feat: K8s-native CI/CD with Tekton Triggers

EventListener: catches Forgejo webhooks
TriggerTemplate: creates PipelineRun from git events
TriggerBinding: extracts git commit info
ServiceAccount: RBAC for trigger creation

Removes dependency on external CI (Gitea workflows)
Fully event-driven K8s-native architecture
Webhooks → EventListener → PipelineRun → deploy

k8s/tekton/eventlistener.yaml

@@ -0,0 +1,143 @@
+---
+# Tekton EventListener: Git webhook → PipelineRun
+# Listens on HTTP for Forgejo push events, triggers pipeline
+
+apiVersion: triggers.tekton.dev/v1beta1
+kind: EventListener
+metadata:
+  name: poimen-memory-listener
+  namespace: poimen
+spec:
+  serviceAccountName: tekton-triggers
+  triggers:
+  - name: on-push
+    interceptors:
+    - ref:
+        name: "github"
+      params:
+      - name: "secretRef"
+        value:
+          secretName: github-secret
+          secretKey: secretToken
+      - name: "eventTypes"
+        value:
+        - "push"
+    - name: "filter"
+      ref:
+        name: "cel"
+      params:
+      - name: "filter"
+        value: |
+          body.ref in ['refs/heads/main', 'refs/heads/feat/production-ingest-test-logging'] &&
+          (body.commits[0].modified.exists(x, x.startsWith('migrations/')) ||
+           body.commits[0].modified.exists(x, x.startsWith('crates/')) ||
+           body.commits[0].modified.exists(x, x.startsWith('k8s/tekton/')))
+    template:
+      ref: poimen-pipelinerun-template
+    bindings:
+    - ref: poimen-pipelinebinding
+
+---
+# TriggerTemplate: defines what PipelineRun to create
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerTemplate
+metadata:
+  name: poimen-pipelinerun-template
+  namespace: poimen
+spec:
+  params:
+  - name: gitrevision
+    description: git revision
+  - name: gitrepositoryurl
+    description: git repo URL
+  - name: gitrepositoryname
+    description: git repo name
+  resourcetemplates:
+  - apiVersion: tekton.dev/v1
+    kind: PipelineRun
+    metadata:
+      generateName: poimen-ci-
+      namespace: poimen
+    spec:
+      pipelineRef:
+        name: poimen-ci
+      params:
+      - name: image
+        value: "forgejo.riotpiao.com/riotpiao-poimen/poimen-memory:$(tt.params.gitrevision)"
+      - name: git-revision
+        value: "$(tt.params.gitrevision)"
+      - name: git-repo-url
+        value: "$(tt.params.gitrepositoryurl)"
+      workspaces:
+      - name: source
+        persistentVolumeClaim:
+          claimName: tekton-source-pvc
+      serviceAccountName: tekton-builder
+      timeout: 2h
+
+---
+# TriggerBinding: extracts fields from git webhook
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerBinding
+metadata:
+  name: poimen-pipelinebinding
+  namespace: poimen
+spec:
+  params:
+  - name: gitrevision
+    value: $(body.after)
+  - name: gitrepositoryurl
+    value: $(body.repository.clone_url)
+  - name: gitrepositoryname
+    value: $(body.repository.name)
+
+---
+# ServiceAccount for Tekton Triggers
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tekton-triggers
+  namespace: poimen
+
+---
+# Role for Tekton Triggers (create PipelineRuns)
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tekton-triggers-role
+  namespace: poimen
+rules:
+- apiGroups: ["tekton.dev"]
+  resources: ["pipelineruns"]
+  verbs: ["create", "get", "list", "watch"]
+- apiGroups: ["tekton.dev"]
+  resources: ["taskruns"]
+  verbs: ["create", "get", "list", "watch"]
+
+---
+# RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tekton-triggers-rolebinding
+  namespace: poimen
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: tekton-triggers-role
+subjects:
+- kind: ServiceAccount
+  name: tekton-triggers
+  namespace: poimen
+
+---
+# Secret for webhook token (base64 encoded)
+# kubectl create secret generic github-secret --from-literal=secretToken=your-webhook-secret -n poimen
+apiVersion: v1
+kind: Secret
+metadata:
+  name: github-secret
+  namespace: poimen
+type: Opaque
+stringData:
+  secretToken: "changeme-use-sops-encryption"