feat(runners): implement Tekton Pipeline runner with native metadata discovery by waveywaves · Pull Request #2767 · chainloop-dev/chainloop

waveywaves · 2026-02-21T01:38:03Z

Summary

Implement the TektonPipeline runner with two-tier native metadata discovery: Tier 1 reads HOSTNAME env var and ServiceAccount namespace file (always available in K8s pods); Tier 2 makes a best-effort K8s API call to discover tekton.dev/* pod labels for rich pipeline context
Implement all SupportedRunner interface methods: RunURI (Tekton Dashboard URL with tekton-pipeline:// fallback), Report (writes to /tekton/results/attestation-report with 3500-byte truncation), Environment (detects GKE/EKS/AKS as Managed vs self-hosted), ListEnvVars, and ResolveEnvVars (synthesizes discovered metadata as key-value entries)
Wire factory in runner.go to pass logger to NewTektonPipeline
Add 26 unit tests using testify suite pattern (7 discovery tests + 19 interface method tests), all passing with race detection

Design decisions

No artificial env vars required: Unlike the previous approach (chore(runner): First cut on Tekton pipeline detection #2581), the runner discovers all metadata natively from the pod's runtime environment. Task YAML does not need to map $(context.*) variables as env vars
Graceful degradation: If K8s API access fails (RBAC denied, missing SA token), the runner continues with Tier 1 data only — it never blocks attestation
Functional options pattern: WithHTTPClient, WithSATokenPath, WithNamespacePath, WithCACertPath, WithResultsDir allow test injection without polluting the production API

Testing

26 unit tests covering discovery success, RBAC denial, missing SA token/namespace, all RunURI variants, Report truncation, Environment detection, and ResolveEnvVars
E2E validated in a kind cluster with Tekton v1.6.0 (9/9 checks pass)
No regressions in existing runner test suites (GitHub Actions, GitLab, etc.)

migmartri · 2026-02-24T08:54:43Z

@cubic-dev-ai review

cubic-dev-ai · 2026-02-24T08:54:48Z

@cubic-dev-ai review

@migmartri I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 3 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/runners/tektonpipeline_test.go">

<violation number="1" location="pkg/attestation/crafter/runners/tektonpipeline_test.go:111">
P3: Unused `tmpDir` in test: `t.TempDir()` is called and immediately suppressed with `_ = tmpDir`. The test only exercises `taskRunNameFromHostname()` via a struct literal — no temp directory is needed. Remove both lines to avoid unnecessary filesystem allocations.</violation>
</file>

Since this is your first cubic review, here's how it works:

cubic automatically reviews your code and comments on bugs and improvements
Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

pkg/attestation/crafter/runners/tektonpipeline_test.go

pkg/attestation/crafter/runners/tektonpipeline.go

javirln · 2026-02-25T15:19:02Z

Thanks @waveywaves for the PR! Could you please provide an example of a completed chainloop attestation that has been processed on Tekton?

javirln

That's basically why I would to see this: #2767 (comment) 👀

javirln · 2026-02-25T15:30:00Z

pkg/attestation/crafter/runners/tektonpipeline.go

+	// All metadata is discovered from K8s API labels and filesystem.
+	// Return HOSTNAME as the only env var we consume (for traceability in attestation).
+	return []*EnvVarDefinition{
+		{"HOSTNAME", true},


Although the environment variables could not be auto resolved automatically, I think it would be good to have TEKTON_TASKRUN_NAME, TEKTON_PIPELINE_NAME, TEKTON_PIPELINERUN_NAME, TEKTON_TASK_NAME, TEKTON_PIPELINE_TASK_NAME, and TEKTON_NAMESPACE as we do with the rest of the runners.

In the Dagger client for example, we "promote" the underlying environment variables because of the encapsulation of Dagger

I have added support for promoting env vars like it's done for dagger and have 2 required and 5 optional env vars as inline tasks and pipeline names might not necessarily be present.

cubic-dev-ai

3 issues found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="test/e2e/tekton-runner/main.go">

<violation number="1" location="test/e2e/tekton-runner/main.go:137">
P2: The `Environment` check always reports PASS regardless of the returned value. Unlike every other check in this e2e test, there's no conditional validation — if `r.Environment()` returns `Unknown` (e.g., due to a detection bug), the test silently passes. Add validation for the expected environment value.</violation>
</file>

<file name="pkg/attestation/crafter/runners/tektonpipeline.go">

<violation number="1" location="pkg/attestation/crafter/runners/tektonpipeline.go:63">
P2: Storing `context.Context` in a struct is a Go anti-pattern, and here `r.ctx` is only used during construction (in `discoverLabelsFromKubeAPI`, called from `NewTektonPipeline`). After the constructor returns, the field is never read again — it's dead state. Pass `ctx` as a parameter to `discoverLabelsFromKubeAPI(ctx)` and remove the struct field.

