feat: release-tools image source tree + build/publish Tekton pipelines #157

Merged

goern merged 0 commits from refs/pull/157/head into main 2026-05-25 22:20:10 +00:00

Conversation 36 Commits - Files changed -

goern commented 2026-05-25 16:55:54 +00:00 (Migrated from codeberg.org)

Copy link

Summary

Implements OpenSpec change release-tools-image (merged in #155) end-to-end. Two iterations, one PR:

• Iteration 1 (commit 240a544): image/release-tools/ — Containerfile, VERSIONS.md, pinned npm lockfile, build.sh, verify.sh, README, renovate.json. Image bundles Go + syft + goreleaser + cosign + Node 22 + jq + curl + mcpb on a Project Hummingbird base (registry.access.redhat.com/hi/go:<tag>-builder). Local verifier (bash build.sh && bash verify.sh) exits 0.
• Iteration 2 (commit acd6c87): .tekton/release-tools/ — 8 reusable Tasks + 2 PaC PipelineRuns. PR build (CEL-gated) + tag publish (push-by-digest → sign → attach SBOM → promote tag, closing the TOCTOU window). Defensive CEL added to existing .tekton/on-tag-push-release.yaml so a release-tools/vX.Y.Z tag never accidentally triggers the forgejo-mcp release pipeline.

Tracks issue #156 and bead forgejo-mcp-1b4. Closes the three runtime-install hazards (step-isolation, GOCACHE-in-workspace, distroless cosign) that bit v2.24.0/1/2.

What's in the diff

.tekton/on-tag-push-release.yaml                          | 9 + (defensive CEL)
.tekton/release-tools/on-pull-request-build.yaml          | 92 +
.tekton/release-tools/on-tag-publish.yaml                 | 166 +
.tekton/release-tools/tasks/build-image.yaml              | 61 +
.tekton/release-tools/tasks/cosign-attach-sbom.yaml       | 60 +
.tekton/release-tools/tasks/cosign-sign-image-by-digest.yaml | 59 +
.tekton/release-tools/tasks/promote-image-tag.yaml        | 70 +
.tekton/release-tools/tasks/push-image-by-digest.yaml     | 81 +
.tekton/release-tools/tasks/resolve-release-tools-tag.yaml | 30 +
.tekton/release-tools/tasks/syft-scan-image.yaml          | 53 +
.tekton/release-tools/tasks/verify-image-tools.yaml       | 55 +
image/release-tools/Containerfile                         | 98 +
image/release-tools/README.md                             | 134 +
image/release-tools/VERSIONS.md                           | 50 +
image/release-tools/.dockerignore                         | 8 +
image/release-tools/build.sh                              | 29 +
image/release-tools/verify.sh                             | 57 +
image/release-tools/npm/package.json                      | 9 +
image/release-tools/npm/package-lock.json                 | 651 +
image/release-tools/renovate.json                         | 50 +

~1,800 LOC across 20 files, all under the two structurally-isolated paths the OpenSpec change promised.

Key design points (per the merged spec + adversarial review)

• Base: Hummingbird hi/go:latest-builder (floats — Hummingbird hasn't shipped versioned tags yet; flagged in VERSIONS.md as TAG-FLOATING RISK).
• Isolation: every introduced path lives under image/release-tools/ or .tekton/release-tools/. Lift to a separate repo = git mv + the 5 enumerated operator actions in spec.md.
• CEL gates:
  • PR build: files.any.exists(p, p.matches("^(image/release-tools/|\\.tekton/release-tools/).*")) — fires only when image-tree changes (per adversarial review A4).
  • Tag publish: target_branch.matches("^refs/tags/release-tools/v.*").
  • Defensive on existing forgejo-mcp release pipeline: !target_branch.startsWith('refs/tags/release-tools/') — prevents cross-firing (A1).
• Signing posture: image-publish pipeline is fail-closed (optional: false), diverging intentionally from the artifact pipeline's fail-open posture (A3, documented in spec.md asymmetry note).
• TOCTOU-safe publish: push-by-digest → sign → attach SBOM → promote human-readable tag. No unsigned-tag window (L1).
• Supply chain: npm package pinned via committed package-lock.json + npm ci --ignore-scripts (L3). Then npm install -g makes mcpb on PATH and offline-npx work without a network round-trip (verified in the offline-network scenario test).

Bug rounds during dev-team execution

For the record (6 rounds in iter 1, all blocking issues fixed before commit):

1. tar missing in hi/go base
2. gzip missing too
3. COPY build context scope wrong (REPO_ROOT vs SCRIPT_DIR)
4. npx mcpb offline (needed global install in addition to lockfile)
5. COPY symlink-deref broke node module resolution
6. PASS

Iter 2 dev team passed verifier first try.

