Run intercept and Results on main when their paths change

.github/workflows/intercept-e2e.yml

@@ -8,6 +8,14 @@ on:
       - "scripts/bootstrap-namespace.sh"
       - "scripts/install-tekton.sh"
       - "scripts/run-product-intercept-e2e.sh"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/intercept-e2e.yml"
+      - "helm/tekton-dag/**"
+      - "scripts/bootstrap-namespace.sh"
+      - "scripts/install-tekton.sh"
+      - "scripts/run-product-intercept-e2e.sh"
   workflow_dispatch:
   schedule:
     # Weekly product-path evidence on the default branch.

.github/workflows/results-regression.yml

@@ -8,6 +8,14 @@ on:
       - "scripts/install-tekton-results.sh"
       - "scripts/run-regression-agent-full.sh"
       - "scripts/run-lang-unit-tests.sh"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/results-regression.yml"
+      - "scripts/install-postgres-kind.sh"
+      - "scripts/install-tekton-results.sh"
+      - "scripts/run-regression-agent-full.sh"
+      - "scripts/run-lang-unit-tests.sh"
   workflow_dispatch:
   schedule:
     # Weekly strict Results/Postgres evidence on the default branch.

libs/tekton-dag-common/tests/test_m17_intercept_automation.py

@@ -9,6 +9,8 @@ def test_intercept_workflow_has_explicit_backend_cadence_and_evidence():
     workflow = (ROOT / ".github/workflows/intercept-e2e.yml").read_text()
 
     assert "pull_request:" in workflow
+    assert "push:" in workflow
+    assert "branches: [main]" in workflow
     assert '".github/workflows/intercept-e2e.yml"' in workflow
     assert '"helm/tekton-dag/**"' in workflow
     assert '"scripts/bootstrap-namespace.sh"' in workflow
@@ -69,3 +71,16 @@ def test_tekton_install_allows_source_and_build_cache_pvcs():
 
     assert "kubectl patch configmap feature-flags -n tekton-pipelines" in install
     assert '''-p '{"data":{"coschedule":"disabled"}}' '''.strip() in install
+
+
+def test_compile_pipeline_defaults_are_valid_container_images():
+    for name in (
+        "stack-bootstrap-pipeline.yaml",
+        "stack-pr-pipeline.yaml",
+        "stack-merge-pipeline.yaml",
+    ):
+        pipeline = (ROOT / "pipeline" / name).read_text()
+        for image_param in ("npm", "maven", "gradle", "pip", "php"):
+            marker = f"- name: compile-image-{image_param}"
+            default = pipeline.split(marker, 1)[1].split("- name:", 1)[0]
+            assert 'default: "ubuntu:22.04"' in default

libs/tekton-dag-common/tests/test_m17_results_automation.py

@@ -11,6 +11,8 @@ def test_results_workflow_is_scheduled_strict_and_retains_diagnostics():
     assert "workflow_dispatch:" in workflow
     assert "schedule:" in workflow
     assert "pull_request:" in workflow
+    assert "push:" in workflow
+    assert "branches: [main]" in workflow
     assert '".github/workflows/results-regression.yml"' in workflow
     assert "run-regression-agent-full.sh" in workflow
     assert "install-postgres-kind.sh --ephemeral" in workflow

pipeline/stack-bootstrap-pipeline.yaml

@@ -25,19 +25,19 @@ spec:
       default: "base-1"
     - name: compile-image-npm
       description: "Image for npm compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-maven
       description: "Image for Maven compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-gradle
       description: "Image for Gradle compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-pip
       description: "Image for pip compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-php
       description: "Image for Composer/PHP compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: cache-repo
       description: "Kaniko cache repo. Empty disables cache."
       default: ""

pipeline/stack-merge-pipeline.yaml

@@ -37,19 +37,19 @@ spec:
       default: "{}"
     - name: compile-image-npm
       description: "Image for npm compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-maven
       description: "Image for Maven compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-gradle
       description: "Image for Gradle compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-pip
       description: "Image for pip compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-php
       description: "Image for Composer/PHP compile step"
-      default: ""
+      default: "ubuntu:22.04"
     - name: pre-build-task
       description: "Optional Tekton Task to run after clone, before compile."
       default: "tekton-dag-hook-noop"

pipeline/stack-pr-pipeline.yaml

@@ -42,19 +42,19 @@ spec:
       default: "{}"
     - name: compile-image-npm
       description: "Pre-built image for npm compile"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-maven
       description: "Pre-built image for Maven compile"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-gradle
       description: "Pre-built image for Gradle compile"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-pip
       description: "Pre-built image for pip compile"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-php
       description: "Pre-built image for Composer/PHP compile"
-      default: ""
+      default: "ubuntu:22.04"
     - name: compile-image-mirrord
       description: "Pre-built image for mirrord proxy pods (M7)"
       default: "localhost:5000/tekton-dag-build-mirrord:latest"