Stabilize default-branch intercept and Action-pin CI

.github/dependabot.yml

@@ -7,6 +7,9 @@ updates:
     groups:
       github-actions:
         patterns: ["*"]
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: gomod
     directory: /operator

.github/workflows/intercept-e2e.yml

@@ -6,6 +6,7 @@ on:
       - ".github/workflows/intercept-e2e.yml"
       - "helm/tekton-dag/**"
       - "scripts/bootstrap-namespace.sh"
+      - "scripts/install-tekton.sh"
       - "scripts/run-product-intercept-e2e.sh"
   workflow_dispatch:
   schedule:

libs/tekton-dag-common/tests/test_m17_intercept_automation.py

@@ -12,6 +12,7 @@ def test_intercept_workflow_has_explicit_backend_cadence_and_evidence():
     assert '".github/workflows/intercept-e2e.yml"' in workflow
     assert '"helm/tekton-dag/**"' in workflow
     assert '"scripts/bootstrap-namespace.sh"' in workflow
+    assert '"scripts/install-tekton.sh"' in workflow
     assert "workflow_dispatch:" in workflow
     assert "schedule:" in workflow
     assert "backend: [telepresence, mirrord]" in workflow
@@ -61,3 +62,10 @@ def test_app_clone_supports_public_https_without_ssh_key():
     assert 'URL="https://github.com/${REPO}.git"' in task
     assert 'URL="git@github.com:${REPO}.git"' in task
     assert "ssh-key workspace must contain" not in task
+
+
+def test_tekton_install_allows_source_and_build_cache_pvcs():
+    install = (ROOT / "scripts/install-tekton.sh").read_text()
+
+    assert "kubectl patch configmap feature-flags -n tekton-pipelines" in install
+    assert '''-p '{"data":{"coschedule":"disabled"}}' '''.strip() in install

libs/tekton-dag-common/tests/test_m17_operator_ci.py

@@ -1,15 +1,27 @@
 """Static acceptance checks for the M17.5 operator CI gate."""
 
+import re
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[3]
+SHA_PINNED_ACTION = re.compile(r"uses:\s+([\w.-]+/[\w.-]+)@([0-9a-f]{40})\b")
+
+
+def _assert_sha_pinned(workflow: str, *actions: str) -> None:
+    pins = {match.group(1) for match in SHA_PINNED_ACTION.finditer(workflow)}
+    missing = [action for action in actions if action not in pins]
+    assert not missing, f"SHA-pinned actions missing: {missing}"
 
 
 def test_operator_workflow_runs_pinned_quality_and_domain_jobs():
     workflow = (ROOT / ".github/workflows/operator.yml").read_text()
 
-    assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in workflow
-    assert "actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e" in workflow
+    _assert_sha_pinned(
+        workflow,
+        "actions/checkout",
+        "actions/setup-go",
+        "actions/upload-artifact",
+    )
     assert "make lint" in workflow
     assert "GOTOOLCHAIN: auto" in workflow
     assert "make test-envtest" in workflow
@@ -18,7 +30,6 @@ def test_operator_workflow_runs_pinned_quality_and_domain_jobs():
     assert "v0.27.0/kind-linux-amd64" in workflow
     assert "sha256sum -c -" in workflow
     assert "--skip-isolation --skip-phase2 --skip-newman" in workflow
-    assert "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" in workflow
 
 
 def test_operator_domain_integration_covers_m17_lifecycle_contracts():

scripts/install-tekton.sh

@@ -47,6 +47,12 @@ kubectl get namespace "$NAMESPACE" &>/dev/null || kubectl create namespace "$NAM
 # 1. Tekton Pipelines (kubectl apply is idempotent)
 echo "  Installing Tekton Pipelines..."
 kubectl apply -f "$TEKTON_PIPELINE_URL"
+# Compile tasks bind the run-scoped source PVC and the persistent build-cache
+# PVC. Tekton's default "workspaces" coscheduling mode rejects any TaskRun
+# with more than one PVC before creating its Pod.
+echo "  Allowing TaskRuns to bind source and build-cache PVCs..."
+kubectl patch configmap feature-flags -n tekton-pipelines --type merge \
+  -p '{"data":{"coschedule":"disabled"}}'
 # Relax Pod Security for the target namespace (Kind enforces restricted; catalog/git-clone task pods need it)
 echo "  Configuring namespace $NAMESPACE for Pod Security (Kind/local clusters)..."
 kubectl label namespace "$NAMESPACE" pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true