What this PR does NOT do

• Does not change the consuming forgejo-mcp release Tasks. .tekton/tasks/goreleaser-release.yaml, cosign-sign-release.yaml, mcpb-pack.yaml still install tools at runtime. Switching them to consume this image is a separate follow-up change (release-pipeline-use-release-tools-image), gated on the operator-confirmable preconditions below.
• Does not cut a release-tools tag. The publish pipeline is wired and validated locally, but no release-tools/v1.0.0 is pushed in this PR. First tag push happens after maintainer review + the registry-path decision below.

Operator-confirmable preconditions before first tag push

• Registry path: quay.io/operate-first/release-tools is the working assumption in pipeline headers. Coordinate with op1st-emea-b4mad maintainers; update the string in .tekton/release-tools/on-tag-publish.yaml and tasks/push-image-by-digest.yaml/promote-image-tag.yaml before merging the tag-publish trigger.
• Registry write credentials (Secret) provisioned in op1st-pipelines namespace.
• PaC controller in op1st-pipelines ≥ 0.22.0 (for files.any.exists CEL). Verify via oc -n op1st-pipelines exec deploy/pipelines-as-code-controller -- /ko-app/pipelines-as-code-controller --version.
• cosign-signing-key Secret in op1st-pipelines is already present (verified earlier in PR #150 work).

Test plan

Local (passes today on maintainer workstation):

• bash image/release-tools/build.sh exits 0 — produces localhost/release-tools:dev
• bash image/release-tools/verify.sh exits 0 — all 10 tool checks green including offline-npx mcpb
• openspec validate release-tools-image passes
• pre-commit (gitleaks) passes

PaC-driven (post-merge):

• First PR touching image/release-tools/ fires the new on-pull-request-build PipelineRun in op1st-pipelines
• First push of release-tools/v1.0.0 tag fires on-tag-publish, produces signed + SBOM-attached image at the agreed registry path
• cosign verify --key <op1st-pub-url> <image-ref> succeeds
• Push of v2.24.x forgejo-mcp tag fires ONLY the forgejo-mcp release pipeline, NOT the image-publish pipeline (defensive CEL works)

Follow-up beads (blocked on forgejo-mcp-1b4)

• forgejo-mcp-aun — Hummingbird SLO + CVE rescan
• forgejo-mcp-3h2 — Tighten pinning (vendor goreleaser, SHA256 curl)
• forgejo-mcp-j52 — Split cosign keypair (image vs artifact)
• forgejo-mcp-46j — SLSA provenance via Tekton Chains

These remain Status/Blocked until this PR merges + the image is live in the registry.

Out of scope follow-up

release-pipeline-use-release-tools-image — separate OpenSpec change that rewrites the three forgejo-mcp release Tasks to reference the published image and drops the runtime installs + /tmp GOCACHE workaround. First clean Tekton release then counts toward cutover criteria (forgejo-mcp-gdz).

