From c018da3747fc52451e788aff3878cf7bc88aa37c Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Thu, 12 Feb 2026 12:50:59 +0100
Subject: [PATCH] chore: aligned pipelines, tasks & rbac

---
 pipelines/app-pipeline.yaml | 19 ++++++++++++-------
 rbac.yaml                   |  4 ++++
 tasks/build-node.yaml       | 22 ++++++++++++++++++++++
 tasks/git-clone.yaml        |  6 ++++--
 4 files changed, 42 insertions(+), 9 deletions(-)
 create mode 100644 tasks/build-node.yaml

diff --git a/pipelines/app-pipeline.yaml b/pipelines/app-pipeline.yaml
index a4fd3d2..57148af 100644
--- a/pipelines/app-pipeline.yaml
+++ b/pipelines/app-pipeline.yaml
@@ -9,7 +9,6 @@ spec:
     - name: git-url
     - name: git-revision
     - name: pr-number
-      default: ""
     - name: event-type
   workspaces:
     - name: shared-data
@@ -26,9 +25,16 @@ spec:
         - name: revision
           value: $(params.git-revision)
 
-    # 2. Build and Push Image (using standard Kaniko)
-    - name: build-and-push
+    - name: build-app
       runAfter: [fetch-repository]
+      taskRef:
+        name: build-node
+      workspaces:
+        - name: source
+          workspace: shared-data
+
+    - name: build-and-push-image
+      runAfter: [build-app]
       taskRef:
         name: kaniko
       workspaces:
@@ -38,13 +44,12 @@ spec:
         - name: IMAGE
           value: "ghcr.io/pingu-studio/$(params.app-name):$(params.git-revision)"
 
-    # 3. PREVIEW: Runs only on PR
     - name: deploy-preview
       when:
         - input: "$(params.event-type)"
           operator: in
           values: ["pull_request"]
-      runAfter: [build-and-push]
+      runAfter: [build-and-push-image]
       taskRef:
         name: manage-preview
       workspaces:
@@ -54,8 +59,8 @@ spec:
         - name: app-name
           value: $(params.app-name)
         - name: pr-number
-          value: "$(params.pr-number)"
+          value: $(params.pr-number)
         - name: image-tag
-          value: "$(params.git-revision)"
+          value: $(params.git-revision)
         - name: action
           value: "apply"
\ No newline at end of file
diff --git a/rbac.yaml b/rbac.yaml
index 30b8620..0861852 100644
--- a/rbac.yaml
+++ b/rbac.yaml
@@ -3,6 +3,10 @@ kind: ServiceAccount
 metadata:
   name: tekton-triggers-sa
   namespace: tekton-pipelines
+secrets:
+  - name: gh-auth-tekton-pipelines
+imagePullSecrets:
+  - name: ghcr-auth
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
diff --git a/tasks/build-node.yaml b/tasks/build-node.yaml
new file mode 100644
index 0000000..c60af4b
--- /dev/null
+++ b/tasks/build-node.yaml
@@ -0,0 +1,22 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: build-node
+  namespace: tekton-pipelines
+spec:
+  workspaces:
+    - name: source
+  steps:
+    - name: build
+      image: node:20-bookworm
+      workingDir: $(workspaces.source.path)
+      script: |
+        #!/bin/bash
+        if [ -f ".tekton/build.sh" ]; then
+          echo "Found custom build script. Executing..."
+          /bin/bash .tekton/build.sh
+        else
+          echo "No .tekton/build.sh found! Falling back to default build."
+          npm install
+          npm run build
+        fi
\ No newline at end of file
diff --git a/tasks/git-clone.yaml b/tasks/git-clone.yaml
index 4e2c5f6..c2cdd7a 100644
--- a/tasks/git-clone.yaml
+++ b/tasks/git-clone.yaml
@@ -11,11 +11,13 @@ spec:
       type: string
     - name: revision
       type: string
-      default: main
   steps:
     - name: clone
-      image: alpine/git
+      image: alpine/git:latest
       script: |
+        #!/bin/sh
+        # Tekton automatically mounts secrets with tekton.dev/git annotations 
+        # into a shared git credentials file.
         git clone $(params.url) $(workspaces.output.path)
         cd $(workspaces.output.path)
         git checkout $(params.revision)
\ No newline at end of file