---
# PipelineRun: Agent Memory Feature Testing
# Tests role-to-prompt mapping with API Platform Engineer role requirements
# Runs migrations, integration tests, and validates all constraints

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: agent-memory-test-run
  namespace: poimen
  generateName: agent-memory-test-
spec:
  pipelineRef:
    name: poimen-ci
  
  params:
  - name: image
    value: "forgejo.riotpiao.com/riotpiao-poimen/poimen-memory:latest"
  - name: registry-user
    value: "riotpiao-poimen"
  - name: registry-token
    value: "${FORGEJO_REGISTRY_TOKEN}"  # Injected by ArgoCD/SOPS
  
  workspaces:
  - name: source
    emptyDir: {}  # Or use PVC for persistent builds
  
  serviceAccountName: tekton-builder
  
  timeouts:
    pipeline: "1h"
    tasks: "30m"

---
# ServiceAccount for Tekton Pipeline (builder with DB access)
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-builder
  namespace: poimen

---
# ClusterRoleBinding: Allow pipeline to query database via pod exec
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tekton-builder-db-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tekton-builder-db-access
subjects:
- kind: ServiceAccount
  name: tekton-builder
  namespace: poimen

---
# ClusterRole: Database access for migrations
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-builder-db-access
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["memory-db-app"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]