## Summary Implements OpenSpec change [`release-tools-image`](https://codeberg.org/goern/forgejo-mcp/pulls/155) (merged in #155) end-to-end. Two iterations, one PR: - **Iteration 1** (commit `240a544`): `image/release-tools/` — Containerfile, VERSIONS.md, pinned npm lockfile, build.sh, verify.sh, README, renovate.json. Image bundles Go + syft + goreleaser + cosign + Node 22 + jq + curl + mcpb on a Project Hummingbird base (`registry.access.redhat.com/hi/go:<tag>-builder`). Local verifier (`bash build.sh && bash verify.sh`) exits 0. - **Iteration 2** (commit `acd6c87`): `.tekton/release-tools/` — 8 reusable Tasks + 2 PaC PipelineRuns. PR build (CEL-gated) + tag publish (push-by-digest → sign → attach SBOM → promote tag, closing the TOCTOU window). Defensive CEL added to existing `.tekton/on-tag-push-release.yaml` so a `release-tools/vX.Y.Z` tag never accidentally triggers the forgejo-mcp release pipeline. Tracks issue #156 and bead `forgejo-mcp-1b4`. Closes the three runtime-install hazards (step-isolation, GOCACHE-in-workspace, distroless cosign) that bit v2.24.0/1/2. ## What's in the diff ``` .tekton/on-tag-push-release.yaml | 9 + (defensive CEL) .tekton/release-tools/on-pull-request-build.yaml | 92 + .tekton/release-tools/on-tag-publish.yaml | 166 + .tekton/release-tools/tasks/build-image.yaml | 61 + .tekton/release-tools/tasks/cosign-attach-sbom.yaml | 60 + .tekton/release-tools/tasks/cosign-sign-image-by-digest.yaml | 59 + .tekton/release-tools/tasks/promote-image-tag.yaml | 70 + .tekton/release-tools/tasks/push-image-by-digest.yaml | 81 + .tekton/release-tools/tasks/resolve-release-tools-tag.yaml | 30 + .tekton/release-tools/tasks/syft-scan-image.yaml | 53 + .tekton/release-tools/tasks/verify-image-tools.yaml | 55 + image/release-tools/Containerfile | 98 + image/release-tools/README.md | 134 + image/release-tools/VERSIONS.md | 50 + image/release-tools/.dockerignore | 8 + image/release-tools/build.sh | 29 + image/release-tools/verify.sh | 57 + image/release-tools/npm/package.json | 9 + image/release-tools/npm/package-lock.json | 651 + image/release-tools/renovate.json | 50 + ``` ~1,800 LOC across 20 files, all under the two structurally-isolated paths the OpenSpec change promised. ## Key design points (per the merged spec + adversarial review) - **Base**: Hummingbird `hi/go:latest-builder` (floats — Hummingbird hasn't shipped versioned tags yet; flagged in VERSIONS.md as TAG-FLOATING RISK). - **Isolation**: every introduced path lives under `image/release-tools/` or `.tekton/release-tools/`. Lift to a separate repo = `git mv` + the 5 enumerated operator actions in spec.md. - **CEL gates**: - PR build: `files.any.exists(p, p.matches("^(image/release-tools/|\\.tekton/release-tools/).*"))` — fires only when image-tree changes (per adversarial review A4). - Tag publish: `target_branch.matches("^refs/tags/release-tools/v.*")`. - Defensive on existing forgejo-mcp release pipeline: `!target_branch.startsWith('refs/tags/release-tools/')` — prevents cross-firing (A1). - **Signing posture**: image-publish pipeline is **fail-closed** (`optional: false`), diverging intentionally from the artifact pipeline's fail-open posture (A3, documented in spec.md asymmetry note). - **TOCTOU-safe publish**: push-by-digest → sign → attach SBOM → promote human-readable tag. No unsigned-tag window (L1). - **Supply chain**: npm package pinned via committed `package-lock.json` + `npm ci --ignore-scripts` (L3). Then `npm install -g` makes mcpb on PATH and offline-npx work without a network round-trip (verified in the offline-network scenario test). ## Bug rounds during dev-team execution For the record (6 rounds in iter 1, all blocking issues fixed before commit): 1. tar missing in `hi/go` base 2. gzip missing too 3. COPY build context scope wrong (REPO_ROOT vs SCRIPT_DIR) 4. npx mcpb offline (needed global install in addition to lockfile) 5. COPY symlink-deref broke node module resolution 6. PASS Iter 2 dev team passed verifier first try. ## What this PR does NOT do - **Does not change the consuming forgejo-mcp release Tasks.** `.tekton/tasks/goreleaser-release.yaml`, `cosign-sign-release.yaml`, `mcpb-pack.yaml` still install tools at runtime. Switching them to consume this image is a separate follow-up change (`release-pipeline-use-release-tools-image`), gated on the operator-confirmable preconditions below. - **Does not cut a release-tools tag.** The publish pipeline is wired and validated locally, but no `release-tools/v1.0.0` is pushed in this PR. First tag push happens after maintainer review + the registry-path decision below. ## Operator-confirmable preconditions before first tag push - Registry path: `quay.io/operate-first/release-tools` is the working assumption in pipeline headers. Coordinate with op1st-emea-b4mad maintainers; update the string in `.tekton/release-tools/on-tag-publish.yaml` and `tasks/push-image-by-digest.yaml`/`promote-image-tag.yaml` before merging the tag-publish trigger. - Registry write credentials (Secret) provisioned in `op1st-pipelines` namespace. - PaC controller in `op1st-pipelines` ≥ 0.22.0 (for `files.any.exists` CEL). Verify via `oc -n op1st-pipelines exec deploy/pipelines-as-code-controller -- /ko-app/pipelines-as-code-controller --version`. - `cosign-signing-key` Secret in `op1st-pipelines` is already present (verified earlier in PR #150 work). ## Test plan Local (passes today on maintainer workstation): - [x] `bash image/release-tools/build.sh` exits 0 — produces `localhost/release-tools:dev` - [x] `bash image/release-tools/verify.sh` exits 0 — all 10 tool checks green including offline-npx mcpb - [x] `openspec validate release-tools-image` passes - [x] pre-commit (gitleaks) passes PaC-driven (post-merge): - [ ] First PR touching `image/release-tools/` fires the new `on-pull-request-build` PipelineRun in `op1st-pipelines` - [ ] First push of `release-tools/v1.0.0` tag fires `on-tag-publish`, produces signed + SBOM-attached image at the agreed registry path - [ ] `cosign verify --key <op1st-pub-url> <image-ref>` succeeds - [ ] Push of `v2.24.x` forgejo-mcp tag fires ONLY the forgejo-mcp release pipeline, NOT the image-publish pipeline (defensive CEL works) ## Follow-up beads (blocked on `forgejo-mcp-1b4`) - `forgejo-mcp-aun` — Hummingbird SLO + CVE rescan - `forgejo-mcp-3h2` — Tighten pinning (vendor goreleaser, SHA256 curl) - `forgejo-mcp-j52` — Split cosign keypair (image vs artifact) - `forgejo-mcp-46j` — SLSA provenance via Tekton Chains These remain `Status/Blocked` until this PR merges + the image is live in the registry. ## Out of scope follow-up `release-pipeline-use-release-tools-image` — separate OpenSpec change that rewrites the three forgejo-mcp release Tasks to reference the published image and drops the runtime installs + `/tmp` GOCACHE workaround. First clean Tekton release then counts toward cutover criteria (`forgejo-mcp-gdz`).

op1st-gitops commented 2026-05-25 16:55:57 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-qdznq is running.