(Based on your team's feedback about removing unused code, methods, and variables.) [FEEDBACK_USED]</violation>

<violation number="2" location="pkg/attestation/crafter/runners/tektonpipeline.go:247">
P1: `TEKTON_TASKRUN_NAME` is marked as required, but its value comes exclusively from Tier 2 K8s API discovery (`r.labels["tekton.dev/taskRun"]`). If the K8s API call fails (RBAC denied, missing SA token), this label will be empty and `ResolveEnvVars` will return an error — blocking attestation. This contradicts the PR's "graceful degradation" design goal. Consider either making it optional (with `optionalVar`) or falling back to the `taskRunNameFromHostname()` derivation that `RunURI` already uses.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

pkg/attestation/crafter/runners/tektonpipeline.go

test/e2e/tekton-runner/main.go

pkg/attestation/crafter/runners/tektonpipeline.go

migmartri · 2026-03-02T18:01:34Z

@waveywaves could you make sure you sign-off the commit, thanks!

javirln

I'm sorry to block the PR but I have high concerns about the blockade of the attestation when one environment variable couldn't be resolved due to RBAC restrictions.

Also please, could you please share a result of a Chainloop attestation, I would like to see the populated runner environment variables.

Thanks!

javirln · 2026-03-03T07:09:40Z

pkg/attestation/crafter/runners/tektonpipeline.go

+	optionalVar("HOSTNAME", os.Getenv("HOSTNAME"))
+
+	// Required: always available in any TaskRun (needs RBAC for pod get)
+	requireVar("TEKTON_TASKRUN_NAME", r.labels["tekton.dev/taskRun"])


Please pay attention to what https://github.com/chainloop-dev/chainloop/pull/2767/changes#r2864820538 is saying. If we get blocked by RBAC the attestation will be blocked.

The taskRunNameFromHostname() method already exists as a fallback and is used in RunURI(). The fix is to also use it here:

taskRunName := r.labels["tekton.dev/taskRun"] if taskRunName == "" { taskRunName = r.taskRunNameFromHostname() } requireVar("TEKTON_TASKRUN_NAME", taskRunName)

I have added a fallback as you have mentioned.

javirln · 2026-03-03T07:10:32Z

pkg/attestation/crafter/runners/tektonpipeline.go

+	}
+
+	r := &TektonPipeline{
+		ctx:             ctx,


Why do we need the context as part of the struct?

Updated to pass the context from the top.

waveywaves · 2026-03-03T15:44:06Z

@javirln I appreciate the collaboration to make the best of this feature and to ship it in a way that works well. Thanks for reviewing. Please don't apologize for reviewing the PR. Shall reply soon.

waveywaves · 2026-03-05T11:07:55Z

Here is a completed Chainloop attestation processed on a real Tekton Pipeline running on a kind cluster.

Runner detection and initialization:

--- Initializing Attestation ---
INF Attestation initialized! now you can check its status or add materials to it
+-----------------------------------------------------------+
| Attestation ID            | 21664fe0-7cc0-4e65-ab86-fd9e2ec024e1                |
| Organization              | tekton-demo-org                                     |
| Name                      | tekton-demo                                         |
| Project                   | tekton-integration                                  |
| Contract                  | tekton-integration-tekton-demo (revision 1)         |
| Runner Type               | TEKTON_PIPELINE                                     |
| Runner URL                | tekton://demo/pipelineruns/chainloop-demo-run-cf65k |
+-----------------------------------------------------------+
+-----------------------------------------------------------------+
| Runner context                                                  |
+---------------------------+-------------------------------------+
| HOSTNAME                  | chainloop-demo-run-cf65k-attest-pod |
| TEKTON_TASKRUN_NAME       | chainloop-demo-run-cf65k-attest     |
| TEKTON_NAMESPACE          | demo                                |
| TEKTON_PIPELINE_NAME      | chainloop-attestation-demo          |
| TEKTON_PIPELINERUN_NAME   | chainloop-demo-run-cf65k            |
| TEKTON_PIPELINE_TASK_NAME | attest                              |
+---------------------------+-------------------------------------+

