Tekton Mastery:
Practical Reference

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: tekton-demo
nodes:
  - role: control-plane
    # Expose ports for NodePort services (useful for EventListeners in Video 5)
    extraPortMappings:
      - containerPort: 30000
        hostPort: 30000
        protocol: TCP
      - containerPort: 30001
        hostPort: 30001
        protocol: TCP
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
# Kind uses Docker — set resources in Docker Desktop:
# Settings > Resources:  CPUs: 4+   Memory: 8 GB+   Disk: 30 GB+

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: hello-world
  labels:
    app.kubernetes.io/version: "1.0"
  annotations:
    tekton.dev/displayName: "Hello World"
    tekton.dev/description: "A simple hello world to demonstrate Task structure"
spec:
  description: "Greets a user and shows basic Tekton Task concepts"
  params:
    - name: name
      type: string
      default: "Tekton Learner"
      description: "The name of the person to greet"
    - name: language
      type: string
      default: "english"
      description: "Greeting language: english, spanish, french"
  results:
    - name: greeting
      description: "The full greeting message that was printed"
  steps:
    - name: greet
      image: alpine:3.18
      env:
        - name: GREETING_NAME
          value: "$(params.name)"
        - name: LANG_CHOICE
          value: "$(params.language)"
      script: |
        #!/bin/sh
        set -e
        case "$LANG_CHOICE" in
          spanish) MSG="¡Hola, $GREETING_NAME! Bienvenido a Tekton." ;;
          french)  MSG="Bonjour, $GREETING_NAME! Bienvenue sur Tekton." ;;
          *)       MSG="Hello, $GREETING_NAME! Welcome to Tekton." ;;
        esac
        echo "$MSG"
        # Write the greeting as a Task Result
        printf '%s' "$MSG" | tee "$(results.greeting.path)"
    - name: show-tekton-facts
      image: alpine:3.18
      script: |
        #!/bin/sh
        echo ""
        echo "=== About This Execution ==="
        echo "This step runs AFTER the greet step in the SAME Pod."
        echo "Hostname (Pod name): $(hostname)"
        echo "Date: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
        echo "Tekton injects metadata via the downward API."
        echo "Each Step is a separate container init that runs sequentially."

apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
  name: hello-world-run-001
  labels:
    # Labels make it easy to query related runs
    task-name: hello-world
    run-by: demo-video-2
spec:
  taskRef:
    name: hello-world
  params:
    - name: name
      value: "Konflux Engineer"
    - name: language
      value: "english"

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: build-info
  annotations:
    tekton.dev/displayName: "Build Info Collector"
spec:
  description: "Collects build metadata and surfaces it as Task Results for downstream tasks"
  params:
    - name: image-name
      type: string
      description: "The name of the image being built (e.g. myapp)"
    - name: git-revision
      type: string
      default: "main"
      description: "Git revision being built"
    - name: registry
      type: string
      default: "quay.io/myorg"
      description: "Target container registry"
  results:
    - name: image-url
      description: "Full image URL including registry and name"
    - name: build-timestamp
      description: "Unix timestamp when the build started"
    - name: image-tag
      description: "The tag that will be applied to the image"
  # stepTemplate applies these fields to ALL steps — avoids repetition
  stepTemplate:
    image: alpine:3.18
    env:
      - name: IMAGE_NAME
        value: "$(params.image-name)"
      - name: GIT_REVISION
        value: "$(params.git-revision)"
      - name: REGISTRY
        value: "$(params.registry)"
  steps:
    - name: compute-tag
      script: |
        #!/bin/sh
        set -e
        # In real pipelines this comes from git describe or the commit SHA
        TAG="$(date -u '+%Y%m%d')-${GIT_REVISION}"
        echo "Computed image tag: $TAG"
        printf '%s' "$TAG" | tee "$(results.image-tag.path)"

    - name: compute-image-url
      script: |
        #!/bin/sh
        set -e
        TAG=$(cat "$(results.image-tag.path)")
        IMAGE_URL="${REGISTRY}/${IMAGE_NAME}:${TAG}"
        echo "Full image URL: $IMAGE_URL"
        printf '%s' "$IMAGE_URL" | tee "$(results.image-url.path)"

    - name: record-timestamp
      script: |
        #!/bin/sh
        set -e
        TS=$(date -u '+%s')
        echo "Build timestamp: $TS"
        printf '%s' "$TS" | tee "$(results.build-timestamp.path)"

    - name: print-summary
      script: |
        #!/bin/sh
        echo ""
        echo "=== Build Info Summary ==="
        echo "Image:     $(cat $(results.image-url.path))"
        echo "Tag:       $(cat $(results.image-tag.path))"
        echo "Timestamp: $(cat $(results.build-timestamp.path))"
        echo ""
        echo "These results are now available to any downstream Task"
        echo "in a Pipeline via: \$(tasks.build-info.results.image-url)"

