Pipelines as Code Red Hat OpenShift Pipelines 1.18 Configuring and using Pipelines as Code Red Hat OpenShift Documentation Team

Commands:
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: enable: false settings: application-name: Pipelines as Code CI auto-configure-new-github-repo: "false" bitbucket-cloud-check-source-ip: "true" hub-catalog-name: tekton hub-url: https://api.hub.tekton.dev/v1 remote-tasks: "true" secret-auto-create: "true"
oc patch tektonconfig config --type="merge" -p '{"spec": {"platforms": {"openshift":{"pipelinesAsCode": {"enable": false}}}}}'
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: enable: true settings: application-name: Pipelines as Code CI auto-configure-new-github-repo: "false" bitbucket-cloud-check-source-ip: "true" hub-catalog-name: tekton hub-url: https://api.hub.tekton.dev/v1 remote-tasks: "true" secret-auto-create: "true"
oc patch tektonconfig config --type="merge" -p '{"spec": {"platforms": {"openshift":{"pipelinesAsCode": {"enable": true}}}}}'
apiVersion: operator.tekton.dev/v1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: additionalPACControllers: pac_controller_2: 1 enable: true 2 secretName: pac_secret_2 3 settings: # 4
tkn pac bootstrap github-app
tkn pac bootstrap github-app --github-api-url https://github.com/enterprises/example-enterprise
echo https://USD(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')
echo https://USD(oc get route -n openshift-pipelines pac_controller_2 -o jsonpath='{.spec.host}')
openssl rand -hex 20
oc -n openshift-pipelines create secret generic pipelines-as-code-secret \ 1 --from-literal github-private-key="USD(cat <PATH_PRIVATE_KEY>)" \ 2 --from-literal github-application-id="<APP_ID>" \ 3 --from-literal webhook.secret="<WEBHOOK_SECRET>" 4
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: enable: true settings: secret-github-app-token-scoped: false secret-github-app-scope-extra-repos: "owner2/project2, owner3/project3"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: test namespace: test-repo spec: url: "https://github.com/linda/project" settings: github_app_token_scope_repos: - "owner/project" - "owner1/project1"
failed to scope GitHub token as repo owner1/project1 does not exist in namespace test-repo
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: enable: true settings: secret-github-app-token-scoped: false secret-github-app-scope-extra-repos: "owner2/project2, owner3/project3"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: test namespace: test-repo spec: url: "https://github.com/linda/project" settings: github_app_token_scope_repos: - "owner/project" - "owner1/project1"
git --amend -a --no-edit && git push --force-with-lease <origin> <branchname>
tkn pac create repo
? Enter the Git repository url (default: https://github.com/owner/repo): ? Please enter the namespace where the pipeline should run (default: repo-pipelines): ! Namespace repo-pipelines is not found ? Would you like me to create the namespace repo-pipelines? Yes [✓] Repository owner-repo has been created in repo-pipelines namespace [✓] Setting up GitHub Webhook for Repository https://github.com/owner/repo 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes ? Please enter the secret to configure the webhook for payload validation (default: sJNwdmTifHTs): sJNwdmTifHTs i \ufe0fYou now need to create a GitHub personal access token, please checkout the docs at https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token for the required scopes ? Please enter the GitHub access token: **************************************** [✓] Webhook has been created on repository owner/repo 🔑 Webhook Secret owner-repo has been created in the repo-pipelines namespace. 🔑 Repository CR owner-repo has been updated with webhook secret in the repo-pipelines namespace i Directory .tekton has been created. [✓] We have detected your repository using the programming language Go. [✓] A basic template has been created in /home/Go/src/github.com/owner/repo/.tekton/pipelinerun.yaml, feel free to customize it.