Starting Pipelinerun code-scans-qdznq in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-qdznq -f

op1st Pipelines as Code/code-scans-qdznq is running. Starting Pipelinerun <b>[code-scans-qdznq](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-qdznq -f</code>

op1st-gitops commented 2026-05-25 16:55:57 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-tzsgx is running.

Starting Pipelinerun on-pull-request-tzsgx in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-tzsgx -f

op1st Pipelines as Code/on-pull-request-tzsgx is running. Starting Pipelinerun <b>[on-pull-request-tzsgx](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tzsgx)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tzsgx) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-tzsgx -f</code>

op1st-gitops commented 2026-05-25 16:56:19 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-qdznq has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-qdznq

---

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	7 seconds	gitleaks-version
Succeeded	9 seconds	gitleaks

op1st Pipelines as Code/code-scans-qdznq has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq">code-scans-qdznq</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>7 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qdznq/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 16:57:24 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-tzsgx has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-tzsgx

---

Task Statuses:

Status	Duration	Name
Succeeded	12 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-tzsgx has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tzsgx">on-pull-request-tzsgx</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tzsgx/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tzsgx/logs/build-and-test) </td></tr> </table>

op1st-gitops commented 2026-05-25 17:09:06 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-f95rp is running.

Starting Pipelinerun openspec-validate-pr-f95rp in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines openspec-validate-pr-f95rp -f

op1st Pipelines as Code/openspec-validate-pr-f95rp is running. Starting Pipelinerun <b>[openspec-validate-pr-f95rp](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-f95rp)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-f95rp) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines openspec-validate-pr-f95rp -f</code>

op1st-gitops commented 2026-05-25 17:09:06 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-qszxh is running.

Starting Pipelinerun on-pull-request-qszxh in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-qszxh -f

op1st Pipelines as Code/on-pull-request-qszxh is running. Starting Pipelinerun <b>[on-pull-request-qszxh](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-qszxh)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-qszxh) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-qszxh -f</code>

op1st-gitops commented 2026-05-25 17:09:06 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-mvwxw is running.

Starting Pipelinerun code-scans-mvwxw in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-mvwxw -f

op1st Pipelines as Code/code-scans-mvwxw is running. Starting Pipelinerun <b>[code-scans-mvwxw](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-mvwxw -f</code>

op1st-gitops commented 2026-05-25 17:09:30 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-mvwxw has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-mvwxw

---

Task Statuses:

Status	Duration	Name
Succeeded	12 seconds	fetch-source
Succeeded	9 seconds	gitleaks-version
Succeeded	10 seconds	gitleaks

op1st Pipelines as Code/code-scans-mvwxw has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw">code-scans-mvwxw</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-mvwxw/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 17:09:37 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-f95rp has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: openspec-validate-pr-f95rp

---

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	20 seconds	validate

op1st Pipelines as Code/openspec-validate-pr-f95rp has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-f95rp">openspec-validate-pr-f95rp</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-f95rp/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>20 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-f95rp/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-05-25 17:10:43 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-qszxh has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-qszxh

---

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-qszxh has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-qszxh">on-pull-request-qszxh</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-qszxh/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-qszxh/logs/build-and-test) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:11:51 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-jh76p is running.

Starting Pipelinerun openspec-validate-pr-jh76p in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines openspec-validate-pr-jh76p -f

op1st Pipelines as Code/openspec-validate-pr-jh76p is running. Starting Pipelinerun <b>[openspec-validate-pr-jh76p](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-jh76p)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-jh76p) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines openspec-validate-pr-jh76p -f</code>

op1st-gitops commented 2026-05-25 21:11:52 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-556wx is running.

Starting Pipelinerun on-pull-request-556wx in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-556wx -f

op1st Pipelines as Code/on-pull-request-556wx is running. Starting Pipelinerun <b>[on-pull-request-556wx](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-556wx)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-556wx) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-556wx -f</code>

op1st-gitops commented 2026-05-25 21:11:52 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-hhrtk is running.