---
# Task 1: Validates the repository URL and extracts the repo name
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: validate-repo
spec:
  description: "Validates a Git repository URL and extracts the project name"
  params:
    - name: repo-url
      type: string
  results:
    - name: repo-name
      description: "Short repository name extracted from the URL"
    - name: repo-host
      description: "The hosting service: github or gitlab"
  steps:
    - name: validate-and-extract
      image: alpine:3.18
      env:
        - name: REPO_URL
          value: "$(params.repo-url)"
      script: |
        #!/bin/sh
        set -e
        echo "Validating: $REPO_URL"
        if echo "$REPO_URL" | grep -q "github.com"; then
          HOST="github"
        elif echo "$REPO_URL" | grep -q "gitlab.com"; then
          HOST="gitlab"
        else
          echo "ERROR: Unsupported host. Use github.com or gitlab.com"
          exit 1
        fi
        REPO_NAME=$(echo "$REPO_URL" | sed 's|.*/||' | sed 's|\.git$||')
        echo "Host: $HOST"
        echo "Repo name: $REPO_NAME"
        printf '%s' "$HOST"      | tee "$(results.repo-host.path)"
        printf '%s' "$REPO_NAME" | tee "$(results.repo-name.path)"
---
# Task 2: Simulates a code check (used for both lint and test steps)
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: run-check
spec:
  description: "Simulates running a code quality check (lint or test)"
  params:
    - name: check-type
      type: string
      description: "Type of check: lint or test"
    - name: repo-name
      type: string
  results:
    - name: status
      description: "Check result: pass or fail"
    - name: finding-count
      description: "Number of findings (0 = clean)"
  steps:
    - name: execute-check
      image: alpine:3.18
      env:
        - name: CHECK_TYPE
          value: "$(params.check-type)"
        - name: REPO_NAME
          value: "$(params.repo-name)"
      script: |
        #!/bin/sh
        set -e
        echo "Running $CHECK_TYPE check for: $REPO_NAME"
        echo "Simulating work..."
        sleep 2
        COUNT=0
        echo "$CHECK_TYPE complete. Findings: $COUNT"
        printf '%s' "pass"  | tee "$(results.status.path)"
        printf '%s' "$COUNT" | tee "$(results.finding-count.path)"
---
# Task 3: Generates a summary report from all previous task results
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: quality-report
spec:
  description: "Generates a final quality report from lint and test results"
  params:
    - name: repo-name
      type: string
    - name: repo-host
      type: string
    - name: lint-status
      type: string
    - name: lint-findings
      type: string
    - name: test-status
      type: string
    - name: test-findings
      type: string
  results:
    - name: summary
      description: "One-line quality summary"
  steps:
    - name: generate
      image: alpine:3.18
      script: |
        #!/bin/sh
        REPO="$(params.repo-name)"
        HOST="$(params.repo-host)"
        LINT="$(params.lint-status) ($(params.lint-findings) issues)"
        TEST="$(params.test-status) ($(params.test-findings) findings)"
        SUMMARY="[$HOST] $REPO — Lint: $LINT | Tests: $TEST"
        echo ""
        echo "=========================================="
        echo " QUALITY REPORT"
        echo "=========================================="
        echo " Repository : $REPO"
        echo " Host       : $HOST"
        echo " Lint       : $LINT"
        echo " Tests      : $TEST"
        echo "=========================================="
        printf '%s' "$SUMMARY" | tee "$(results.summary.path)"

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: code-quality-pipeline
  annotations:
    tekton.dev/displayName: "Code Quality Pipeline"
    tekton.dev/description: "Validates repo, runs lint + test in parallel, reports results"
spec:
  description: "Demonstrates task chaining, parallel execution, and result passing"
  params:
    - name: repo-url
      type: string
      description: "Full URL of the Git repository to check"
      default: "https://github.com/tektoncd/pipeline"
    - name: revision
      type: string
      default: "main"
  # Pipeline surfaces a result from one of its tasks to callers
  results:
    - name: quality-summary
      description: "Final quality report from the pipeline run"
      value: "$(tasks.generate-report.results.summary)"

  tasks:
    # STEP 1 — Validate input (runs first, blocks everything else)
    - name: validate
      taskRef:
        name: validate-repo
      params:
        - name: repo-url
          value: "$(params.repo-url)"

    # STEP 2a — Lint (runs in parallel with test, after validate)
    - name: lint
      runAfter:
        - validate
      taskRef:
        name: run-check
      params:
        - name: check-type
          value: "lint"
        - name: repo-name
          # Reference the result from the validate task
          value: "$(tasks.validate.results.repo-name)"

    # STEP 2b — Test (runs in parallel with lint, after validate)
    - name: test
      runAfter:
        - validate
      taskRef:
        name: run-check
      params:
        - name: check-type
          value: "test"
        - name: repo-name
          value: "$(tasks.validate.results.repo-name)"

    # STEP 3 — Report (runs after BOTH lint and test complete)
    - name: generate-report
      runAfter:
        - lint
        - test
      taskRef:
        name: quality-report
      params:
        - name: repo-name
          value: "$(tasks.validate.results.repo-name)"
        - name: repo-host
          value: "$(tasks.validate.results.repo-host)"
        - name: lint-status
          value: "$(tasks.lint.results.status)"
        - name: lint-findings
          value: "$(tasks.lint.results.finding-count)"
        - name: test-status
          value: "$(tasks.test.results.status)"
        - name: test-findings
          value: "$(tasks.test.results.finding-count)"

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: quality-pipeline-run-001
  labels:
    pipeline-name: code-quality-pipeline
spec:
  pipelineRef:
    name: code-quality-pipeline
  params:
    - name: repo-url
      value: "https://github.com/tektoncd/pipeline"
    - name: revision
      value: "main"
  # TaskRunSpecs lets you set compute limits per task
  taskRunSpecs:
    - pipelineTaskName: lint
      computeResources:
        requests:
          memory: "64Mi"
          cpu: "100m"
    - pipelineTaskName: test
      computeResources:
        requests:
          memory: "128Mi"
          cpu: "200m"

---
# PersistentVolumeClaim — shared storage for Tasks in the pipeline
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pipeline-workspace-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 500Mi
  # On Minikube the default StorageClass provisions hostPath volumes
  # On cloud clusters (EKS, GKE, OpenShift) use the cluster's default SC
---
# ConfigMap used as a read-only config workspace
apiVersion: v1
kind: ConfigMap
metadata:
  name: build-config
data:
  config.yaml: |
    version: "1.0"
    build:
      output_dir: /workspace/source/dist
      optimization: true
      target: linux/amd64
    lint:
      max_issues: 0
      strict: true
  .golangci.yml: |
    run:
      timeout: 5m
    linters:
      enable:
        - errcheck
        - gosimple
        - staticcheck

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: workspace-demo-pipeline
spec:
  description: "Demonstrates workspace usage: PVC for source, ConfigMap for config, Secret for creds"
  params:
    - name: app-name
      type: string
      default: "my-app"
  # Pipeline-level workspace declarations — these are the slots
  workspaces:
    - name: source
      description: "Shared PVC workspace for source files — all tasks share this"
    - name: build-config
      description: "ConfigMap workspace with build configuration (read-only)"
    - name: registry-credentials
      description: "Secret workspace with container registry credentials"
      optional: true

  tasks:
    # Task 1: Write simulated source files to the shared workspace
    - name: write-source
      workspaces:
        - name: source         # task's workspace name
          workspace: source    # pipeline's workspace slot name
        - name: config
          workspace: build-config
      taskSpec:
        workspaces:
          - name: source
            description: "Where to write source files"
          - name: config
            description: "Build configuration (read-only)"
        params:
          - name: app-name
            type: string
        steps:
          - name: create-source
            image: alpine:3.18
            env:
              - name: APP
                value: "$(params.app-name)"
            script: |
              #!/bin/sh
              set -e
              echo "Writing source to: $(workspaces.source.path)"
              mkdir -p "$(workspaces.source.path)/src"
              mkdir -p "$(workspaces.source.path)/tests"

              # Simulate writing application code
              cat > "$(workspaces.source.path)/src/main.go" << 'EOF'
              package main

              import "fmt"

              func main() {
                  fmt.Println("Hello from", "$(APP)")
              }
              EOF

              cat > "$(workspaces.source.path)/Makefile" << 'EOF'
              test:
              	go test ./...
              build:
              	go build -o dist/$(APP) ./src
              EOF

              echo "Reading config from workspace..."
              cat "$(workspaces.config.path)/config.yaml"
              echo ""
              echo "Source tree:"
              find "$(workspaces.source.path)" -type f
      params:
        - name: app-name
          value: "$(params.app-name)"

    # Task 2: Read source from workspace and 'build' it
    - name: build
      runAfter:
        - write-source
      workspaces:
        - name: source
          workspace: source
        - name: config
          workspace: build-config
        - name: credentials
          workspace: registry-credentials
      taskSpec:
        workspaces:
          - name: source
          - name: config
          - name: credentials
            optional: true
        params:
          - name: app-name
            type: string
        results:
          - name: artifact-path
            description: "Path to the built artifact in the workspace"
        steps:
          - name: build-app
            image: alpine:3.18
            env:
              - name: APP
                value: "$(params.app-name)"
            script: |
              #!/bin/sh
              set -e
              echo "=== Build Stage ==="
              echo "Reading source from: $(workspaces.source.path)"
              echo ""
              echo "Source files found:"
              find "$(workspaces.source.path)" -type f
              echo ""
              echo "Build config:"
              cat "$(workspaces.config.path)/config.yaml"
              echo ""

              # Simulate building
              mkdir -p "$(workspaces.source.path)/dist"
              echo "#!/bin/sh" > "$(workspaces.source.path)/dist/$APP"
              echo "echo 'I am $APP'" >> "$(workspaces.source.path)/dist/$APP"
              chmod +x "$(workspaces.source.path)/dist/$APP"

              ARTIFACT="$(workspaces.source.path)/dist/$APP"
              echo "Built artifact: $ARTIFACT"
              printf '%s' "$ARTIFACT" | tee "$(results.artifact-path.path)"
              echo ""

              # Check if credentials workspace was provided
              if [ "$(workspaces.credentials.bound)" = "true" ]; then
                echo "Registry credentials are available"
                ls "$(workspaces.credentials.path)/"
              else
                echo "No registry credentials — skipping push (dry-run mode)"
              fi
      params:
        - name: app-name
          value: "$(params.app-name)"

    # Task 3: Verify the artifact exists in the workspace
    - name: verify
      runAfter:
        - build
      workspaces:
        - name: source
          workspace: source
      taskSpec:
        workspaces:
          - name: source
        steps:
          - name: check-artifact
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "=== Verification ==="
              echo "Checking workspace contents after build:"
              find "$(workspaces.source.path)" -type f -exec ls -la {} +
              echo ""
              echo "All files persisted correctly across tasks!"
              echo "This is the power of shared PVC workspaces."