echo https://USD(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')
openssl rand -hex 20
oc -n target-namespace create secret generic github-webhook-config --from-literal provider.token="<GITHUB_PERSONAL_ACCESS_TOKEN>" --from-literal webhook.secret="<WEBHOOK_SECRET>"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: url: "https://github.com/owner/repo" git_provider: secret: name: "github-webhook-config" key: "provider.token" # Set this if you have a different key in your secret webhook_secret: name: "github-webhook-config" key: "webhook.secret" # Set this if you have a different key for your secret
tkn pac webhook add -n repo-pipelines
[✓] Setting up GitHub Webhook for Repository https://github.com/owner/repo 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes ? Please enter the secret to configure the webhook for payload validation (default: AeHdHTJVfAeH): AeHdHTJVfAeH [✓] Webhook has been created on repository owner/repo 🔑 Secret owner-repo has been updated with webhook secert in the repo-pipelines namespace.
tkn pac webhook update-token -n repo-pipelines
? Please enter your personal access token: **************************************** 🔑 Secret owner-repo has been updated with new personal access token in the repo-pipelines namespace.
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: git_provider: secret: name: "github-webhook-config"
oc -n USDtarget_namespace patch secret github-webhook-config -p "{\"data\": {\"provider.token\": \"USD(echo -n USDNEW_TOKEN|base64 -w0)\"}}"
tkn pac create repo
? Enter the Git repository url (default: https://gitlab.com/owner/repo): ? Please enter the namespace where the pipeline should run (default: repo-pipelines): ! Namespace repo-pipelines is not found ? Would you like me to create the namespace repo-pipelines? Yes [✓] Repository repositories-project has been created in repo-pipelines namespace [✓] Setting up GitLab Webhook for Repository https://gitlab.com/owner/repo ? Please enter the project ID for the repository you want to be configured, project ID refers to an unique ID (e.g. 34405323) shown at the top of your GitLab project : 17103 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes ? Please enter the secret to configure the webhook for payload validation (default: lFjHIEcaGFlF): lFjHIEcaGFlF i \ufe0fYou now need to create a GitLab personal access token with `api` scope i \ufe0fGo to this URL to generate one https://gitlab.com/-/profile/personal_access_tokens, see https://is.gd/rOEo9B for documentation ? Please enter the GitLab access token: ************************** ? Please enter your GitLab API URL:: https://gitlab.com [✓] Webhook has been created on your repository 🔑 Webhook Secret repositories-project has been created in the repo-pipelines namespace. 🔑 Repository CR repositories-project has been updated with webhook secret in the repo-pipelines namespace i Directory .tekton has been created. [✓] A basic template has been created in /home/Go/src/gitlab.com/repositories/project/.tekton/pipelinerun.yaml, feel free to customize it.
echo https://USD(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')
openssl rand -hex 20
oc -n target-namespace create secret generic gitlab-webhook-config --from-literal provider.token="<GITLAB_PERSONAL_ACCESS_TOKEN>" --from-literal webhook.secret="<WEBHOOK_SECRET>"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: url: "https://gitlab.com/owner/repo" # The repository URL git_provider: #url: "https://gitlab.example.com/" 1 secret: name: "gitlab-webhook-config" key: "provider.token" # Set this if you have a different key in your secret webhook_secret: name: "gitlab-webhook-config" key: "webhook.secret" # Set this if you have a different key for your secret
tkn pac webhook add -n repo-pipelines
[✓] Setting up GitLab Webhook for Repository https://gitlab.com/owner/repo 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes ? Please enter the secret to configure the webhook for payload validation (default: AeHdHTJVfAeH): AeHdHTJVfAeH [✓] Webhook has been created on repository owner/repo 🔑 Secret owner-repo has been updated with webhook secert in the repo-pipelines namespace.
tkn pac webhook update-token -n repo-pipelines
? Please enter your personal access token: **************************************** 🔑 Secret owner-repo has been updated with new personal access token in the repo-pipelines namespace.
