Fix intercept product E2E on main

.github/workflows/intercept-e2e.yml

@@ -5,16 +5,30 @@ on:
     paths:
       - ".github/workflows/intercept-e2e.yml"
       - "helm/tekton-dag/**"
+      - "libs/tekton-dag-common/**"
+      - "operator/**"
+      - "orchestrator/**"
+      - "pipeline/**"
+      - "stacks/**"
+      - "tasks/**"
       - "scripts/bootstrap-namespace.sh"
       - "scripts/install-tekton.sh"
+      - "scripts/run-cluster-ci.sh"
       - "scripts/run-product-intercept-e2e.sh"
   push:
     branches: [main]
     paths:
       - ".github/workflows/intercept-e2e.yml"
       - "helm/tekton-dag/**"
+      - "libs/tekton-dag-common/**"
+      - "operator/**"
+      - "orchestrator/**"
+      - "pipeline/**"
+      - "stacks/**"
+      - "tasks/**"
       - "scripts/bootstrap-namespace.sh"
       - "scripts/install-tekton.sh"
+      - "scripts/run-cluster-ci.sh"
       - "scripts/run-product-intercept-e2e.sh"
   workflow_dispatch:
   schedule:

helm/tekton-dag/package.sh

@@ -10,10 +10,12 @@ echo "  Repo root: $REPO_ROOT"
 
 rm -rf "$CHART_DIR/raw"
 mkdir -p "$CHART_DIR/raw/tasks" "$CHART_DIR/raw/pipelines" "$CHART_DIR/raw/stacks" \
-  "$CHART_DIR/raw/stack-crs" "$CHART_DIR/raw/team-crs"
+  "$CHART_DIR/raw/stack-crs" "$CHART_DIR/raw/team-crs" "$CHART_DIR/raw/scripts"
 
 echo "  Copying tasks..."
 cp "$REPO_ROOT"/tasks/*.yaml "$CHART_DIR/raw/tasks/"
+cp "$REPO_ROOT/scripts/run-stack-tests-runners.sh" \
+  "$CHART_DIR/raw/scripts/run-stack-tests-runners.sh"
 
 echo "  Copying pipelines and triggers..."
 cp "$REPO_ROOT"/pipeline/*.yaml "$CHART_DIR/raw/pipelines/"

helm/tekton-dag/templates/configmap-run-stack-tests-runners.yaml

@@ -0,0 +1,14 @@
+{{- $script := .Files.Get "raw/scripts/run-stack-tests-runners.sh" -}}
+{{- if $script }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: run-stack-tests-runners
+  namespace: {{ .Values.namespace }}
+  labels:
+    app.kubernetes.io/part-of: tekton-job-standardization
+    {{- include "tekton-dag.labels" . | nindent 4 }}
+data:
+  run-stack-tests-runners.sh: |
+    {{- $script | nindent 4 }}
+{{- end }}

libs/tekton-dag-common/tests/fixtures/pipelineruns/bootstrap.json

@@ -70,7 +70,7 @@
       {
         "name": "build-cache",
         "persistentVolumeClaim": {
-          "claimName": "build-cache-pvc"
+          "claimName": "build-cache"
         }
       }
     ]

libs/tekton-dag-common/tests/fixtures/pipelineruns/merge.json

@@ -31,10 +31,6 @@
         "name": "image-registry",
         "value": "localhost:5000"
       },
-      {
-        "name": "cache-repo",
-        "value": "localhost:5000/kaniko-cache"
-      },
       {
         "name": "max-retries",
         "value": "2"
@@ -74,7 +70,7 @@
       {
         "name": "build-cache",
         "persistentVolumeClaim": {
-          "claimName": "build-cache-pvc"
+          "claimName": "build-cache"
         }
       }
     ]

libs/tekton-dag-common/tests/fixtures/pipelineruns/pr.json

@@ -94,7 +94,7 @@
       {
         "name": "build-cache",
         "persistentVolumeClaim": {
-          "claimName": "build-cache-pvc"
+          "claimName": "build-cache"
         }
       }
     ]