Starting Pipelinerun code-scans-hhrtk in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-hhrtk -f

op1st Pipelines as Code/code-scans-hhrtk is running. Starting Pipelinerun <b>[code-scans-hhrtk](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-hhrtk -f</code>

goern commented 2026-05-25 21:12:04 +00:00 (Migrated from codeberg.org)

Copy link

Fix commit: d59b910

All 11 review findings addressed in commit d59b910 (fix: 🔒️ address automated code review findings from PR #157). Summary per comment:

File	Issue	Fix
Containerfile	Floating latest-builder tag	Added HI_GO_DIGEST ARG; both FROM lines now pin image:tag@digest
Containerfile	syft installer from anchore/syft/main/install.sh	URL changed to anchore/syft/${SYFT_VERSION}/install.sh (tagged ref)
Containerfile	cosign curl — no integrity check	Added curl of cosign_checksums.txt + sha256sum -c before chmod +x
Containerfile	npm install -g re-resolves transitive deps outside lockfile	Replaced with cp -r /npm-src/node_modules/. /usr/local/lib/node_modules/ — copies the npm ci (lockfile-pinned) tree directly
build-image.yaml	IMAGE_DIGEST extraction returned base image digest	Dropped the broken extraction; emit empty pre-push, real manifest digest captured by push-image-by-digest --digestfile
syft-scan-image.yaml	syft ran inside container against unpushed image → registry pull failure	Rewritten: installs syft on host step, exports image to oci-archive:, scans archive
push-image-by-digest.yaml	buildah inherits source tag at destination; version tag visible pre-sign	Retag local image to release-tools:build-tmp first; push explicitly to :build-tmp destination
cosign-sign-image-by-digest.yaml	cosign curl — no integrity check	Same checksum-verification pattern as Containerfile
cosign-attach-sbom.yaml	syft from main + cosign no integrity	Same fixes: pin syft URL to tagged ref, verify cosign checksum
on-tag-publish.yaml	SKIP_SIGN ungated — any v* tag could publish unsigned	Added validate-skip-sign inline task: fails if SKIP_SIGN=true and resolved tag ≠ v1.0.0; added to cosign-sign.runAfter
README.md	cosign.pub from mutable operate-first/common/main branch	Replaced with commit-pinned Codeberg op1st-emea-b4mad URL (same pattern as root README)

## Fix commit: d59b910 All 11 review findings addressed in commit `d59b910` (`fix: 🔒️ address automated code review findings from PR #157`). Summary per comment: | File | Issue | Fix | |---|---|---| | `Containerfile` | Floating `latest-builder` tag | Added `HI_GO_DIGEST` ARG; both `FROM` lines now pin `image:tag@digest` | | `Containerfile` | syft installer from `anchore/syft/main/install.sh` | URL changed to `anchore/syft/${SYFT_VERSION}/install.sh` (tagged ref) | | `Containerfile` | cosign curl — no integrity check | Added curl of `cosign_checksums.txt` + `sha256sum -c` before `chmod +x` | | `Containerfile` | `npm install -g` re-resolves transitive deps outside lockfile | Replaced with `cp -r /npm-src/node_modules/. /usr/local/lib/node_modules/` — copies the `npm ci` (lockfile-pinned) tree directly | | `build-image.yaml` | `IMAGE_DIGEST` extraction returned base image digest | Dropped the broken extraction; emit empty pre-push, real manifest digest captured by `push-image-by-digest --digestfile` | | `syft-scan-image.yaml` | syft ran inside container against unpushed image → registry pull failure | Rewritten: installs syft on host step, exports image to `oci-archive:`, scans archive | | `push-image-by-digest.yaml` | buildah inherits source tag at destination; version tag visible pre-sign | Retag local image to `release-tools:build-tmp` first; push explicitly to `:build-tmp` destination | | `cosign-sign-image-by-digest.yaml` | cosign curl — no integrity check | Same checksum-verification pattern as Containerfile | | `cosign-attach-sbom.yaml` | syft from `main` + cosign no integrity | Same fixes: pin syft URL to tagged ref, verify cosign checksum | | `on-tag-publish.yaml` | `SKIP_SIGN` ungated — any `v*` tag could publish unsigned | Added `validate-skip-sign` inline task: fails if `SKIP_SIGN=true` and resolved tag ≠ `v1.0.0`; added to `cosign-sign.runAfter` | | `README.md` | cosign.pub from mutable `operate-first/common/main` branch | Replaced with commit-pinned Codeberg op1st-emea-b4mad URL (same pattern as root README) |

op1st-gitops commented 2026-05-25 21:12:21 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-hhrtk has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-hhrtk

---

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	11 seconds	gitleaks-version
Succeeded	8 seconds	gitleaks

op1st Pipelines as Code/code-scans-hhrtk has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk">code-scans-hhrtk</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>8 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-hhrtk/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:12:27 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-jh76p has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: openspec-validate-pr-jh76p

---

Task Statuses:

Status	Duration	Name
Succeeded	19 seconds	fetch-source
Succeeded	17 seconds	validate

op1st Pipelines as Code/openspec-validate-pr-jh76p has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-jh76p">openspec-validate-pr-jh76p</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>19 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-jh76p/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>17 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-jh76p/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:14:08 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-556wx has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-556wx

---

Task Statuses:

Status	Duration	Name
Succeeded	18 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-556wx has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-556wx">on-pull-request-556wx</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>18 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-556wx/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-556wx/logs/build-and-test) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:19:50 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-kgspj is running.

