// Use before pushing a PR for review, when CI checks fail, or when reviewing someone else's PR. Pre-push checklist covering all CI requirements, commit conventions, and documentation for task catalog PRs.
Use when CI behaves unexpectedly, when you need to understand how Tekton bundles are built, or when understanding non-obvious behavior with templated workflows, Checkton, migration validation, kustomize checks, or trusted artifacts generation.
Use when a scan task fails in a pipeline, when task results have unexpected values, when understanding scan output formats, or when debugging bundle build failures.
Use when creating task variants (remote, trusted-artifacts), working with recipe.yaml files, or when the check-ta CI workflow fails. Covers both Go generators, the recipe format, and the generation pipeline.
Use when creating a new task version, bumping version labels, writing migration scripts, or when versioning/migration CI checks fail. Covers version labels, CHANGELOG.md, migration scripts with pmt modify, and kustomized variant updates.
Use when writing tests for a Tekton task, running tests locally, debugging test failures in CI, or understanding the three testing layers (Kind cluster, Tekton integration, ShellSpec).
| name | pr-definition-of-done |
| description | Use before pushing a PR for review, when CI checks fail, or when reviewing someone else's PR. Pre-push checklist covering all CI requirements, commit conventions, and documentation for task catalog PRs. |
14+ GitHub Actions workflows run on every PR. This checklist ensures you pass all CI checks before pushing, reducing round-trip time and review cycles. Each section maps to a CI workflow.
type(STONEINTG-XXXX): descriptionfeat, fix, chore, refactor, test, docsgit commit -s (DCO signature)Assisted-by: <tool-name> if usedapp.kubernetes.io/version: "x.y[.z]"$(params.*) directly in scripts — use env variables instead#!/usr/bin/env bash and set -euo pipefailhack/build-manifests.sh (for -min variants)hack/generate-readme.sh (if task interface changed)hack/generate-everything.shtask/<name>/migrations/<version>.shpmt modify, NOT yq -ishellcheck task/<name>/migrations/<version>.sh-oci-ta variant, create migration there too| Workflow | Triggered By | What Fails It | Repo File |
|---|---|---|---|
| YAML Lint | Any .yaml, .yml file change | YAML syntax errors, indentation | .github/workflows/yaml-lint.yaml |
| Checkton | Task YAML changes | ShellCheck violations in embedded scripts | .github/workflows/checkton.yaml |
| Task Lint | Task YAML changes | $(params.*) used directly in script blocks | .github/workflows/task-lint.yaml |
| Versioning | Task YAML changes | Missing app.kubernetes.io/version label, missing CHANGELOG.md | .github/workflows/versioning.yaml |
| Kustomize Build | kustomization.yaml, patch.yaml changes | Regenerated manifest files stale | .github/workflows/check-kustomize-build.yaml |
| Task Migrations | Migration files added/modified | Invalid migration script, failed pmt modify | .github/workflows/check-task-migration.yaml |
| Check READMEs | README files, task structure changes | README out of date or missing | .github/workflows/check-readmes.yaml |
| Check Task YAMLs | Task YAML changes | Invalid Tekton task definition (kubectl dry-run) | .github/workflows/check-task-yamls.yaml |
| Check TA Variants | Task changes | Missing or stale trusted-artifacts variants | .github/workflows/check-ta.yaml |
| Check Task Owners | CODEOWNERS changes | Mismatch between CODEOWNERS and renovate.json | .github/workflows/check-task-owners.yaml |
| Go CI | task-generator/*/ changes | golangci-lint, go test, go mod tidy failures | .github/workflows/go-ci.yaml |
| Run Task Tests | Task tests/ directory changes | Kind cluster test pipeline failures | .github/workflows/run-task-tests.yaml |
| AgentReady | Any file change | Code quality and AI-readiness assessment | .github/workflows/agentready.yaml |
Files marked with <TEMPLATED FILE!> comment come from task-repo-shared-ci.
Do NOT edit these files directly. Instead, send PR upstream to the template repo or use:
cruft update --skip-apply-ask --allow-untracked-files
Check for <TEMPLATED FILE!> in:
hack/.github/workflows/.github/scripts/| Mistake | Fix |
|---|---|
| Edited a TEMPLATED FILE | Send PR to task-repo-shared-ci instead; or run cruft update |
| Kustomize manifests stale | hack/build-manifests.sh after changing kustomization.yaml or patch.yaml |
| TA variant out of date | hack/generate-ta-tasks.sh |
$(params.*) in script | Create env var in task spec: env: - name: MY_VAR value: "$(params.my-param)" then use $MY_VAR |
| Missing CODEOWNERS entry | Add task to CODEOWNERS; run hack/check-task-owners.sh -f |
| Checkton fails locally but not in CI | CI uses full git diff history. Run locally: hack/checkton-local.sh |
| Versioning warning treated as error | Versioning warnings don't block merge. But best practice: always update version + CHANGELOG together. |