/libs/tekton-dag-common/tests/test_m17_intercept_automation.py @@ -61,3 +61,10 @@ def test_app_clone_supports_public_https_without_ssh_key(): assert 'URL="https://github.com/${REPO}.git"' in task assert 'URL="git@github.com:${REPO}.git"' in task assert "ssh-key workspace must contain" not in task + + +def test_tekton_install_allows_source_and_build_cache_pvcs(): + install = (ROOT / "scripts/install-tekton.sh").read_text() + + assert "kubectl patch configmap feature-flags -n tekton-pipelines" in install + assert '''-p '{"data":{"coschedule":"disabled"}}' '''.strip() in install diff --git a/libs/tekton-dag-common/tests/test_m17_operator_ci.py b/libs/tekton-dag-common/tests/test_m17_operator_ci.py index 7ccb88f..f0d2278 100644 --- a/libs/tekton-dag-common/tests/test_m17_operator_ci.py +++ b/libs/tekton-dag-common/tests/test_m17_operator_ci.py @@ -1,15 +1,27 @@ """Static acceptance checks for the M17.5 operator CI gate.""" +import re from pathlib import Path ROOT = Path(__file__).resolve().parents[3] +SHA_PINNED_ACTION = re.compile(r"uses:\s+([\w.-]+/[\w.-]+)@([0-9a-f]{40})\b") + + +def _assert_sha_pinned(workflow: str, *actions: str) -> None: + pins = {match.group(1) for match in SHA_PINNED_ACTION.finditer(workflow)} + missing = [action for action in actions if action not in pins] + assert not missing, f"SHA-pinned actions missing: {missing}" def test_operator_workflow_runs_pinned_quality_and_domain_jobs(): workflow = (ROOT / ".github/workflows/operator.yml").read_text() - assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in workflow - assert "actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e" in workflow + _assert_sha_pinned( + workflow, + "actions/checkout", + "actions/setup-go", + "actions/upload-artifact", + ) assert "make lint" in workflow assert "GOTOOLCHAIN: auto" in workflow assert "make test-envtest" in workflow @@ -18,7 +30,6 @@ def test_operator_workflow_runs_pinned_quality_and_domain_jobs(): assert "v0.27.0/kind-linux-amd64" in workflow assert "sha256sum -c -" in workflow assert "--skip-isolation --skip-phase2 --skip-newman" in workflow - assert "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" in workflow def test_operator_domain_integration_covers_m17_lifecycle_contracts(): diff --git a/scripts/install-tekton.sh b/scripts/install-tekton.sh index e9dfae8..01e5d72 100755 --- a/scripts/install-tekton.sh +++ b/scripts/install-tekton.sh @@ -47,6 +47,12 @@ kubectl get namespace "$NAMESPACE" &>/dev/null || kubectl create namespace "$NAM # 1. Tekton Pipelines (kubectl apply is idempotent) echo " Installing Tekton Pipelines..." kubectl apply -f "$TEKTON_PIPELINE_URL" +# Compile tasks bind the run-scoped source PVC and the persistent build-cache +# PVC. Tekton's default "workspaces" coscheduling mode rejects any TaskRun +# with more than one PVC before creating its Pod. +echo " Allowing TaskRuns to bind source and build-cache PVCs..." +kubectl patch configmap feature-flags -n tekton-pipelines --type merge \ + -p '{"data":{"coschedule":"disabled"}}' # Relax Pod Security for the target namespace (Kind enforces restricted; catalog/git-clone task pods need it) echo " Configuring namespace $NAMESPACE for Pod Security (Kind/local clusters)..." kubectl label namespace "$NAMESPACE" pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true From ede860bacaff7cd9ac0e0a6e8fd86b799fa46d42 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 16 Sep 2026 17:42:08 +0000 Subject: [PATCH 2/2] Run intercept E2E when the Tekton installer changes Default-branch intercept never fired on the coschedule fix because install-tekton.sh was not in the workflow path filter. Co-authored-by: jmjava --- .github/workflows/intercept-e2e.yml | 1 + libs/tekton-dag-common/tests/test_m17_intercept_automation.py | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/intercept-e2e.yml b/.github/workflows/intercept-e2e.yml index 70935f8..c86f6fd 100644 --- a/.github/workflows/intercept-e2e.yml +++ b/.github/workflows/intercept-e2e.yml @@ -6,6 +6,7 @@ on: - ".github/workflows/intercept-e2e.yml" - "helm/tekton-dag/**" - "scripts/bootstrap-namespace.sh" + - "scripts/install-tekton.sh" - "scripts/run-product-intercept-e2e.sh" workflow_dispatch: schedule: diff --git a/libs/tekton-dag-common/tests/test_m17_intercept_automation.py b/libs/tekton-dag-common/tests/test_m17_intercept_automation.py index 2f97a0e..cbceade 100644 --- a/libs/tekton-dag-common/tests/test_m17_intercept_automation.py +++ b/libs/tekton-dag-common/tests/test_m17_intercept_automation.py @@ -12,6 +12,7 @@ def test_intercept_workflow_has_explicit_backend_cadence_and_evidence(): assert '".github/workflows/intercept-e2e.yml"' in workflow assert '"helm/tekton-dag/**"' in workflow assert '"scripts/bootstrap-namespace.sh"' in workflow + assert '"scripts/install-tekton.sh"' in workflow assert "workflow_dispatch:" in workflow assert "schedule:" in workflow assert "backend: [telepresence, mirrord]" in workflow