Pushing signed attestation:

--- Pushing Signed Attestation ---
INF push completed
+-----------------------------------------------------------+
| Digest                    | sha256:8be557a6ecba8f48045e934779f59b407f8570a5... |
| Runner Type               | TEKTON_PIPELINE                                     |
| Runner URL                | tekton://demo/pipelineruns/chainloop-demo-run-cf65k |
+-----------------------------------------------------------+

Verification results (9/9 pass):

PASS: Runner detected Tekton environment
PASS: Runner is TEKTON_PIPELINE, not GENERIC
PASS: HOSTNAME captured in runner output
PASS: Namespace captured in runner output
PASS: Tier 2 labels present AND runner read them via K8s API
PASS: RunURI uses tekton:// scheme
PASS: attestation-report result found in TaskRun status
PASS: PipelineRun completed successfully (Succeeded)
PASS: Environment is SelfHosted (kind cluster, no cloud provider detected)

RESULT: 9/9 checks passed

The runner auto-discovers all metadata from the K8s API pod labels and ServiceAccount namespace file, zero env var wiring needed in the Pipeline YAML.

Full asciinema recording of the E2E flow: https://asciinema.org/a/795546

waveywaves · 2026-03-05T11:08:06Z

Done, the commit is now squashed and signed off.

migmartri

Very nice! Thanks for posting the tests

once we merge it we'll update the docs, feel free to suggest any changes we should add in that section :)

Thanks!

https://docs.chainloop.dev/concepts/contracts#tekton_pipeline

waveywaves · 2026-03-05T12:11:30Z

Thanks @migmartri! Here are the suggested updates for the Tekton runner docs:

The TEKTON_PIPELINE runner now auto-discovers all metadata natively. The docs section should be updated to reflect:

Runner context variables (auto-captured):

Variable	Source	Required
`TEKTON_TASKRUN_NAME`	`tekton.dev/taskRun` pod label	Yes (falls back to hostname)
`TEKTON_NAMESPACE`	ServiceAccount namespace file	Yes
`TEKTON_TASK_NAME`	`tekton.dev/task` pod label	No (absent with inline taskSpec)
`TEKTON_PIPELINE_NAME`	`tekton.dev/pipeline` pod label	No (only in Pipeline TaskRuns)
`TEKTON_PIPELINERUN_NAME`	`tekton.dev/pipelineRun` pod label	No (only in Pipeline TaskRuns)
`TEKTON_PIPELINE_TASK_NAME`	`tekton.dev/pipelineTask` pod label	No (only in Pipeline TaskRuns)
`HOSTNAME`	Environment variable	No

Key points:

Zero env var wiring needed in Pipeline YAML — the runner discovers everything from K8s API pod labels and the ServiceAccount namespace file
RBAC: ServiceAccount needs get permission on pods in its namespace for Tier 2 label discovery (graceful degradation if missing)
RunURI format: tekton://<namespace>/pipelineruns/<name> (or Tekton Dashboard URL if TEKTON_DASHBOARD_URL env var is set)

The "work in progress" note can be removed — all runner context is now automatically gathered.

Add documentation for the Tekton Pipeline runner context variables that are auto-discovered natively from K8s API pod labels and ServiceAccount namespace file. Ref: chainloop-dev/chainloop#2767 Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

waveywaves · 2026-03-05T12:17:02Z

@migmartri Thanks! I noticed the docs repo (chainloop-dev/docs) is archived so I couldn't open a PR there. I've posted the suggested runner context variable table above — happy to open a docs PR wherever the docs live now if you point me to the right place.

we synced offline

migmartri · 2026-03-05T12:27:27Z

@migmartri Thanks! I noticed the docs repo (chainloop-dev/docs) is archived so I couldn't open a PR there. I've posted the suggested runner context variable table above — happy to open a docs PR wherever the docs live now if you point me to the right place.

