ROX-34386: Split main and release pipeline to remove image expire

.tekton/acs-mcp-server-pull-request.yaml

@@ -18,8 +18,8 @@ metadata:
           target_branch == "main" ||
           target_branch.startsWith("release-") ||
           (
-            has(body.pull_request) && 
-            has(body.pull_request.labels) && 
+            has(body.pull_request) &&
+            has(body.pull_request.labels) &&
             body.pull_request.labels.exists(l, l.name == "konflux-build")
           )
         )
@@ -39,7 +39,7 @@ spec:
   - name: output-image-repo
     value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
   - name: image-expires-after
-    value: 5d
+    value: "5d"
   - name: dockerfile
     value: konflux.Dockerfile
   - name: hermetic

.tekton/acs-mcp-server-push.yaml → .tekton/acs-mcp-server-push-main.yaml

@@ -9,30 +9,27 @@ metadata:
     pipelinesascode.tekton.dev/max-keep-runs: "10"
     pipelinesascode.tekton.dev/on-label: "[]"
     # For push trigger:
-    # - trigger on commit push on main or release branch.
-    # - trigger on tag pushes.
+    # - trigger on commit push on main.
     # For PR triggers:
     # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
-    # - trigger only for PRs on release branches.
-    # - support triggering by label: "konflux-build"
+    # - trigger only for PRs on main branch with label: "konflux-build"
     pipelinesascode.tekton.dev/on-cel-expression: |
       (
-        event == "push" && target_branch.matches("^(main|release-.*|refs/tags/.*)$")
+        event == "push" &&
+        target_branch.matches("^main$")
       ) || (
-        event == "pull_request" && body.action != "ready_for_review" && (
-          target_branch.startsWith("release-") ||
-          (
-            has(body.pull_request) && 
-            has(body.pull_request.labels) && 
-            body.pull_request.labels.exists(l, l.name == "konflux-build")
-          )
-        )
+        event == "pull_request" &&
+        target_branch.matches("^main$") &&
+        body.action != "ready_for_review" &&
+        has(body.pull_request) &&
+        has(body.pull_request.labels) &&
+        body.pull_request.labels.exists(l, l.name == "konflux-build")
       )
   labels:
     appstudio.openshift.io/application: agentic-cluster-security-suite-0-2
     appstudio.openshift.io/component: acs-mcp-server-0-2
     pipelines.appstudio.openshift.io/type: build
-  name: acs-mcp-server-on-push
+  name: acs-mcp-server-on-push-main
   namespace: agentic-cluster-security-suite-tenant
 spec:
   params:

.tekton/acs-mcp-server-push-release.yaml

@@ -0,0 +1,85 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox-mcp?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/max-keep-runs: "10"
+    pipelinesascode.tekton.dev/on-label: "[]"
+    # For push trigger:
+    # - trigger on commit push on release branches.
+    # - trigger on tag pushes.
+    # For PR triggers:
+    # - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
+    # - trigger only for PRs on release branches with label: "konflux-build"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        event == "push" && target_branch.matches("^(release-.*|refs/tags/.*)$")
+      ) || (
+        event == "pull_request" &&
+        target_branch.startsWith("release-") &&
+        body.action != "ready_for_review" &&
+        has(body.pull_request) &&
+        has(body.pull_request.labels) &&
+        body.pull_request.labels.exists(l, l.name == "konflux-build")
+      )
+  labels:
+    appstudio.openshift.io/application: agentic-cluster-security-suite-0-2
+    appstudio.openshift.io/component: acs-mcp-server-0-2
+    pipelines.appstudio.openshift.io/type: build
+  name: acs-mcp-server-on-push-release
+  namespace: agentic-cluster-security-suite-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: output-image-repo
+    value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
+  - name: dockerfile
+    value: konflux.Dockerfile
+  - name: hermetic
+    value: 'true'
+  - name: prefetch-input
+    value: |
+      [
+        { "type": "gomod", "path": "." },
+        { "type": "rpm", "path": "." }
+      ]
+  - name: build-source-image
+    value: 'true'
+  - name: build-image-index
+    value: 'true'
+  - name: clone-depth
+    value: '0'
+  - name: clone-fetch-tags
+    value: 'true'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: extra-labels
+    value:
+    # X.Y in the cpe label must be adjusted for every version stream.
+    - "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"
+
+  pipelineRef:
+    name: basic-component-pipeline
+
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-acs-mcp-server-0-2
+
+  timeouts:
+    tasks: 1h
+    finally: 10m
+    pipeline: 1h10m
+
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'