spec: git_provider: secret: name: "gitlab-webhook-config"
oc -n USDtarget_namespace patch secret gitlab-webhook-config -p "{\"data\": {\"provider.token\": \"USD(echo -n USDNEW_TOKEN|base64 -w0)\"}}"
tkn pac create repo
? Enter the Git repository url (default: https://bitbucket.org/workspace/repo): ? Please enter the namespace where the pipeline should run (default: repo-pipelines): ! Namespace repo-pipelines is not found ? Would you like me to create the namespace repo-pipelines? Yes [✓] Repository workspace-repo has been created in repo-pipelines namespace [✓] Setting up Bitbucket Webhook for Repository https://bitbucket.org/workspace/repo ? Please enter your bitbucket cloud username: <username> i \ufe0fYou now need to create a Bitbucket Cloud app password, please checkout the docs at https://is.gd/fqMHiJ for the required permissions ? Please enter the Bitbucket Cloud app password: ************************************ 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes [✓] Webhook has been created on repository workspace/repo 🔑 Webhook Secret workspace-repo has been created in the repo-pipelines namespace. 🔑 Repository CR workspace-repo has been updated with webhook secret in the repo-pipelines namespace i Directory .tekton has been created. [✓] A basic template has been created in /home/Go/src/bitbucket/repo/.tekton/pipelinerun.yaml, feel free to customize it.
echo https://USD(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')
oc -n target-namespace create secret generic bitbucket-cloud-token --from-literal provider.token="<BITBUCKET_APP_PASSWORD>"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: url: "https://bitbucket.com/workspace/repo" branch: "main" git_provider: user: "<BITBUCKET_USERNAME>" 1 secret: name: "bitbucket-cloud-token" 2 key: "provider.token" # Set this if you have a different key in your secret
tkn pac webhook add -n repo-pipelines
[✓] Setting up Bitbucket Webhook for Repository https://bitbucket.org/workspace/repo ? Please enter your bitbucket cloud username: <username> 👀 I have detected a controller url: https://pipelines-as-code-controller-openshift-pipelines.apps.example.com ? Do you want me to use it? Yes [✓] Webhook has been created on repository workspace/repo 🔑 Secret workspace-repo has been updated with webhook secret in the repo-pipelines namespace.
tkn pac webhook update-token -n repo-pipelines
? Please enter your personal access token: **************************************** 🔑 Secret owner-repo has been updated with new personal access token in the repo-pipelines namespace.
spec: git_provider: user: "<BITBUCKET_USERNAME>" secret: name: "bitbucket-cloud-token" key: "provider.token"
oc -n USDtarget_namespace patch secret bitbucket-cloud-token -p "{\"data\": {\"provider.token\": \"USD(echo -n USDNEW_TOKEN|base64 -w0)\"}}"
echo https://USD(oc get route -n openshift-pipelines pipelines-as-code-controller -o jsonpath='{.spec.host}')
openssl rand -hex 20
oc -n target-namespace create secret generic bitbucket-datacenter-webhook-config --from-literal provider.token="<PERSONAL_TOKEN>" --from-literal webhook.secret="<WEBHOOK_SECRET>"
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: url: "https://bitbucket.com/workspace/repo" git_provider: url: "https://bitbucket.datacenter.api.url/rest" 1 user: "<BITBUCKET_USERNAME>" 2 secret: 3 name: "bitbucket-datacenter-webhook-config" key: "provider.token" # Set this if you have a different key in your secret webhook_secret: name: "bitbucket-datacenter-webhook-config" key: "webhook.secret" # Set this if you have a different key for your secret
workspace: - name: basic-auth secret: secretName: "{{ git_auth_secret }}"
workspaces: - name basic-auth params: - name: repo_url - name: revision tasks: workspaces: - name: basic-auth workspace: basic-auth tasks: - name: git-clone-from-catalog taskRef: name: git-clone 1 params: - name: url value: USD(params.repo_url) - name: revision value: USD(params.revision)
