fix: 使用 Tekton result 传递 AgentRun 构建产物

scripts/src/agentrun-manifests.ts

@@ -260,12 +260,11 @@ function agentRunBuildPublishTasks(spec: AgentRunLaneSpec): readonly Record<stri
     params,
     when: [{ input: spec.deployment.format, operator: "in", values: ["unidesk-yaml-only"] }],
   });
-  return [
-    task("plan-artifacts", [
+  const planTask = task("plan-artifacts", [
       { name: "source-checkout", image: "$(params.tools-image)", script: agentRunTektonSourceCheckoutScript() },
       { name: "probe-env-image", image: "$(params.tools-image)", script: agentRunTektonProbeImageScript() },
-    ]),
-    task("collect-artifacts", [{
+  ]);
+  const collectTask = task("collect-artifacts", [{
       name: "build-env-image",
       image: "$(params.buildkit-image)",
       env: [
@@ -281,14 +280,20 @@ function agentRunBuildPublishTasks(spec: AgentRunLaneSpec): readonly Record<stri
       ],
       securityContext: { privileged: true, runAsUser: 1000, runAsGroup: 1000 },
       script: agentRunTektonBuildImageScript(),
-    }], ["plan-artifacts"]),
-    task("gitops-promote", [{
+  }], ["plan-artifacts"]);
+  (collectTask.taskSpec as Record<string, unknown>).results = [{ name: "build-result" }];
+  const promoteTask = task("gitops-promote", [{
       name: "publish-gitops",
       image: "$(params.tools-image)",
-      env: [{ name: "GITEA_TOKEN", valueFrom: { secretKeyRef: { name: agentRunPacGiteaSecretName(spec), key: "token", optional: true } } }],
+      env: [
+        { name: "BUILD_RESULT_JSON", value: "$(params.build-result-json)" },
+        { name: "GITEA_TOKEN", valueFrom: { secretKeyRef: { name: agentRunPacGiteaSecretName(spec), key: "token", optional: true } } },
+      ],
       script: agentRunTektonGitopsPublishScript(spec),
-    }], ["collect-artifacts"]),
-  ];
+  }], ["collect-artifacts"]);
+  (promoteTask.taskSpec as Record<string, unknown>).params = [...taskParams, { name: "build-result-json" }];
+  promoteTask.params = [...params, { name: "build-result-json", value: "$(tasks.collect-artifacts.results.build-result)" }];
+  return [planTask, collectTask, promoteTask];
 }
 
 function agentRunTektonSourceCheckoutScript(): string {
@@ -379,7 +384,7 @@ function agentRunTektonBuildImageScript(): string {
     "#!/bin/sh",
     "set -eu",
     "root=\"$(workspaces.source.path)\"",
-    "if [ -f \"$root/skip-build\" ]; then cat \"$root/build-result.json\"; exit 0; fi",
+    "if [ -f \"$root/skip-build\" ]; then cp \"$root/build-result.json\" \"$(results.build-result.path)\"; cat \"$root/build-result.json\"; exit 0; fi",
     "env_identity=$(cat \"$root/env-identity\")",
     "image_repository='$(params.image-repository)'",
     "image=\"$image_repository:$env_identity\"",
@@ -398,6 +403,7 @@ function agentRunTektonBuildImageScript(): string {
     "digest=$(printf '%s' \"$metadata_compact\" | sed -n 's/.*\"containerimage.digest\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p' | head -n 1)",
     "test -n \"$digest\"",
     "printf '{\"ok\":true,\"status\":\"built\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"image\":\"%s\",\"digest\":\"%s\",\"repositoryDigest\":\"%s@%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" \"$image\" \"$digest\" \"$image_repository\" \"$digest\" > \"$root/build-result.json\"",
+    "cp \"$root/build-result.json\" \"$(results.build-result.path)\"",
     "cat \"$root/build-result.json\"",
   ].join("\n");
 }
@@ -428,6 +434,7 @@ function agentRunTektonGitopsPublishScript(spec: AgentRunLaneSpec): string {
     "set -eu",
     "root=\"$(workspaces.source.path)\"",
     "build_result=\"$root/build-result.json\"",
+    "printf '%s\\n' \"$BUILD_RESULT_JSON\" > \"$build_result\"",
     "test -s \"$build_result\"",
     `templates_b64=${JSON.stringify(templateB64)}`,
     "git_write_url='$(params.git-write-url)'",

scripts/src/platform-infra-pac-provenance.test.ts

@@ -284,9 +284,14 @@ test("AgentRun owning renderer emits ordered terminal roles over the shared work
   expect(tasks[0].taskSpec.steps.map((item: any) => item.name)).toEqual(["source-checkout", "probe-env-image"]);
   expect(tasks[1].taskSpec.steps.map((item: any) => item.name)).toEqual(["build-env-image"]);
   expect(tasks[2].taskSpec.steps.map((item: any) => item.name)).toEqual(["publish-gitops"]);
+  expect(tasks[1].taskSpec.results).toEqual([{ name: "build-result" }]);
+  expect(tasks[2].params).toContainEqual({ name: "build-result-json", value: "$(tasks.collect-artifacts.results.build-result)" });
+  expect(tasks[2].taskSpec.steps[0].env).toContainEqual({ name: "BUILD_RESULT_JSON", value: "$(params.build-result-json)" });
   expect(tasks[0].taskSpec.steps[1].script).toContain('"event":"pac-delivery-plan"');
   expect(tasks[1].taskSpec.steps[0].script).toContain("buildctl-daemonless.sh");
+  expect(tasks[1].taskSpec.steps[0].script).toContain("$(results.build-result.path)");
   expect(tasks[2].taskSpec.steps[0].script).toContain("gitops-publish");
+  expect(tasks[2].taskSpec.steps[0].script).toContain("$BUILD_RESULT_JSON");
 });
 
 test("AgentRun rendered delivery plan and real TaskRun terminals close the status evaluator gate", () => {