libs/tekton-dag-common/tests/test_m17_intercept_automation.py

@@ -13,8 +13,12 @@ def test_intercept_workflow_has_explicit_backend_cadence_and_evidence():
     assert "branches: [main]" in workflow
     assert '".github/workflows/intercept-e2e.yml"' in workflow
     assert '"helm/tekton-dag/**"' in workflow
-    assert '"scripts/bootstrap-namespace.sh"' in workflow
+    assert '"operator/**"' in workflow
+    assert '"orchestrator/**"' in workflow
+    assert '"pipeline/**"' in workflow
+    assert '"tasks/**"' in workflow
     assert '"scripts/install-tekton.sh"' in workflow
+    assert '"scripts/bootstrap-namespace.sh"' in workflow
     assert "workflow_dispatch:" in workflow
     assert "schedule:" in workflow
     assert "backend: [telepresence, mirrord]" in workflow
@@ -41,6 +45,7 @@ def test_product_script_covers_trigger_stackrun_tests_and_cleanup():
     assert "pipeline-results.json" in script
     assert "tekton.dev/pipelineTask=run-tests" in script
     assert 'pipeline_status" == "False"' in script
+    assert "kubectl get pvc build-cache" in script
     assert "pr-traffic-evidence.log" in script
     assert "kubectl delete pipelinerun" in script
     assert "kubectl delete stackrun" in script
@@ -71,6 +76,13 @@ def test_tekton_install_allows_source_and_build_cache_pvcs():
 
     assert "kubectl patch configmap feature-flags -n tekton-pipelines" in install
     assert '''-p '{"data":{"coschedule":"disabled"}}' '''.strip() in install
+    assert "rollout status deployment/tekton-pipelines-webhook" in install
+    assert "rollout status deployment/tekton-triggers-webhook" in install
+    assert (
+        install.index("rollout status deployment/tekton-triggers-webhook")
+        < install.index('apply_with_retry -f "$TEKTON_TRIGGERS_INTERCEPTORS_URL"')
+    )
+    assert 'apply_with_retry -f "$MILESTONE_DIR/tasks/"' in install
 
 
 def test_compile_pipeline_defaults_are_valid_container_images():
@@ -84,3 +96,22 @@ def test_compile_pipeline_defaults_are_valid_container_images():
             marker = f"- name: compile-image-{image_param}"
             default = pipeline.split(marker, 1)[1].split("- name:", 1)[0]
             assert 'default: "ubuntu:22.04"' in default
+
+
+def test_pipelinerun_builders_use_installed_build_cache_claim():
+    go_builder = (ROOT / "operator/internal/pipeline/builder.go").read_text()
+    python_builder = (ROOT / "orchestrator/pipelinerun_builder.py").read_text()
+
+    assert '"claimName": "build-cache"' in go_builder
+    assert '"claimName": "build-cache-pvc"' not in go_builder
+    assert '"claimName": "build-cache"' in python_builder
+    assert '"claimName": "build-cache-pvc"' not in python_builder
+
+
+def test_pr_comment_token_is_optional_when_commenting_is_not_configured():
+    task = (ROOT / "tasks/post-pr-comment.yaml").read_text()
+
+    token_ref = task.split("secretKeyRef:", 1)[1].split("- name: GIT_URL", 1)[0]
+    assert "key: token" in token_ref
+    assert "optional: true" in token_ref
+    assert 'if [ -z "$GITHUB_TOKEN" ]' in task

libs/tekton-dag-common/tests/test_m17_stack_test_runners.py

@@ -0,0 +1,42 @@
+"""Static acceptance checks for M17.13 stack test runners."""
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+
+
+def test_task_sources_extracted_runner_script():
+    task = (ROOT / "tasks/run-stack-tests.yaml").read_text()
+    installer = (ROOT / "scripts/install-tekton.sh").read_text()
+    chart = (ROOT / "helm/tekton-dag/templates/configmap-run-stack-tests-runners.yaml").read_text()
+    packager = (ROOT / "helm/tekton-dag/package.sh").read_text()
+    script = (ROOT / "scripts/run-stack-tests-runners.sh").read_text()
+
+    assert "name: run-stack-tests-runners" in task
+    assert "mountPath: /opt/tekton-dag" in task
+    assert "ERROR: run-stack-tests runners ConfigMap missing" in task
+    assert "PHASE 2: Per-app tests" not in task
+    assert "kubectl create configmap run-stack-tests-runners" in installer
+    assert "raw/scripts/run-stack-tests-runners.sh" in chart
+    assert "raw/scripts/run-stack-tests-runners.sh" in packager
+    assert "run_newman" in script
+    assert "run_playwright" in script
+    assert "run_artillery" in script
+    assert "stack-json is not valid JSON" in script
+
+
+def test_runner_fixture_suite_covers_success_and_failure():
+    tests = (ROOT / "libs/tekton-dag-common/tests/test_run_stack_tests_runners.py").read_text()
+
+    assert "test_malformed_stack_json_fails" in tests
+    assert '"{not-json"' in tests
+    assert "test_runner_success_and_failure_paths" in tests
+    assert '"newman"' in tests
+    assert '"playwright"' in tests
+    assert '"artillery"' in tests
+    assert "[postman] PASS" in tests
+    assert "[postman] FAIL" in tests
+    assert "[playwright] PASS" in tests
+    assert "[playwright] FAIL" in tests
+    assert "[artillery] PASS" in tests
+    assert "[artillery] FAIL" in tests