Chains support for CustomRuns #1210

Activity

1. vdemeester

   added

   area/roadmapIssues that are part of the project (or organization) roadmap (usually an epic)Issues that are part of the project (or organization) roadmap (usually an epic)

   on Jan 8, 2025
2. vdemeester

   added this to Tekton Community Roadmapon Jan 8, 2025
3. github-project-automation

   moved this to Todo in Tekton Community Roadmapon Jan 8, 2025
4. tekton-community-roadmap-sync

   added this to Tekton Community Roadmap v2on Feb 3, 2026
5. github-project-automation

   moved this to Todo in Tekton Community Roadmap v2on Feb 3, 2026
6. yuzichen12123 commented on Oct 8, 2026

   

   yuzichen12123

   on Oct 8, 2026

   More actions

   I reproduced this on v0.27.4 with both Tekton and OCI storage. The failure happens before payload generation or storage: FinalizeKind collects every PipelineRun.Status.ChildReferences name, then looks up each through the TaskRun lister. A Kind: CustomRun child returns NotFound, so the reconciler exits before calling the PipelineRun signer.

   Minimal shape of the completed run:

   status:
     conditions:
       - type: Succeeded
         status: "True"
     childReferences:
       - apiVersion: tekton.dev/v1
         kind: TaskRun
         name: example-build
         pipelineTaskName: build
       - apiVersion: tekton.dev/v1beta1
         kind: CustomRun
         name: example-approval
         pipelineTaskName: approval

   The ordinary TaskRun is complete and has already been reconciled by Chains. The CustomRun is also complete, but the controller logs:

   Unable to get reconciled status of taskrun example-approval within pipelinerun
   

   I am preparing a small PR that skips only explicit Kind == "CustomRun" references in the TaskRun reconciliation loop. This keeps the existing PipelineRun.IsDone() gate, ordinary TaskRun completion/reconciliation checks, and missing TaskRun behavior. It also preserves empty-Kind references used by existing tests/older status representations.

   This restores PipelineRun signing for mixed runs without adding CustomRun execution or approval details to the existing provenance format. Those details still need a separate provenance design; the fix does not claim that Chains signs or attests each CustomRun itself.

   The regression tests cover CustomRun-only and mixed runs, both child orders, pending/unreconciled/missing ordinary TaskRuns, empty and unknown Kind compatibility, terminal failures, and repeated reconciliation. For acceptance, I will verify actual attestations using a valid signing key rather than relying only on chains.tekton.dev/signed=true.