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: workspace-demo-run-001
spec:
  pipelineRef:
    name: workspace-demo-pipeline
  params:
    - name: app-name
      value: "myapp-v1"
  # Bind the workspace slots to actual Kubernetes resources
  workspaces:
    - name: source
      # Bind to our pre-created PVC
      persistentVolumeClaim:
        claimName: pipeline-workspace-pvc
    - name: build-config
      # Bind to our ConfigMap — mounted as files
      configMap:
        name: build-config
    # NOTE: registry-credentials is optional, so omitting it is fine
    # To include it you would add:
    # - name: registry-credentials
    #   secret:
    #     secretName: registry-push-secret

---
# ServiceAccount used by the EventListener Pod
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-triggers-sa
  namespace: default
---
# Role granting the SA permission to create pipeline resources
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tekton-triggers-role
  namespace: default
rules:
  # Allow creating PipelineRuns
  - apiGroups: ["tekton.dev"]
    resources: ["pipelineruns", "taskruns"]
    verbs: ["create", "get", "list", "watch"]
  # Allow reading existing Pipelines and Tasks
  - apiGroups: ["tekton.dev"]
    resources: ["pipelines", "tasks"]
    verbs: ["get", "list"]
  # Allow creating PVCs for workspaces
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["create", "delete", "get", "list"]
  # Allow reading Secrets (for webhook secret validation)
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tekton-triggers-rolebinding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: tekton-triggers-sa
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tekton-triggers-role
---
# ClusterRole granting access to cluster-scoped Triggers resources.
# ClusterInterceptors live at the cluster scope so a Role (namespace-only)
# cannot grant access to them — a ClusterRole is required.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-triggers-eventlistener-clusterrole
rules:
  - apiGroups: ["triggers.tekton.dev"]
    resources:
      - clusterinterceptors       # cluster-scoped — the key missing permission
      - clustertriggerbindings
      - eventlisteners
      - triggerbindings
      - triggertemplates
      - triggers
      - interceptors
    verbs: ["get", "list", "watch"]
---
# Bind the EventListener SA to the ClusterRole above
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tekton-triggers-cluster-binding
subjects:
  - kind: ServiceAccount
    name: tekton-triggers-sa
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-triggers-eventlistener-clusterrole

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerBinding
metadata:
  name: github-push-binding
spec:
  params:
    # Extract values from the GitHub push webhook JSON payload
    - name: git-repo-url
      value: $(body.repository.clone_url)
    - name: git-repo-name
      value: $(body.repository.name)
    - name: git-revision
      value: $(body.head_commit.id)
    - name: git-ref
      value: $(body.ref)
    - name: pusher-name
      value: $(body.pusher.name)

apiVersion: triggers.tekton.dev/v1beta1
kind: TriggerTemplate
metadata:
  name: github-push-template
spec:
  # These params receive values from the TriggerBinding
  params:
    - name: git-repo-url
      description: "URL of the repository that was pushed to"
    - name: git-repo-name
      description: "Short name of the repository"
    - name: git-revision
      description: "Commit SHA that was pushed"
      default: "main"
    - name: git-ref
      description: "Git ref (branch or tag)"
      default: "refs/heads/main"
    - name: pusher-name
      description: "GitHub username of who pushed"
      default: "unknown"
  resourcetemplates:
    # This is the resource that gets created for each event
    - apiVersion: tekton.dev/v1
      kind: PipelineRun
      metadata:
        # generateName adds a random suffix for uniqueness
        generateName: triggered-build-
        labels:
          triggers.tekton.dev/trigger: github-push
          app.kubernetes.io/managed-by: tekton-triggers
        annotations:
          triggered-by: "$(tt.params.pusher-name)"
          git-revision: "$(tt.params.git-revision)"
      spec:
        pipelineRef:
          name: code-quality-pipeline
        params:
          - name: repo-url
            value: "$(tt.params.git-repo-url)"
          - name: revision
            value: "$(tt.params.git-revision)"
        # code-quality-pipeline (Video 3) has no workspace declarations,
        # so no workspaces block is needed here.

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-push-listener
spec:
  serviceAccountName: tekton-triggers-sa
  triggers:
    - name: github-push-trigger
      # Interceptors run BEFORE the binding — they validate and filter events
      interceptors:
        - ref:
            name: github
            kind: ClusterInterceptor
          params:
            # Validate the webhook secret (set this in GitHub webhook settings)
            - name: secretRef
              value:
                secretName: github-webhook-secret
                secretKey: secret
            # Only process push events (not PRs, issues, etc.)
            - name: eventTypes
              value:
                - push
        - ref:
            name: cel
            kind: ClusterInterceptor
          params:
            # CEL filter: only trigger for pushes to main branch
            - name: filter
              value: "body.ref == 'refs/heads/main'"
            # CEL overlays: add computed values to the event context
            - name: overlays
              value:
                - key: branch_name
                  expression: "body.ref.split('/')[2]"
      # Map the interceptor output to template params
      bindings:
        - ref: github-push-binding
      template:
        ref: github-push-template

apiVersion: v1
kind: Secret
metadata:
  name: github-webhook-secret
type: Opaque
stringData:
  # Use this same value in GitHub webhook settings → Secret field
  secret: "my-super-secret-webhook-key-change-this"