cat <<EOF|kubectl create -n my-pipeline-ci -f- 1 apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: project-repository spec: url: "https://github.com/<repository>/<project>" EOF
cat <<EOF|oc create -n openshift-pipelines -f - apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: pipelines-as-code spec: git_provider: secret: name: "gitlab-webhook-config" key: "provider.token" webhook_secret: name: "gitlab-webhook-config" key: "webhook.secret" EOF
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: concurrency_limit: <number>
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: my-repo namespace: target-namespace spec: settings: pipelinerun_provenance: "default_branch"
spec: params: - name: company value: "ABC Company"
spec: params: - name: company secretRef: name: my-secret key: companyname
spec: params: - name: company value: "ABC Company" filter: - name: event value: | pac.event_type == "pull_request"
pipelinesascode.tekton.dev/task: "git-clone" 1
pipelinesascode.tekton.dev/task: "[git-clone, golang-test, tkn]"
pipelinesascode.tekton.dev/task: "git-clone" pipelinesascode.tekton.dev/task-1: "golang-test" pipelinesascode.tekton.dev/task-2: "tkn" 1
pipelinesascode.tekton.dev/task: "[git-clone:0.1]" 1
pipelinesascode.tekton.dev/task: "<https://remote.url/task.yaml>" 1
pipelinesascode.tekton.dev/task: "<share/tasks/git-clone.yaml>" 1
pipelinesascode.tekton.dev/pipeline: "<https://git.provider/raw/pipeline.yaml>" 1
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: annotations: pipelinesascode.tekton.dev/pipeline: "https://git.provider/raw/pipeline.yaml" pipelinesascode.tekton.dev/task: "./my-git-clone-task.yaml"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-with-comment annotations: pipelinesascode.tekton.dev/task: "github-add-comment" spec: pipelineSpec: tasks: - name: add-sample-comment taskRef: name: github-add-comment params: - name: REQUEST_URL value: "{{ repo_url }}/pull/{{ pull_request_number }}" 1 - name: COMMENT_OR_FILE value: "Pipelines as Code IS GREAT!" - name: GITHUB_TOKEN_SECRET_NAME value: "{{ git_auth_secret }}" - name: GITHUB_TOKEN_SECRET_KEY value: "git-provider-token"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-pr-main annotations: pipelinesascode.tekton.dev/on-target-branch: "[main]" 1 pipelinesascode.tekton.dev/on-event: "[pull_request]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-push-on-main annotations: pipelinesascode.tekton.dev/on-target-branch: "[refs/heads/main]" 1 pipelinesascode.tekton.dev/on-event: "[push]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-pkg-or-cli annotations: pipelinesascode.tekton.dev/on-path-changed: "["pkg/*", "cli/**"]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-docs-not-generated annotations: pipelinesascode.tekton.dev/on-path-changed: "["docs/**"]" pipelinesascode.tekton.dev/on-path-changed-ignore: "["docs/generated/**"]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-main-not-docs annotations: pipelinesascode.tekton.dev/on-target-branch: "[main]" pipelinesascode.tekton.dev/on-event: "[pull_request]" pipelinesascode.tekton.dev/on-path-changed-ignore: "["docs/**"]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-bug-or-defect annotations: pipelinesascode.tekton.dev/on-label: "[bug, defect]"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-comment annotations: pipelinesascode.tekton.dev/on-comment: "^/merge-pr"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-advanced-pr annotations: pipelinesascode.tekton.dev/on-cel-expression: | event == "pull_request" && target_branch == "main" && source_branch == "wip"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-advanced-pr-pathchanged annotations: pipelinesascode.tekton.dev/on-cel-expression: | event == "pull_request" && "docs/\*.md".pathChanged() 1
