fix: validate referenced volumes in PipelineRun executor before creation

[mohit-bhandari45]

Changes

The PipelineRun executor mode did not validate referenced volumes (Secrets, ConfigMaps, Projected volumes) before creating the PipelineRun resource in Kubernetes.

During reconciliation, validateExecutorVolumes called GetUnderlyingTaskRuns on the ImageBuildRunner. For a PipelineRun, GetUnderlyingTaskRuns inspects PipelineRun.Status.ChildReferences. However, before the PipelineRun is created in Kubernetes, Status.ChildReferences is empty, causing GetUnderlyingTaskRuns to return an empty list and volume validation to be completely skipped.

As a result, a Build or BuildRun referencing a non-existent Secret or ConfigMap would proceed to create the PipelineRun in Kubernetes instead of failing early with Reason: VolumeDoesNotExist.

Solution

1. Extracted volume checking logic into a generic helper CheckVolumesExist(ctx, client, namespace, volumes) in resources/volumes.go.
2. Added CheckPipelineRunVolumesExist(ctx, client, pipelineRun) to iterate over pipelineRun.Spec.PipelineSpec.Tasks (and .Finally) and validate embedded task volumes directly against Kubernetes before resource creation.
3. Updated validateExecutorVolumes in buildrun.go to inspect the ImageBuildRunner type and validate TektonPipelineRunWrapper volumes directly.
4. Added unit test coverage for volume helpers in resources/volumes_test.go and reconciler volume validation failure in buildrun_test.go.

Related Issue

Fixes #2325

Type of PR

/kind bug

Submitter Checklist

• Includes tests if functionality changed/was added
• Includes docs if changes are user-facing
• Kind label has been set
• Release notes block has been filled in, or marked NONE

Release Notes

Fixed an issue where the PipelineRun executor mode skipped pre-flight volume validation for missing Secrets and ConfigMaps before creating the PipelineRun resource.

[openshift-ci]

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign apoorvajagtap for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kaizakin]

@mohit-bhandari45 please sign your commits

[mohit-bhandari45]

@kaizakin Almost forget, done now.