---
# The buildah catalog task mounts the dockerconfig workspace and looks for
# a file named exactly "config.json" at the workspace root.
#
# DO NOT use "kubectl create secret docker-registry" — that command creates
# a secret with the key ".dockerconfigjson", which buildah cannot find.
#
# CORRECT approach — key must be "config.json":
#
# Option A: reuse your local Docker / Podman login (simplest):
#   kubectl create secret generic registry-credentials \
#     --from-file=config.json=$HOME/.docker/config.json
#
# Option B: create from scratch for docker.io:
#   AUTH=$(echo -n "YOUR_USERNAME:YOUR_TOKEN" | base64)
#   kubectl create secret generic registry-credentials \
#     --from-literal=config.json="{\"auths\":{\"https://index.docker.io/v1/\":{\"auth\":\"$AUTH\"}}}"
#
# Option C: create from scratch for quay.io:
#   AUTH=$(echo -n "YOUR_USERNAME:YOUR_TOKEN" | base64)
#   kubectl create secret generic registry-credentials \
#     --from-literal=config.json="{\"auths\":{\"quay.io\":{\"auth\":\"$AUTH\"}}}"
#
# The YAML structure for reference (apply after base64-encoding config.json):
apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
type: Opaque
data:
  # base64 of the full config.json contents (NOT the dockerconfigjson format)
  config.json: BASE64_OF_CONFIG_JSON_HERE

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: container-ci-pipeline
  annotations:
    tekton.dev/displayName: "Container CI Pipeline"
    tekton.dev/description: "Clone, build, and push a container image using catalog tasks"
spec:
  params:
    - name: git-url
      type: string
      description: "Repository URL to clone and build"
    - name: git-revision
      type: string
      default: ""   # empty = HEAD of default branch (works for main, master, etc.)
    - name: image-name
      type: string
      description: "Target image (e.g. quay.io/myorg/myapp)"
    - name: dockerfile-path
      type: string
      default: "./Dockerfile"
      description: "Path to the Dockerfile relative to repo root"
    - name: context-path
      type: string
      default: "."
      description: "Build context path"
  results:
    - name: image-url
      description: "Full URL of the pushed image"
      value: "$(tasks.build-image.results.IMAGE_URL)"
    - name: image-digest
      description: "SHA256 digest of the pushed image"
      value: "$(tasks.build-image.results.IMAGE_DIGEST)"
    - name: git-commit
      description: "Exact commit SHA that was built"
      value: "$(tasks.clone-repo.results.commit)"
  workspaces:
    - name: source
      description: "Shared workspace: source code lives here"
    - name: registry-auth
      description: "Docker config secret for registry authentication"
  tasks:
    # TASK 1: Clone the repository
    - name: clone-repo
      taskRef:
        # Use the resolver to reference the catalog task directly
        # No kubectl apply needed — Tekton fetches it from the catalog
        resolver: http
        params:
          - name: url
            value: https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml
      params:
        - name: url
          value: "$(params.git-url)"
        - name: revision
          value: "$(params.git-revision)"
        - name: deleteExisting
          value: "true"
      workspaces:
        - name: output
          workspace: source

    # TASK 2: Build and push the container image with Buildah
    - name: build-image
      runAfter:
        - clone-repo
      taskRef:
        resolver: http
        params:
          - name: url
            value: https://raw.githubusercontent.com/tektoncd/catalog/main/task/buildah/0.7/buildah.yaml
      params:
        - name: IMAGE
          value: "$(params.image-name):$(tasks.clone-repo.results.commit)"
        - name: DOCKERFILE
          value: "$(params.dockerfile-path)"
        - name: CONTEXT
          value: "$(params.context-path)"
        - name: TLSVERIFY
          value: "false"
        - name: FORMAT
          value: "oci"
      workspaces:
        - name: source
          workspace: source
        - name: dockerconfig
          workspace: registry-auth

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ci-pipeline-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: container-ci-run-001
spec:
  pipelineRef:
    name: container-ci-pipeline
  params:
    # traefik/whoami — tiny Go HTTP server, minimal self-contained Dockerfile,
    # no external dependencies, builds in seconds. Good demo target.
    # Swap git-url for your own application repo when ready.
    # git-revision is left empty so git-clone uses HEAD of the default branch
    # automatically — works whether the repo uses main, master, or anything else.
    - name: git-url
      value: "https://github.com/traefik/whoami"
    - name: git-revision
      value: ""
    # Replace with your own registry + image name
    - name: image-name
      value: "quay.io/YOURORG/whoami-demo"
    - name: dockerfile-path
      value: "./Dockerfile"
    - name: context-path
      value: "."
  workspaces:
    - name: source
      persistentVolumeClaim:
        claimName: ci-pipeline-pvc
    - name: registry-auth
      secret:
        secretName: registry-credentials

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: advanced-patterns-pipeline
spec:
  params:
    - name: skip-tests
      type: string
      default: "false"
      description: "Set to 'true' to skip the test stage (use with caution)"
    - name: run-security-scan
      type: string
      default: "true"
      description: "Set to 'false' to skip security scanning"
    - name: platforms
      type: array
      default:
        - "linux/amd64"
        - "linux/arm64"
      description: "List of platforms to build for"
    - name: app-name
      type: string
      default: "myapp"

  workspaces:
    - name: source

  tasks:
    # Always runs — validates configuration
    - name: validate
      taskSpec:
        steps:
          - name: check
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "Validating pipeline configuration..."
              echo "App: $(params.app-name)"
              echo "Skip tests: $(params.skip-tests)"
              echo "Validation passed."
      params:
        - name: app-name
          value: "$(params.app-name)"
        - name: skip-tests
          value: "$(params.skip-tests)"