Yeah it's private, I have a PR ready to be merged with the update

migmartri · 2026-03-05T12:28:26Z

one last bit, could you squash your commits and make sure they are signed please?

waveywaves · 2026-03-05T12:48:55Z

@migmartri CI is green now

migmartri · 2026-03-05T13:00:21Z

@migmartri CI is green now

I still see the commit signature issue

waveywaves · 2026-03-05T15:18:02Z

@javirln All feedback has been addressed — context refactored to function param, env var promotion with required/optional split, RBAC fallback added, and attestation example posted above. Could you re-review when you get a chance? CI is all green.

…discovery Add a new TektonPipeline runner that discovers Tekton metadata natively using a two-tier approach: - Tier 1: HOSTNAME env var and ServiceAccount namespace file (always available) - Tier 2: K8s API pod labels for rich tekton.dev/* metadata (best-effort) The runner promotes 7 env vars (2 required, 5 optional) following the Dagger runner pattern. TEKTON_TASK_NAME is optional since inline taskSpec pipelines lack the tekton.dev/task label. TEKTON_TASKRUN_NAME falls back to hostname derivation when K8s API labels are unavailable. context.Context is passed as a function parameter to discoverLabelsFromKubeAPI() rather than stored in the struct, following Go best practices. Includes comprehensive unit tests, e2e test binary with Environment validation, and tekton:// URI scheme for RunURI. Signed-off-by: Vibhav Bobade <vibhav.bobde@gmail.com> Co-Authored-By: Claude <noreply@anthropic.com>

waveywaves · 2026-03-05T15:25:13Z

@migmartri I did not sign correctly earlier looks like, it should be good now.

waveywaves · 2026-03-05T15:47:57Z

cc @migmartri CI is properly green now :D

waveywaves force-pushed the feat/tekton-runner-native-discovery branch 2 times, most recently from cbcf765 to 229b0c9 Compare February 22, 2026 02:00

cubic-dev-ai bot reviewed Feb 24, 2026

View reviewed changes

pkg/attestation/crafter/runners/tektonpipeline_test.go Show resolved Hide resolved

migmartri requested review from javirln, jiparis and matiasinsaurralde February 25, 2026 00:02

matiasinsaurralde reviewed Feb 25, 2026

View reviewed changes

pkg/attestation/crafter/runners/tektonpipeline.go Outdated Show resolved Hide resolved

javirln reviewed Feb 25, 2026

View reviewed changes

cubic-dev-ai bot reviewed Feb 27, 2026

View reviewed changes

pkg/attestation/crafter/runners/tektonpipeline.go Show resolved Hide resolved

test/e2e/tekton-runner/main.go Outdated Show resolved Hide resolved

pkg/attestation/crafter/runners/tektonpipeline.go Outdated Show resolved Hide resolved

javirln previously requested changes Mar 3, 2026

View reviewed changes

waveywaves force-pushed the feat/tekton-runner-native-discovery branch from 2c6dec3 to a2d6a8b Compare March 5, 2026 11:05

migmartri requested a review from javirln March 5, 2026 11:20

migmartri approved these changes Mar 5, 2026

View reviewed changes

waveywaves force-pushed the feat/tekton-runner-native-discovery branch from a2d6a8b to 5389af4 Compare March 5, 2026 11:34

waveywaves force-pushed the feat/tekton-runner-native-discovery branch from 5389af4 to 2f00e03 Compare March 5, 2026 15:21

Conversation

waveywaves commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Design decisions

Testing

Uh oh!

migmartri commented Feb 24, 2026

Uh oh!

cubic-dev-ai bot commented Feb 24, 2026

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

javirln commented Feb 25, 2026

Uh oh!

javirln left a comment

Choose a reason for hiding this comment

Uh oh!

javirln Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

waveywaves Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

migmartri commented Mar 2, 2026

Uh oh!

javirln left a comment

Choose a reason for hiding this comment

Uh oh!

javirln Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

waveywaves Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

javirln Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

waveywaves Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

waveywaves commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

migmartri left a comment

Choose a reason for hiding this comment

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

migmartri commented Mar 5, 2026

Uh oh!

migmartri commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

migmartri commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

waveywaves commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

waveywaves commented Feb 21, 2026 •

edited

Loading

waveywaves commented Mar 3, 2026 •

edited

Loading