ci: bootstrap GitHub workflows and dependabot

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+<!-- Thank you for the PR! -->
+
+# Changes
+
+<!-- Describe your changes here — ideally from your descriptive commit message(s). -->
+
+# Submitter Checklist
+
+- [ ] Includes [tests](https://github.com/tektoncd/community/blob/main/standards.md#tests) for new or changed functionality
+- [ ] Includes [docs](https://github.com/tektoncd/community/blob/main/standards.md#docs) for user-facing changes
+- [ ] Commit messages follow [best practices](https://github.com/tektoncd/community/blob/main/standards.md#commits)
+- [ ] Meets the [Tekton contributor standards](https://github.com/tektoncd/community/blob/main/standards.md)
+
+# Release Notes
+
+```release-note
+NONE
+```

.github/workflows/build.yaml

@@ -0,0 +1,132 @@
+name: Build
+
+on:
+  pull_request:
+    branches: ['main']
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * *'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Verify StepAction is in sync
+        run: |
+          ./hack/generate-stepaction.sh
+          if ! git diff --exit-code stepaction/; then
+            echo "StepAction is out of sync with Task. Run: ./hack/generate-stepaction.sh"
+            exit 1
+          fi
+
+      - name: Validate YAML structure
+        run: |
+          validate() {
+            local f="$1" want_kind="$2" want_api="$3"
+            echo -n "--- Validating ${f} ... "
+            apiVersion=$(yq '.apiVersion' "${f}")
+            kind=$(yq '.kind' "${f}")
+            name=$(yq '.metadata.name' "${f}")
+            if [[ "${apiVersion}" != "${want_api}" ]]; then
+              echo "FAIL: expected apiVersion ${want_api}, got ${apiVersion}"; exit 1
+            fi
+            if [[ "${kind}" != "${want_kind}" ]]; then
+              echo "FAIL: expected kind ${want_kind}, got ${kind}"; exit 1
+            fi
+            if [[ -z "${name}" || "${name}" == "null" ]]; then
+              echo "FAIL: metadata.name is missing"; exit 1
+            fi
+            echo "OK (${kind}/${name})"
+          }
+          validate "task/kaniko/kaniko.yaml" Task tekton.dev/v1
+          validate "stepaction/kaniko/kaniko.yaml" StepAction tekton.dev/v1beta1
+
+  e2e:
+    name: E2E (${{ matrix.pipeline-version }})
+    needs: [lint]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        pipeline-version:
+          - v1.12.0  # LTS, EOL 2027-05-04
+          - v1.9.3   # LTS, EOL 2027-01-30
+          - v1.6.2   # LTS, EOL 2026-10-31
+          - v1.3.4   # LTS, EOL 2026-08-04
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Create Kind cluster
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+        with:
+          cluster_name: kind
+          wait: 120s
+
+      - name: Run e2e tests
+        env:
+          PIPELINE_VERSION: ${{ matrix.pipeline-version }}
+          TIMEOUT: 180s
+        run: ./test/e2e-tests.sh
+
+  e2e-bundle:
+    name: E2E Bundle
+    needs: [lint]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: tektoncd/actions/setup-tektoncd-cli@dd92514472167b361de1c95fd31fc2ef83c282ec # main
+
+      - name: Create Kind cluster
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+        with:
+          cluster_name: kind
+          wait: 120s
+
+      - name: Run bundle e2e test
+        env:
+          PIPELINE_VERSION: v1.12.0
+          TIMEOUT: 180s
+        run: ./test/e2e-bundle-test.sh
+
+  ci-summary:
+    name: CI summary
+    needs: [lint, e2e, e2e-bundle]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check CI results
+        run: |
+          results=(
+            "lint=${NEEDS_LINT_RESULT}"
+            "e2e=${NEEDS_E2E_RESULT}"
+            "e2e-bundle=${NEEDS_E2E_BUNDLE_RESULT}"
+          )
+          failed=0
+          for r in "${results[@]}"; do
+            name="${r%%=*}"
+            result="${r#*=}"
+            echo "${name}: ${result}"
+            if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then
+              failed=1
+            fi
+          done
+          if [ "$failed" -eq 1 ]; then
+            echo ""
+            echo "Some CI jobs failed or were cancelled"
+            exit 1
+          fi
+          echo ""
+          echo "All CI checks passed"
+        env:
+          NEEDS_LINT_RESULT: ${{ needs.lint.result }}
+          NEEDS_E2E_RESULT: ${{ needs.e2e.result }}
+          NEEDS_E2E_BUNDLE_RESULT: ${{ needs.e2e-bundle.result }}

.github/workflows/release.yaml

@@ -0,0 +1,72 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  release:
+    permissions:
+      packages: write
+      contents: write
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: tektoncd/actions/setup-tektoncd-cli@dd92514472167b361de1c95fd31fc2ef83c282ec # main
+
+      - name: Set tag output
+        id: tag
+        run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Publish Tekton Bundle
+        env:
+          GIT_TAG: ${{ steps.tag.outputs.tag_name }}
+          REGISTRY: "ghcr.io/${{ github.repository }}"
+        run: |
+          tkn bundle push "${REGISTRY}/bundle:${GIT_TAG}" \
+            -f task/kaniko/kaniko.yaml \
+            -f stepaction/kaniko/kaniko.yaml
+          tkn bundle push "${REGISTRY}/bundle:latest" \
+            -f task/kaniko/kaniko.yaml \
+            -f stepaction/kaniko/kaniko.yaml
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_TAG: ${{ steps.tag.outputs.tag_name }}
+          REGISTRY: "ghcr.io/${{ github.repository }}"
+        run: |
+          cat <<EOF > release-notes.md
+          ## Installation
+
+          Install the task directly:
+          \`\`\`bash
+          kubectl apply -f https://raw.githubusercontent.com/${{ github.repository }}/${GIT_TAG}/task/kaniko/kaniko.yaml
+          \`\`\`
+
+          Or use via bundle resolver:
+          \`\`\`yaml
+          taskRef:
+            resolver: bundles
+            params:
+              - name: bundle
+                value: ${REGISTRY}/bundle:${GIT_TAG}
+              - name: name
+                value: kaniko
+              - name: kind
+                value: task
+          \`\`\`
+
+          ### Bundle image
+          - \`${REGISTRY}/bundle:${GIT_TAG}\`
+          EOF
+
+          gh release create "${GIT_TAG}" \
+            --title "${GIT_TAG}" \
+            --notes-file release-notes.md