    # Conditional: only runs if skip-tests != "true"
    - name: run-tests
      runAfter:
        - validate
      when:
        - input: "$(params.skip-tests)"
          operator: in
          values: ["false", "False", "FALSE", ""]
      taskSpec:
        params:
          - name: app-name
        steps:
          - name: test
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "Running unit tests for $(params.app-name)..."
              sleep 3
              echo "42 tests passed, 0 failed."
      params:
        - name: app-name
          value: "$(params.app-name)"

    # Matrix: builds for each platform in parallel
    # One TaskRun is created per platform value
    - name: build-multiarch
      runAfter:
        - validate
      matrix:
        params:
          - name: platform
            value:
              - "$(params.platforms[0])"
              - "$(params.platforms[1])"
      taskSpec:
        params:
          - name: platform
            type: string
          - name: app-name
            type: string
        results:
          - name: build-status
        steps:
          - name: build-for-platform
            image: alpine:3.18
            script: |
              #!/bin/sh
              PLATFORM="$(params.platform)"
              APP="$(params.app-name)"
              echo "Building $APP for platform: $PLATFORM"
              sleep 4
              echo "Build complete for $PLATFORM"
              printf '%s' "success-$PLATFORM" | tee "$(results.build-status.path)"
      params:
        - name: app-name
          value: "$(params.app-name)"

    # Conditional: skip if run-security-scan is false
    # Also uses retry — will retry up to 2 times on failure
    - name: security-scan
      runAfter:
        - build-multiarch
      when:
        - input: "$(params.run-security-scan)"
          operator: in
          values: ["true", "True", "TRUE"]
      retries: 2
      timeout: "10m"
      taskSpec:
        params:
          - name: app-name
        steps:
          - name: scan
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "Running security scan on $(params.app-name)..."
              sleep 2
              echo "Scan complete. No critical vulnerabilities found."
      params:
        - name: app-name
          value: "$(params.app-name)"

  # FINALLY block — always executes, even if above tasks fail
  finally:
    - name: notify-result
      taskSpec:
        params:
          - name: pipeline-run-name
            type: string
        steps:
          - name: send-notification
            image: alpine:3.18
            env:
              - name: PIPELINERUN_NAME
                value: "$(params.pipeline-run-name)"
            script: |
              #!/bin/sh
              echo "=== Pipeline Completion Notification ==="
              echo "PipelineRun: $PIPELINERUN_NAME"
              echo "Namespace: $(context.pipelineRun.namespace)"
              echo ""
              # In a real pipeline this would call a Slack webhook or
              # post a GitHub status comment
              echo "Status: Pipeline finished (check PipelineRun for final status)"
              echo "Timestamp: $(date -u)"
              echo "This finally task always runs, regardless of success or failure."
      params:
        - name: pipeline-run-name
          value: "$(context.pipelineRun.name)"

    # Cleanup: delete temporary resources
    - name: cleanup-workspace
      taskSpec:
        steps:
          - name: cleanup
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "Cleaning up temporary files..."
              echo "In a real pipeline: rm -rf /workspace/source/tmp"
              echo "Or delete temporary PVCs, ConfigMaps, etc."
              echo "Cleanup complete."

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: advanced-run-skip-tests
spec:
  pipelineRef:
    name: advanced-patterns-pipeline
  params:
    - name: app-name
      value: "demo-app"
    - name: skip-tests
      # This will cause the run-tests task to be SKIPPED (not failed)
      value: "true"
    - name: run-security-scan
      value: "true"
    - name: platforms
      value:
        - "linux/amd64"
        - "linux/arm64"
  workspaces:
    - name: source
      emptyDir: {}

apiVersion: v1
kind: ConfigMap
metadata:
  name: chains-config
  namespace: tekton-chains
data:
  # Where to store the signed attestations.
  # "oci" attaches them as OCI referrers alongside the image (recommended).
  artifacts.oci.storage: "oci"
  artifacts.taskrun.storage: "oci"
  artifacts.pipelinerun.storage: "oci"

  # Signing format for OCI images.
  # artifacts.oci.format ONLY accepts "simplesigning" — it is an image signing
  # format, not an attestation format. "slsa/v1" is invalid here and will crash
  # the Chains controller on startup.
  artifacts.oci.format: "simplesigning"

  # Attestation format for TaskRun and PipelineRun provenance documents.
  # "in-toto" is supported across all current Chains versions.
  # "slsa/v1" requires Chains v0.21+ — use "in-toto" for broad compatibility.
  artifacts.taskrun.format: "in-toto"
  artifacts.pipelinerun.format: "in-toto"

  # Transparency log — set to false for local/air-gapped dev clusters.
  # Set to true in production to publish to the Sigstore Rekor public log.
  transparency.enabled: "false"
  transparency.url: "https://rekor.sigstore.dev"

