feat: Add PipelineRun support to BuildRun reconciler

This commit introduces PipelineRun support to the BuildRun
reconciler, enabling Shipwright to use Tekton PipelineRuns as an alternative
to TaskRuns for build execution.

Key changes:
- Add pipelinerun_runner.go with TektonPipelineRunWrapper implementation
  that wraps Tekton PipelineRuns and injects TaskRun specs into PipelineRun
  structures.
- Implement ImageBuildRunner and ImageBuildRunnerFactory interfaces for
  PipelineRun support.
- Add reconciliation logic for PipelineRun status updates, including
  condition handling and failure detection
- Add UpdateBuildRunUsingPipelineRunCondition function to update BuildRun
  status based on PipelineRun conditions (timeout, cancellation, success,
  failure)
- Refactor volume checking to use GetUnderlyingTaskRun() method for both
  TaskRun and PipelineRun executors, eliminating the need for separate
  volume checking methods
- Add RunnerFactories map to support configurable executor selection
  between TaskRun and PipelineRun implementations
- Update error handling in CreateImageBuildRunner
- Add UpdateImageBuildRunFromExecutor to handle updating Buildrun based on
  used executor (pipelinerun or taskrun)

The implementation maintains backward compatibility.

Signed-off-by: Hasan Awad <hasan.m.awad94@gmail.com>

Author: hasanawad94

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Login to container registry
         run: echo ${{ secrets.GITHUB_TOKEN }} | docker login -u ${{ github.repository_owner }} --password-stdin ghcr.io
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.24.x'
           cache: true
@@ -82,14 +82,14 @@ jobs:
             tekton: v0.65.7
           # newest supported Kubernetes and Tekton LTS that exists at the time of our planned next release
           - kubernetes: v1.33.1
-            tekton: v1.3.1 # RETAIN-COMMENT: TEKTON_NEWEST_LTS
+            tekton: v1.3.2 # RETAIN-COMMENT: TEKTON_NEWEST_LTS
       max-parallel: 4
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
         uses: actions/checkout@v5
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.24.x'
           cache: true
@@ -150,6 +150,9 @@ jobs:
           export IMAGE_PROCESSING_CONTAINER_IMAGE="$(KO_DOCKER_REPO=kind.local ko publish ./cmd/image-processing)"
 
           make test-integration
+      - name: Test-PipelineRun
+        run: |
+          BUILDRUN_EXECUTOR=PipelineRun ginkgo --focus-file="buildruns_to_pipelineruns_test.go" -v test/integration/...
 
   e2e:
     strategy:
@@ -161,14 +164,14 @@ jobs:
             tekton: v0.65.7
           # newest supported Kubernetes and Tekton LTS that exists at the time of our planned next release
           - kubernetes: v1.33.1
-            tekton: v1.3.1 # RETAIN-COMMENT: TEKTON_NEWEST_LTS
+            tekton: v1.3.2 # RETAIN-COMMENT: TEKTON_NEWEST_LTS
       max-parallel: 4
     runs-on: oracle-vm-16cpu-64gb-x86-64
     steps:
       - name: Check out code
         uses: actions/checkout@v5
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.24.x'
           cache: true
@@ -240,6 +243,33 @@ jobs:
           export TEST_E2E_FLAGS="-r --procs 8 --randomize-all --timeout=1h --trace --vv"
           export TEST_E2E_TIMEOUT_MULTIPLIER=2
           make test-e2e
+      - name: Test-PipelineRun
+        run: |
+          export TEST_NAMESPACE=shp-e2e
+          export TEST_IMAGE_REPO=registry.registry.svc.cluster.local:32222/shipwright-io/build-e2e
+          export TEST_IMAGE_REPO_INSECURE=true
+          export TEST_E2E_TIMEOUT_MULTIPLIER=1
+          kubectl patch deployment shipwright-build-controller -n shipwright-build --type='json' -p='[
+            {
+              "op": "add",
+              "path": "/spec/template/spec/containers/0/env/-",
+              "value": {
+                "name": "BUILDRUN_EXECUTOR",
+                "value": "PipelineRun"
+              }
+            }
+          ]'
+          # Wait for the rollout to complete
+          kubectl rollout restart deployment shipwright-build-controller -n shipwright-build
+          kubectl rollout status deployment shipwright-build-controller -n shipwright-build
+          
+          # Run PipelineRun tests
+          TEST_CONTROLLER_NAMESPACE=${TEST_NAMESPACE} \
+          TEST_WATCH_NAMESPACE=${TEST_NAMESPACE} \
+          TEST_E2E_SERVICEACCOUNT_NAME=pipeline \
+          TEST_E2E_TIMEOUT_MULTIPLIER=${TEST_E2E_TIMEOUT_MULTIPLIER} \
+          TEST_E2E_VERIFY_TEKTONOBJECTS=true \
+          ginkgo --focus="PipelineRun E2E Tests" --procs 8 --timeout=1h --vv test/e2e/v1beta1/
       - name: Build controller logs
         if: ${{ failure() }}
         run: |