Starting Pipelinerun openspec-validate-pr-kgspj in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines openspec-validate-pr-kgspj -f

op1st Pipelines as Code/openspec-validate-pr-kgspj is running. Starting Pipelinerun <b>[openspec-validate-pr-kgspj](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-kgspj)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-kgspj) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines openspec-validate-pr-kgspj -f</code>

op1st-gitops commented 2026-05-25 21:19:50 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-h8bjd is running.

Starting Pipelinerun code-scans-h8bjd in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-h8bjd -f

op1st Pipelines as Code/code-scans-h8bjd is running. Starting Pipelinerun <b>[code-scans-h8bjd](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-h8bjd -f</code>

op1st-gitops commented 2026-05-25 21:19:50 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-mgkbx is running.

Starting Pipelinerun on-pull-request-mgkbx in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-mgkbx -f

op1st Pipelines as Code/on-pull-request-mgkbx is running. Starting Pipelinerun <b>[on-pull-request-mgkbx](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mgkbx)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mgkbx) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-mgkbx -f</code>

op1st-gitops commented 2026-05-25 21:20:14 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-h8bjd has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-h8bjd

---

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	10 seconds	gitleaks-version
Succeeded	10 seconds	gitleaks

op1st Pipelines as Code/code-scans-h8bjd has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd">code-scans-h8bjd</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-h8bjd/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:20:22 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-kgspj has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: openspec-validate-pr-kgspj

---

Task Statuses:

Status	Duration	Name
Succeeded	14 seconds	fetch-source
Succeeded	17 seconds	validate

op1st Pipelines as Code/openspec-validate-pr-kgspj has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-kgspj">openspec-validate-pr-kgspj</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-kgspj/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>17 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-kgspj/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:21:27 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-mgkbx has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-mgkbx

---

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-mgkbx has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mgkbx">on-pull-request-mgkbx</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mgkbx/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-mgkbx/logs/build-and-test) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:23:52 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-tcpr5 is running.

Starting Pipelinerun on-pull-request-tcpr5 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-tcpr5 -f

op1st Pipelines as Code/on-pull-request-tcpr5 is running. Starting Pipelinerun <b>[on-pull-request-tcpr5](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tcpr5)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tcpr5) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-tcpr5 -f</code>

op1st-gitops commented 2026-05-25 21:23:52 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-w82t5 is running.

Starting Pipelinerun code-scans-w82t5 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-w82t5 -f

op1st Pipelines as Code/code-scans-w82t5 is running. Starting Pipelinerun <b>[code-scans-w82t5](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-w82t5 -f</code>

op1st-gitops commented 2026-05-25 21:23:52 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-fw8sj is running.

Starting Pipelinerun openspec-validate-pr-fw8sj in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines openspec-validate-pr-fw8sj -f

op1st Pipelines as Code/openspec-validate-pr-fw8sj is running. Starting Pipelinerun <b>[openspec-validate-pr-fw8sj](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-fw8sj)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-fw8sj) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines openspec-validate-pr-fw8sj -f</code>

goern commented 2026-05-25 21:24:03 +00:00 (Migrated from codeberg.org)

Copy link

Follow-up commits: govulncheck + openspec baked in; all .tekton/tasks/ rewritten

Two more commits on this branch:

c1316d8 — feat: ✨ add govulncheck + openspec to release-tools image

• govulncheck added via go install golang.org/x/vuln/cmd/govulncheck@latest in tools-builder, copied to final stage
• @fission-ai/openspec@1.3.1 added to npm/package-lock.json (lockfile integrity, bin path bin/openspec.js confirmed from lockfile metadata), symlinked at /usr/local/bin/openspec
• GOVULNCHECK_VERSION ARG added (default: latest)
• VERSIONS.md, renovate.json, README bundled-tools list updated

0dcb2e1 — refactor: ♻️ rewrite .tekton/tasks/ to use release-tools image

All 5 tasks in .tekton/tasks/ now use RELEASE_TOOLS_IMAGE (default: codeberg.org/operate-first/release-tools:latest). No task installs software at runtime:

Task	Removed	Change
goreleaser-release	curl syft/main/install.sh + go install goreleaser	GO_IMAGE/SYFT_VERSION/GORELEASER_VERSION → RELEASE_TOOLS_IMAGE; install+run Steps now separate
cosign-sign-release	microdnf install jq curl tar gzip	COSIGN_IMAGE/TOOLS_IMAGE → RELEASE_TOOLS_IMAGE
mcpb-pack	apt-get install jq curl + npx -y @anthropic-ai/mcpb	NODE_IMAGE/TOOLS_IMAGE → RELEASE_TOOLS_IMAGE; mcpb pack directly
go-ci (govulncheck step only)	go install golang.org/x/vuln/cmd/govulncheck	GOVULNCHECK_VERSION removed; govulncheck ./... directly
openspec-validate	npm install -g @fission-ai/openspec	NODE_IMAGE/OPENSPEC_VERSION removed; openspec validate directly

GO_IMAGE and GOLANGCI_LINT_IMAGE params in go-ci remain — those steps had no runtime installs and golangci-lint is not in release-tools (by design; tracked in forgejo-mcp-7g9 for future image decomposition).