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: simulate-build-and-push
  annotations:
    # Tell Chains which results contain the image coordinates
    chains.tekton.dev/output-image-name: IMAGE_URL
    chains.tekton.dev/output-image-digest: IMAGE_DIGEST
spec:
  description: |
    Simulates building and pushing a container image.
    In a real pipeline this would be the Buildah task.
    Chains watches for the IMAGE_URL and IMAGE_DIGEST results.
  params:
    - name: image-name
      type: string
      description: "Full image reference including tag (e.g. quay.io/org/app:v1.0)"
  results:
    # Chains REQUIRES these specific result names to detect the image
    - name: IMAGE_URL
      description: "The full URL of the built image"
    - name: IMAGE_DIGEST
      description: "The SHA256 digest of the pushed image (sha256:...)"
  steps:
    - name: build-and-push
      image: alpine:3.18
      env:
        - name: IMAGE
          value: "$(params.image-name)"
      script: |
        #!/bin/sh
        set -e
        echo "=== Simulating Build & Push ==="
        echo "Image: $IMAGE"
        echo "Simulating Buildah build..."
        sleep 2

        # In a real scenario, the registry returns this digest after push
        # Here we simulate a plausible digest
        DIGEST="sha256:$(echo $IMAGE | md5sum | head -c 64)"

        echo "Image built and pushed successfully!"
        echo "Image URL:    $IMAGE"
        echo "Image Digest: $DIGEST"

        # Write results — Chains reads these after the TaskRun completes
        printf '%s' "$IMAGE"  | tee "$(results.IMAGE_URL.path)"
        printf '%s' "$DIGEST" | tee "$(results.IMAGE_DIGEST.path)"

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: production-container-pipeline
  annotations:
    tekton.dev/displayName: "Production Container CI Pipeline"
    tekton.dev/description: |
      Full CI pipeline: clone, test, build, scan, sign.
      Mirrors the structure of Konflux's default build pipeline.
spec:
  params:
    - name: git-url
      type: string
      description: "Repository URL"
    - name: git-revision
      type: string
      default: "main"
    - name: image-name
      type: string
      description: "Target image, e.g. quay.io/myorg/myapp"
    - name: dockerfile-path
      type: string
      default: "./Containerfile"
    - name: skip-tests
      type: string
      default: "false"
    - name: skip-vuln-scan
      type: string
      default: "false"

  results:
    - name: image-url
      value: "$(tasks.build-container.results.IMAGE_URL)"
    - name: image-digest
      value: "$(tasks.build-container.results.IMAGE_DIGEST)"
    - name: git-commit
      value: "$(tasks.clone-repository.results.commit)"

  workspaces:
    - name: source
      description: "Shared workspace — source code and build artifacts"
    - name: registry-auth
      description: "Container registry credentials (docker config secret)"
    # Uncomment for private repositories — mount a Secret with .git-credentials
    # or SSH keys so git-clone can authenticate.
    # - name: git-auth
    #   description: "Git credentials for private repos (optional)"
    #   optional: true

  tasks:
    # ── Stage 1: Clone ─────────────────────────────────────────────
    - name: clone-repository
      taskRef:
        resolver: http
        params:
          - name: url
            value: https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.9/git-clone.yaml
      params:
        - name: url
          value: "$(params.git-url)"
        - name: revision
          value: "$(params.git-revision)"
        - name: deleteExisting
          value: "true"
      workspaces:
        - name: output
          workspace: source
        # Uncomment for private repositories — maps the pipeline's git-auth
        # workspace slot to the git-clone task's basic-auth workspace.
        # - name: basic-auth
        #   workspace: git-auth

    # ── Stage 2: Test (skippable) ──────────────────────────────────
    - name: run-unit-tests
      runAfter:
        - clone-repository
      when:
        - input: "$(params.skip-tests)"
          operator: in
          values: ["false", ""]
      taskSpec:
        workspaces:
          - name: source
        params:
          - name: commit
            type: string
        steps:
          - name: test
            image: golang:1.24-alpine
            workingDir: "$(workspaces.source.path)"
            script: |
              #!/bin/sh
              set -e
              echo "Running unit tests at commit: $(params.commit)"
              # Detect project type
              if [ -f go.mod ]; then
                go test ./... -v -count=1
              elif [ -f package.json ]; then
                npm test
              elif [ -f requirements.txt ]; then
                pip install -r requirements.txt
                python -m pytest
              else
                echo "No recognized test runner — skipping"
              fi
      params:
        - name: commit
          value: "$(tasks.clone-repository.results.commit)"
      workspaces:
        - name: source
          workspace: source

    # ── Stage 3: Build Container Image ────────────────────────────
    - name: build-container
      runAfter:
        - run-unit-tests
      taskSpec:
        params:
          - name: image
            type: string
          - name: dockerfile
            type: string
          - name: commit
            type: string
        results:
          - name: IMAGE_URL
            description: "Full image URL with tag"
          - name: IMAGE_DIGEST
            description: "SHA256 digest of pushed image"
        workspaces:
          - name: source
          - name: registry-auth
        steps:
          - name: build-and-push
            image: quay.io/buildah/stable:latest
            securityContext:
              privileged: true
            env:
              - name: IMAGE
                value: "$(params.image):$(params.commit)"
              - name: DOCKERFILE
                value: "$(params.dockerfile)"
              - name: DOCKERCONFIG
                value: "$(workspaces.registry-auth.path)/config.json"
            workingDir: "$(workspaces.source.path)"
            script: |
              #!/bin/bash
              set -euo pipefail
              export REGISTRY_AUTH_FILE="$DOCKERCONFIG"

              echo "Building image: $IMAGE"
              buildah build \
                --file "$DOCKERFILE" \
                --format oci \
                --tag "$IMAGE" \
                .