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-advanced-pr-downstream annotations: pipelinesascode.tekton.dev/on-cel-expression: | event == "pull_request && event_title.startsWith("[DOWNSTREAM]")
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipeline-advanced-pr-not-experimental annotations: pipelinesascode.tekton.dev/on-cel-expression: | event == "pull_request" && target_branch != experimental"
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: annotations: pipelinesascode.tekton.dev/on-cel-expression: | body.pull_request.base.ref == "main" && body.pull_request.user.login == "superuser" && body.action == "synchronize"
git commit --amend --no-edit && git push --force-with-lease
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: sample-pipeline annotations: pipelinesascode.tekton.dev/cancel-in-progress: "true"
tkn pac logs -n <my-pipeline-ci> -L 1
tkn pac logs -n <my-pipeline-ci> 1
This is a comment inside a pull request. /cancel
This is a comment inside a commit. /retest example_pipeline_run
<filename>:<line>:<column>: <error message>
oc get repo -n <pipelines-as-code-ci>
NAME URL NAMESPACE SUCCEEDED REASON STARTTIME COMPLETIONTIME pipelines-as-code-ci https://github.com/openshift-pipelines/pipelines-as-code pipelines-as-code-ci True Succeeded 59m 56m
pipelinesascode.tekton.dev/max-keep-runs: "<max_number>" 1
apiVersion: "pipelinesascode.tekton.dev/v1alpha1" kind: Repository metadata: name: repo namespace: ns spec: url: "https://github.com/owner/repo" git_provider: type: github secret: name: "owner-token" incoming: - targets: - main secret: name: repo-incoming-secret type: webhook-url
apiVersion: v1 kind: Secret metadata: name: repo-incoming-secret namespace: ns type: Opaque stringData: secret: <very-secure-shared-secret>
curl -X POST 'https://control.pac.url/incoming?secret=very-secure-shared-secret&repository=repo&branch=main&pipelinerun=target_pipelinerun'
tkn pac [command or options] [arguments]
tkn pac --help
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: options: configMaps: pac-config-logging: data: loglevel.pac-watcher: warn 1 loglevel.pipelines-as-code-webhook: warn 2 loglevel.pipelinesascode: warn 3 zap-logger-config: | { "level": "info", "development": false, "sampling": { "initial": 100, "thereafter": 100 }, "outputPaths": ["stdout"], "errorOutputPaths": ["stderr"], "encoding": "json", "encoderConfig": { "timeKey": "ts", "levelKey": "level", "nameKey": "logger", "callerKey": "caller", "messageKey": "msg", "stacktraceKey": "stacktrace", "lineEnding": "", "levelEncoder": "", "timeEncoder": "iso8601", "durationEncoder": "", "callerEncoder": "" } }
apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: pipelinesAsCode: enable: true options: configMaps: custom-pac-config-logging: data: loglevel.pac-watcher: warn loglevel.pipelines-as-code-webhook: warn loglevel.pipelinesascode: warn zap-logger-config: | { "level": "info", "development": false, "sampling": { "initial": 100, "thereafter": 100 }, "outputPaths": ["stdout"], "errorOutputPaths": ["stderr"], "encoding": "json", "encoderConfig": { "timeKey": "ts", "levelKey": "level", "nameKey": "logger", "callerKey": "caller", "messageKey": "msg", "stacktraceKey": "stacktrace", "lineEnding": "", "levelEncoder": "", "timeEncoder": "iso8601", "durationEncoder": "", "callerEncoder": "" } } deployments: pipelines-as-code-controller: spec: template: spec: containers: - name: pac-controller env: - name: CONFIG_LOGGING_NAME value: custom-pac-config-logging pipelines-as-code-watcher: spec: template: spec: containers: - name: pac-watcher env: - name: CONFIG_LOGGING_NAME value: custom-pac-config-logging pipelines-as-code-webhook: spec: template: spec: containers: - name: pac-webhook env: - name: CONFIG_LOGGING_NAME value: custom-pac-config-logging
oc logs pipelines-as-code-controller-<unique-id> -n openshift-pipelines | grep mynamespace 1