## Follow-up commits: govulncheck + openspec baked in; all .tekton/tasks/ rewritten Two more commits on this branch: **`c1316d8`** — `feat: ✨ add govulncheck + openspec to release-tools image` - `govulncheck` added via `go install golang.org/x/vuln/cmd/govulncheck@latest` in tools-builder, copied to final stage - `@fission-ai/openspec@1.3.1` added to `npm/package-lock.json` (lockfile integrity, bin path `bin/openspec.js` confirmed from lockfile metadata), symlinked at `/usr/local/bin/openspec` - `GOVULNCHECK_VERSION` ARG added (default: `latest`) - VERSIONS.md, renovate.json, README bundled-tools list updated **`0dcb2e1`** — `refactor: ♻️ rewrite .tekton/tasks/ to use release-tools image` All 5 tasks in `.tekton/tasks/` now use `RELEASE_TOOLS_IMAGE` (default: `codeberg.org/operate-first/release-tools:latest`). No task installs software at runtime: | Task | Removed | Change | |---|---|---| | `goreleaser-release` | `curl syft/main/install.sh` + `go install goreleaser` | `GO_IMAGE`/`SYFT_VERSION`/`GORELEASER_VERSION` → `RELEASE_TOOLS_IMAGE`; install+run Steps now separate | | `cosign-sign-release` | `microdnf install jq curl tar gzip` | `COSIGN_IMAGE`/`TOOLS_IMAGE` → `RELEASE_TOOLS_IMAGE` | | `mcpb-pack` | `apt-get install jq curl` + `npx -y @anthropic-ai/mcpb` | `NODE_IMAGE`/`TOOLS_IMAGE` → `RELEASE_TOOLS_IMAGE`; `mcpb pack` directly | | `go-ci` (govulncheck step only) | `go install golang.org/x/vuln/cmd/govulncheck` | `GOVULNCHECK_VERSION` removed; `govulncheck ./...` directly | | `openspec-validate` | `npm install -g @fission-ai/openspec` | `NODE_IMAGE`/`OPENSPEC_VERSION` removed; `openspec validate` directly | `GO_IMAGE` and `GOLANGCI_LINT_IMAGE` params in `go-ci` remain — those steps had no runtime installs and golangci-lint is not in release-tools (by design; tracked in `forgejo-mcp-7g9` for future image decomposition).

op1st-gitops commented 2026-05-25 21:24:26 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-tcpr5 has failed.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-tcpr5

---

Task Statuses:

Status	Duration	Name
Succeeded	14 seconds	fetch-source
Failed	19 seconds	build-and-test

---

Failure snippet:

task build-and-test has the status "TaskRunImagePullFailed":

the step "govulncheck" in TaskRun "on-pull-request-tcpr5-build-and-test" failed to pull the image "". The pod errored with the message: "Back-off pulling image "codeberg.org/operate-first/release-tools:latest": ErrImagePull: unable to pull image or OCI artifact: pull image err: initializing source docker://codeberg.org/operate-first/release-tools:latest: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown; artifact err: get manifest: build image source: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown."

op1st Pipelines as Code/on-pull-request-tcpr5 has <b>failed</b>. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tcpr5">on-pull-request-tcpr5</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tcpr5/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>19 seconds</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tcpr5/logs/build-and-test) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>build-and-test</b> has the status <b>"TaskRunImagePullFailed"</b>: <pre>the step "govulncheck" in TaskRun "on-pull-request-tcpr5-build-and-test" failed to pull the image "". The pod errored with the message: "Back-off pulling image "codeberg.org/operate-first/release-tools:latest": ErrImagePull: unable to pull image or OCI artifact: pull image err: initializing source docker://codeberg.org/operate-first/release-tools:latest: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown; artifact err: get manifest: build image source: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown."</pre>

op1st-gitops commented 2026-05-25 21:24:34 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-fw8sj has failed.