              echo "Pushing image to registry..."
              buildah push \
                --digestfile /tmp/image-digest \
                "$IMAGE"

              DIGEST=$(cat /tmp/image-digest)
              echo "Image pushed successfully"
              echo "URL:    $IMAGE"
              echo "Digest: $DIGEST"

              printf '%s' "$IMAGE"  | tee "$(results.IMAGE_URL.path)"
              printf '%s' "$DIGEST" | tee "$(results.IMAGE_DIGEST.path)"
      params:
        - name: image
          value: "$(params.image-name)"
        - name: dockerfile
          value: "$(params.dockerfile-path)"
        - name: commit
          value: "$(tasks.clone-repository.results.commit)"
      workspaces:
        - name: source
          workspace: source
        - name: registry-auth
          workspace: registry-auth

    # ── Stage 4a: Vulnerability Scan (skippable) ──────────────────
    - name: vulnerability-scan
      runAfter:
        - build-container
      when:
        - input: "$(params.skip-vuln-scan)"
          operator: in
          values: ["false", ""]
      taskSpec:
        params:
          - name: image-url
          - name: image-digest
        steps:
          - name: trivy-scan
            image: aquasec/trivy:latest
            env:
              - name: TRIVY_NO_PROGRESS
                value: "true"
              - name: TRIVY_EXIT_CODE
                value: "1"
              - name: TRIVY_SEVERITY
                value: "CRITICAL"
            script: |
              #!/bin/sh
              IMAGE="$(params.image-url)@$(params.image-digest)"
              echo "Scanning image: $IMAGE"
              trivy image \
                --exit-code "$TRIVY_EXIT_CODE" \
                --severity "$TRIVY_SEVERITY" \
                --format table \
                "$IMAGE"
      params:
        - name: image-url
          value: "$(tasks.build-container.results.IMAGE_URL)"
        - name: image-digest
          value: "$(tasks.build-container.results.IMAGE_DIGEST)"

    # ── Stage 4b: Generate SBOM ────────────────────────────────────
    - name: generate-sbom
      runAfter:
        - build-container
      taskSpec:
        params:
          - name: image-url
          - name: image-digest
        workspaces:
          - name: source
        steps:
          - name: syft-sbom
            # anchore/syft:latest is distroless — no shell, so Tekton cannot
            # inject its script file. Use alpine and install the syft binary.
            image: alpine:3.18
            env:
              - name: IMAGE
                value: "$(params.image-url)@$(params.image-digest)"
            workingDir: "$(workspaces.source.path)"
            script: |
              #!/bin/sh
              set -e
              echo "Installing syft..."
              apk add --no-cache curl ca-certificates
              curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
                | sh -s -- -b /usr/local/bin
              echo "Generating SBOM for: $IMAGE"
              syft "$IMAGE" -o cyclonedx-json > sbom.json
              echo "SBOM generated: $(wc -l < sbom.json) lines"
              echo "Top components:"
              head -50 sbom.json
      params:
        - name: image-url
          value: "$(tasks.build-container.results.IMAGE_URL)"
        - name: image-digest
          value: "$(tasks.build-container.results.IMAGE_DIGEST)"
      workspaces:
        - name: source
          workspace: source

  # ── Finally: Always runs ─────────────────────────────────────────
  finally:
    - name: pipeline-notification
      taskSpec:
        params:
          - name: image-url
            default: "unknown"
          - name: run-name
        steps:
          - name: notify
            image: alpine:3.18
            script: |
              #!/bin/sh
              echo "========================================"
              echo " Pipeline Complete"
              echo " Run:   $(params.run-name)"
              echo " Image: $(params.image-url)"
              echo " Time:  $(date -u)"
              echo "========================================"
              # In production: curl -X POST SLACK_WEBHOOK -d "{...}"
      params:
        - name: run-name
          value: "$(context.pipelineRun.name)"
        - name: image-url
          value: "$(tasks.build-container.results.IMAGE_URL)"

# Store this file at .tekton/push.yaml in your application repository.
# Tekton PaC (Pipeline as Code) detects it and runs it on every push.
#
# Annotations control WHEN this pipeline runs:
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: push-build
  annotations:
    # PaC annotation: trigger on push to main
    pipelinesascode.tekton.dev/on-event: "[push]"
    pipelinesascode.tekton.dev/on-target-branch: "[main, release-*]"
    # Maximum number of concurrent runs for this pipeline
    pipelinesascode.tekton.dev/max-keep-runs: "5"
spec:
  pipelineRef:
    name: production-container-pipeline
  params:
    - name: git-url
      value: "{{ repo_url }}"          # PaC template variable
    - name: git-revision
      value: "{{ revision }}"          # PaC template variable
    - name: image-name
      value: "quay.io/myorg/myapp"
    - name: dockerfile-path
      value: "./Containerfile"
  workspaces:
    - name: source
      volumeClaimTemplate:
        spec:
          accessModes: [ReadWriteOnce]
          resources:
            requests:
              storage: 1Gi
    - name: registry-auth
      secret:
        secretName: registry-push-credentials
    # Uncomment for private repositories — provide a Secret with
    # .git-credentials or SSH keys for PaC to authenticate to git.
    # - name: git-auth
    #   secret:
    #     secretName: pipelines-as-code-secret