ci.yaml

name: ci

on: [pull_request] # yamllint disable-line rule:truthy

defaults:
  run:
    shell: bash

permissions:
  contents: read
  checks: write # Used to annotate code in the PR

jobs:
  linting:
    name: lint
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
      with:
        fetch-depth: 0
    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
      with:
        go-version-file: "go.mod"
    - name: AGENTS.md line limit
      run: |
        max_lines=60
        actual=$(wc -l < AGENTS.md)
        if [ "$actual" -gt "$max_lines" ]; then
          echo "::error::AGENTS.md has $actual lines (limit: $max_lines)"
          exit 1
        fi
        echo "AGENTS.md: $actual lines (limit: $max_lines) — OK"
    - name: yamllint
      run: |
        sudo apt-get update && sudo apt-get install -y yamllint
        yamllint -c $(git rev-parse --show-toplevel)/.yamllint $(find . -type f -regex ".*y[a]ml" -print | tr '\n' ' ')
    - name: gofmt
      run: |
        gofmt_out=$(gofmt -d $(find * -name '*.go' ! -path 'vendor/*' ! -path 'third_party/*'))
        if [[ -n "$gofmt_out" ]]; then
            failed=1
        fi
        echo "$gofmt_out"
    - name: Install catlin
      run: |
        go install github.com/tektoncd/catlin/cmd/catlin@latest
        echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
    - name: catlin validate
      env:
        PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
      run: |
        # Detect changed task version directories (task/<name>/<version>).
        # Reduce every changed file to its version directory so that catlin
        # only validates the catalog resource itself, never the test
        # manifests under tests/ (TaskRun/Pipeline) or files under samples/,
        # which are not catalog resources and would fail validation.
        changed_tasks=$(
          git --no-pager diff --name-only ${PULL_BASE_SHA}..HEAD | \
          { grep -oE '^task/[^/]+/[^/]+' || true; } | \
          sort -u
        )
        if [[ -z "$changed_tasks" ]]; then
          echo "No file changes detected in task directories"
          exit 0
        fi
        # Filter out removed directories
        existing_tasks=""
        for task in $changed_tasks; do
          [[ -d "$task" ]] && existing_tasks="$existing_tasks $task"
        done
        if [[ -z "$existing_tasks" ]]; then
          echo "Changed task directories no longer exist (removed)"
          exit 0
        fi
        echo "Validating:$existing_tasks"
        catlin validate $existing_tasks
    - name: catlin lint scripts
      env:
        PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
      run: |
        # Detect changed task version directories (task/<name>/<version>).
        # See the note in the "catlin validate" step above.
        changed_tasks=$(
          git --no-pager diff --name-only ${PULL_BASE_SHA}..HEAD | \
          { grep -oE '^task/[^/]+/[^/]+' || true; } | \
          sort -u
        )
        if [[ -z "$changed_tasks" ]]; then
          echo "No file changes detected in task directories"
          exit 0
        fi
        # Script linting is informational (matching previous Prow behavior)
        # catlin validate above is the hard gate
        for dir in $changed_tasks; do
          [[ ! -d "$dir" ]] && continue
          # Skip deprecated tasks
          grep -q 'tekton.dev/deprecated: "true"' ${dir}/*.yaml 2>/dev/null && continue
          echo "Linting scripts in $dir"
          catlin lint script ${dir}/*.yaml || echo "::warning::catlin lint script found issues in $dir"
        done
  e2e-tests:
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.tekton-version }}-${{ github.event.pull_request.number || github.ref }}
      cancel-in-progress: true
    name: e2e tests
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false # Keep running if one leg fails.
      matrix:
        tekton-version:
        - latest
        - lts-latest
        - lts-latest-minus-one
        - lts-latest-minus-two
        - lts-latest-minus-three

        include:
        - tekton-version: latest
          pipeline-version: v1.13.0
        - tekton-version: lts-latest
          pipeline-version: v1.9.0
        - tekton-version: lts-latest-minus-one
          pipeline-version: v1.6.0
        - tekton-version: lts-latest-minus-two
          pipeline-version: v1.3.0
        - tekton-version: lts-latest-minus-three
          pipeline-version: v1.0.0

    env:
      KO_DOCKER_REPO: registry.local:5000/tekton
      CLUSTER_DOMAIN: c${{ github.run_id }}.local
      ARTIFACTS: ${{ github.workspace }}/artifacts

    steps:
    - name: Free disk space
      run: |
        echo "--- Disk space before cleanup ---"
        df -h
        sudo rm -rf /usr/share/dotnet
        sudo rm -rf /usr/local/lib/android
        sudo rm -rf /opt/ghc
        sudo rm -rf /opt/hostedtoolcache/CodeQL
        sudo docker image prune -a -f
        echo "--- Disk space after cleanup ---"
        df -h
    - id: checkout
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        fetch-depth: 0
    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
      with:
        go-version-file: "go.mod"
    - name: Run tests
      run: |
        export PULL_BASE_SHA=origin/${{ github.base_ref }}
        export PULL_PULL_SHA=${{ steps.checkout.outputs.commit }}
        ./hack/setup-kind.sh \
          --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
          --cluster-suffix c${{ github.run_id }}.local \
          --nodes 1 \
          --pipeline-version ${{ matrix.pipeline-version }} \
          --e2e-script ./test/e2e-tests.sh \
          --e2e-env ./test/e2e-tests-kind-gha.env

    - name: Upload test results
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        name: ${{ matrix.pipeline-version }}
        path: ${{ env.ARTIFACTS }}

    - uses: chainguard-dev/actions/kind-diag@6f4f4de7549514e7b659741b30f6476f245600dd # v1.5.3
      if: ${{ failure() }}
      with:
        artifact-name: ${{ matrix.pipeline-version }}-logs

    - name: Dump Artifacts
      if: ${{ failure() }}
      run: |
        if [[ -d ${{ env.ARTIFACTS }} ]]; then
          cd ${{ env.ARTIFACTS }}
          for x in $(find . -type f); do
            echo "::group:: artifact $x"
            cat $x
            echo '::endgroup::'
          done
        fi

  ci-summary:
    name: CI summary
    needs: [linting, e2e-tests]
    runs-on: ubuntu-latest
    if: always()
    steps:
    - name: Check CI results
      run: |
        results=(
          "linting=${NEEDS_LINTING_RESULT}"
          "e2e-tests=${NEEDS_E2E_TESTS_RESULT}"
        )
        failed=0
        for r in "${results[@]}"; do
          name="${r%%=*}"
          result="${r#*=}"
          echo "${name}: ${result}"
          if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
            failed=1
          fi
        done
        if [ "$failed" -eq 1 ]; then
          echo ""
          echo "Some CI jobs failed or were cancelled"
          exit 1
        fi
        echo ""
        echo "All CI checks passed"
      env:
        NEEDS_LINTING_RESULT: ${{ needs.linting.result }}
        NEEDS_E2E_TESTS_RESULT: ${{ needs.e2e-tests.result }}