• Namespace: op1st-pipelines
• PipelineRun: openspec-validate-pr-fw8sj

---

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Failed	27 seconds	validate

---

Failure snippet:

task validate has the status "TaskRunImagePullFailed":

the step "validate" in TaskRun "openspec-validate-pr-fw8sj-validate" failed to pull the image "". The pod errored with the message: "Back-off pulling image "codeberg.org/operate-first/release-tools:latest": ErrImagePull: unable to pull image or OCI artifact: pull image err: initializing source docker://codeberg.org/operate-first/release-tools:latest: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown; artifact err: get manifest: build image source: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown."

op1st Pipelines as Code/openspec-validate-pr-fw8sj has <b>failed</b>. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-fw8sj">openspec-validate-pr-fw8sj</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-fw8sj/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>27 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-fw8sj/logs/validate) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>validate</b> has the status <b>"TaskRunImagePullFailed"</b>: <pre>the step "validate" in TaskRun "openspec-validate-pr-fw8sj-validate" failed to pull the image "". The pod errored with the message: "Back-off pulling image "codeberg.org/operate-first/release-tools:latest": ErrImagePull: unable to pull image or OCI artifact: pull image err: initializing source docker://codeberg.org/operate-first/release-tools:latest: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown; artifact err: get manifest: build image source: reading manifest latest in codeberg.org/operate-first/release-tools: manifest unknown."</pre>

op1st-gitops commented 2026-05-25 21:25:43 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-w82t5 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-w82t5

---

Task Statuses:

Status	Duration	Name
Succeeded	10 seconds	fetch-source
Succeeded	9 seconds	gitleaks-version
Succeeded	1 minute	gitleaks

op1st Pipelines as Code/code-scans-w82t5 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5">code-scans-w82t5</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-w82t5/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:38:36 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-lv8k2 is running.

Starting Pipelinerun openspec-validate-pr-lv8k2 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines openspec-validate-pr-lv8k2 -f

op1st Pipelines as Code/openspec-validate-pr-lv8k2 is running. Starting Pipelinerun <b>[openspec-validate-pr-lv8k2](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-lv8k2)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-lv8k2) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines openspec-validate-pr-lv8k2 -f</code>

op1st-gitops commented 2026-05-25 21:38:36 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-r562x is running.

Starting Pipelinerun code-scans-r562x in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-r562x -f

op1st Pipelines as Code/code-scans-r562x is running. Starting Pipelinerun <b>[code-scans-r562x](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-r562x -f</code>

op1st-gitops commented 2026-05-25 21:38:37 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-hf2qj is running.

Starting Pipelinerun on-pull-request-hf2qj in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-hf2qj -f

op1st Pipelines as Code/on-pull-request-hf2qj is running. Starting Pipelinerun <b>[on-pull-request-hf2qj](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-hf2qj)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-hf2qj) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-hf2qj -f</code>

op1st-gitops commented 2026-05-25 21:39:02 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-r562x has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-r562x

---

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	9 seconds	gitleaks-version
Succeeded	9 seconds	gitleaks

op1st Pipelines as Code/code-scans-r562x has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x">code-scans-r562x</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-r562x/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:39:39 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/openspec-validate-pr-lv8k2 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: openspec-validate-pr-lv8k2

---

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	49 seconds	validate

op1st Pipelines as Code/openspec-validate-pr-lv8k2 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-lv8k2">openspec-validate-pr-lv8k2</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-lv8k2/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>49 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/openspec-validate-pr-lv8k2/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-05-25 21:40:44 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-hf2qj has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-hf2qj

---

Task Statuses:

Status	Duration	Name
Succeeded	12 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-hf2qj has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-hf2qj">on-pull-request-hf2qj</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-hf2qj/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-hf2qj/logs/build-and-test) </td></tr> </table>

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/OpenSpec

OpenSpec change proposal / spec-driven work

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority/Critical

The priority is critical

  

Priority/High

The priority is high

  

Priority/Low

The priority is low

  

Priority/Medium

The priority is medium

  

RFC - Request For Comments

Request For Comments — design/spec open for feedback before implementation

  

Reviewed/Confirmed

Issue has been confirmed

  

Reviewed/Duplicate

This issue or pull request already exists

  

Reviewed/Invalid

Invalid issue

  

Reviewed/Won't Fix

This issue won't be fixed

  

Status/Abandoned

Somebody has started to work on this but abandoned work

  

Status/Blocked

Something is blocking this issue or pull request

  

Status/Need More Info

Feedback is required to reproduce issue or to continue work

  

hermes-attempted

Hermes attempted but produced no changes

  

hermes-needs-clarification

Quality gate flagged, needs human input

  

hermes-ready

Ready for hermes to process

  

hermes-review

Hermes PR awaiting review

  

hermes-wip

Hermes is working on this

  

human-required

Hermes gave up after 3 attempts

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/OpenSpec

Kind/Security

Kind/Testing

Priority/Critical

Priority/High

Priority/Low

Priority/Medium

RFC - Request For Comments

Reviewed/Confirmed

Reviewed/Duplicate

Reviewed/Invalid

Reviewed/Won't Fix

Status/Abandoned

Status/Blocked

Status/Need More Info

hermes-attempted

hermes-needs-clarification

hermes-ready

hermes-review

hermes-wip

human-required

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!157

No description provided.