.github/workflows/nightly.yaml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@v5
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
       with:
         go-version: '1.24.x'
         cache: true

.github/workflows/release.yaml

@@ -35,7 +35,7 @@ jobs:
       with:
         ref: ${{ inputs.git-ref }}
         fetch-depth: 0  # Fetch all history, needed for release note generation.
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
       with:
         go-version: '1.24.x'
         cache: true

.github/workflows/report-release-vulnerabilities.yaml

@@ -19,7 +19,7 @@ jobs:
         with:
           path: main
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.24.x'
           cache: true
@@ -58,7 +58,7 @@ jobs:
           path: release-branch
           ref: ${{ steps.download-latest-release.outputs.release-branch }}
       - name: Install Go version of latest release
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "${{ steps.download-latest-release.outputs.go-version }}.x"
           cache: true

.github/workflows/update-tekton-version.yaml

@@ -20,7 +20,7 @@ jobs:
         with:
           token: ${{ secrets.SHIPWRIGHT_BUILD_WRITE_WORKFLOWS }}
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.24.x'
           cache: true

.github/workflows/verify.yaml

@@ -25,7 +25,7 @@ jobs:
       with:
         path: go/src/github.com/shipwright-io/build
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: '1.24.x'
         cache: true

Makefile

@@ -36,7 +36,7 @@ ZAP_FLAGS ?= --zap-log-level=debug --zap-encoder=console
 TEST_NAMESPACE ?= default
 
 # CI: tekton pipelines controller version
-TEKTON_VERSION ?= v1.3.1
+TEKTON_VERSION ?= v1.3.2
 
 # E2E test flags
 TEST_E2E_FLAGS ?= -r -p --randomize-all --timeout=1h --trace --vv
@@ -213,6 +213,7 @@ test-integration: install-apis ginkgo
 		--randomize-all \
 		--randomize-suites \
 		--fail-on-pending \
+		--skip-file=buildruns_to_pipelineruns_test.go \
 		-trace \
 		test/integration/...
 
@@ -226,7 +227,7 @@ test-e2e-plain: ginkgo
 	TEST_E2E_SERVICEACCOUNT_NAME=${TEST_E2E_SERVICEACCOUNT_NAME} \
 	TEST_E2E_TIMEOUT_MULTIPLIER=${TEST_E2E_TIMEOUT_MULTIPLIER} \
 	TEST_E2E_VERIFY_TEKTONOBJECTS=${TEST_E2E_VERIFY_TEKTONOBJECTS} \
-	$(GINKGO) ${TEST_E2E_FLAGS} test/e2e/
+	$(GINKGO) --skip-file=e2e_pipelinerun_test.go ${TEST_E2E_FLAGS} test/e2e/
 
 .PHONY: test-e2e-kind-with-prereq-install
 test-e2e-kind-with-prereq-install: ginkgo install-controller-kind install-strategies test-e2e-plain

README.md

@@ -39,7 +39,7 @@ Shipwright supports any tool that can build container images in Kubernetes clust
 - We also require a Tekton installation (v0.59.+). To install the latest LTS release, run:
 
   ```bash
-  kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/previous/v1.3.1/release.yaml
+  kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/previous/v1.3.2/release.yaml
   ```
 
   If you are using OpenShift cluster refer [Running on OpenShift](#running-on-openshift) for some more configurations.

deploy/200-role.yaml

@@ -67,6 +67,10 @@ rules:
   # With the OwnerReferencesPermissionEnforcement admission controller enabled, controllers need the "delete" permission on objects that they set owner references on.
   verbs:     ['get', 'list', 'watch', 'create', 'delete', 'patch']
 
+- apiGroups: ['tekton.dev']
+  resources: ['pipelineruns']
+  verbs:     ['get', 'list', 'watch', 'create', 'delete', 'patch']
+
 - apiGroups: ['']
   resources: ['pods']
   verbs:     ['get', 'list', 'watch']

docs/buildstrategies.md

@@ -440,7 +440,7 @@ spec:
   steps:
     ...
     - name: build-and-push
-      image: moby/buildkit:v0.23.2-rootless
+      image: moby/buildkit:v0.24.0-rootless
       imagePullPolicy: Always
       workingDir: $(params.shp-source-root)
       ...
@@ -939,7 +939,7 @@ If we apply the following resources:
 
   ```yaml
     - name: buildah-bud
-      image: quay.io/containers/buildah:v1.40.1
+      image: quay.io/containers/buildah:v1.41.4
       workingDir: $(params.shp-source-root)
       securityContext:
         privileged: true
@@ -961,7 +961,7 @@ If we apply the following resources:
         - name: buildah-images
           mountPath: /var/lib/containers/storage
     - name: buildah-push
-      image: quay.io/containers/buildah:v1.40.1
+      image: quay.io/containers/buildah:v1.41.4
       securityContext:
         privileged: true
       command: