chore: aligned pipelines, tasks & rbac

pipelines/app-pipeline.yaml

@@ -9,7 +9,6 @@ spec:
     - name: git-url
     - name: git-revision
     - name: pr-number
-      default: ""
     - name: event-type
   workspaces:
     - name: shared-data
@@ -26,9 +25,16 @@ spec:
         - name: revision
           value: $(params.git-revision)
 
-    # 2. Build and Push Image (using standard Kaniko)
-    - name: build-and-push
+    - name: build-app
       runAfter: [fetch-repository]
+      taskRef:
+        name: build-node
+      workspaces:
+        - name: source
+          workspace: shared-data
+
+    - name: build-and-push-image
+      runAfter: [build-app]
       taskRef:
         name: kaniko
       workspaces:
@@ -38,13 +44,12 @@ spec:
         - name: IMAGE
           value: "ghcr.io/pingu-studio/$(params.app-name):$(params.git-revision)"
 
-    # 3. PREVIEW: Runs only on PR
     - name: deploy-preview
       when:
         - input: "$(params.event-type)"
           operator: in
           values: ["pull_request"]
-      runAfter: [build-and-push]
+      runAfter: [build-and-push-image]
       taskRef:
         name: manage-preview
       workspaces:
@@ -54,8 +59,8 @@ spec:
         - name: app-name
           value: $(params.app-name)
         - name: pr-number
-          value: "$(params.pr-number)"
+          value: $(params.pr-number)
         - name: image-tag
-          value: "$(params.git-revision)"
+          value: $(params.git-revision)
         - name: action
           value: "apply"

rbac.yaml

@@ -3,6 +3,10 @@ kind: ServiceAccount
 metadata:
   name: tekton-triggers-sa
   namespace: tekton-pipelines
+secrets:
+  - name: gh-auth-tekton-pipelines
+imagePullSecrets:
+  - name: ghcr-auth
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole

tasks/build-node.yaml

@@ -0,0 +1,22 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: build-node
+  namespace: tekton-pipelines
+spec:
+  workspaces:
+    - name: source
+  steps:
+    - name: build
+      image: node:20-bookworm
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/bash
+        if [ -f ".tekton/build.sh" ]; then
+          echo "Found custom build script. Executing..."
+          /bin/bash .tekton/build.sh
+        else
+          echo "No .tekton/build.sh found! Falling back to default build."
+          npm install
+          npm run build
+        fi

tasks/git-clone.yaml

@@ -11,11 +11,13 @@ spec:
       type: string
     - name: revision
       type: string
-      default: main
   steps:
     - name: clone
-      image: alpine/git
+      image: alpine/git:latest
       script: |
+        #!/bin/sh
+        # Tekton automatically mounts secrets with tekton.dev/git annotations 
+        # into a shared git credentials file.
         git clone $(params.url) $(workspaces.output.path)
         cd $(workspaces.output.path)
         git checkout $(params.revision)