From 4fc0222b5c7a8f11dffc7a6588ecb7709128f587 Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Thu, 8 Oct 2026 16:37:57 +0530
Subject: [PATCH 1/2] test: validate ITS pipeline changes in pull requests

Run the ITS E2E suite for changes to the enterprise-contract pipeline or its CI trigger. Pin the runner and tests to the merged upstream E2E commit, and resolve the pipeline under test from the pull request source and revision.

Refs: EC-1943
---
 .tekton/cli-its-pull-request.yaml | 53 +++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 .tekton/cli-its-pull-request.yaml

diff --git a/.tekton/cli-its-pull-request.yaml b/.tekton/cli-its-pull-request.yaml
new file mode 100644
index 000000000..cd221c7d9
--- /dev/null
+++ b/.tekton/cli-its-pull-request.yaml
@@ -0,0 +1,53 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/conforma/cli?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      event == "pull_request" && target_branch == "main" &&
+      ("pipelines/enterprise-contract/**".pathChanged() ||
+       ".tekton/cli-its-pull-request.yaml".pathChanged())
+  labels:
+    appstudio.openshift.io/application: ec-main
+    appstudio.openshift.io/component: cli-main
+    pipelines.appstudio.openshift.io/type: test
+  name: cli-its-on-pull-request
+  namespace: rhtap-contract-tenant
+spec:
+  params:
+  - name: git-url
+    value: https://github.com/conforma/e2e-tests.git
+  - name: revision
+    value: eb59162d7c1d069a699f82a50e9f41db852c53d2
+  - name: oci-container-repo
+    value: quay.io/conforma/e2e-tests
+  - name: oci-container-repo-credentials-secret
+    value: konflux-test-infra
+  - name: aws-credentials-secret
+    value: mapt-kind-secret
+  - name: deprovision-aws-credentials-secret
+    value: mapt-kind-secret
+  - name: its-pipeline-repo-url
+    value: '{{source_url}}'
+  - name: its-pipeline-revision
+    value: '{{revision}}'
+  - name: its-pipeline-path
+    value: pipelines/enterprise-contract/0.1/enterprise-contract.yaml
+  - name: test-label-filter
+    value: its-pipeline
+  pipelineRef:
+    resolver: git
+    params:
+    - name: url
+      value: https://github.com/conforma/e2e-tests.git
+    - name: revision
+      value: eb59162d7c1d069a699f82a50e9f41db852c53d2
+    - name: pathInRepo
+      value: .tekton/pipelines/conforma-e2e/pipeline.yaml
+  taskRunTemplate:
+    serviceAccountName: konflux-integration-runner

From 0c072599a83ffef39221027291a0f75fb5a7f40b Mon Sep 17 00:00:00 2001
From: Dheeraj Singh Jodha <djodha@redhat.com>
Date: Mon, 12 Oct 2026 17:39:41 +0530
Subject: [PATCH 2/2] fix: pin ITS tests to compatible Kubernetes dependencies

---
 .tekton/cli-its-pull-request.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.tekton/cli-its-pull-request.yaml b/.tekton/cli-its-pull-request.yaml
index cd221c7d9..1b16cce68 100644
--- a/.tekton/cli-its-pull-request.yaml
+++ b/.tekton/cli-its-pull-request.yaml
@@ -23,7 +23,7 @@ spec:
   - name: git-url
     value: https://github.com/conforma/e2e-tests.git
   - name: revision
-    value: eb59162d7c1d069a699f82a50e9f41db852c53d2
+    value: 18ee6ce5970bca16167799bd5c93c25b579633d3
   - name: oci-container-repo
     value: quay.io/conforma/e2e-tests
   - name: oci-container-repo-credentials-secret
@@ -46,7 +46,7 @@ spec:
     - name: url
       value: https://github.com/conforma/e2e-tests.git
     - name: revision
-      value: eb59162d7c1d069a699f82a50e9f41db852c53d2
+      value: 18ee6ce5970bca16167799bd5c93c25b579633d3
     - name: pathInRepo
       value: .tekton/pipelines/conforma-e2e/pipeline.yaml
   taskRunTemplate: