Switch to a home-rolled commit step because git-cli is not using the ssh credentials attached to the service account.

.webhook_bridge/pipeline-format.yaml

@@ -214,29 +214,28 @@ spec:
           - name: docker-image
             value: "$(tasks.build-image.results.IMAGE_URL[1])"
       - name: commit-changes
-        taskRef:
+        taskSpec:
-          resolver: git
+          metadata: {}
-          params:
+          stepTemplate:
-            - name: url
+            image: alpine:3.20
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+            computeResources:
-            - name: revision
+              requests:
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+                cpu: 10m
-            - name: pathInRepo
+                memory: 600Mi
-              value: task/git-cli/0.4/git-cli.yaml
+            workingDir: "$(workspaces.source.path)"
-        params:
+          steps:
-          - name: GIT_USER_NAME
+            - image: alpine/git:v2.34.2
-            value: fluxcdbot
+              name: commit-changes-step
-          - name: GIT_USER_EMAIL
+              script: |
-            value: "fluxcdbot@users.noreply.github.com"
+                #!/usr/bin/env sh
-          - name: GIT_SCRIPT
+                set -euo pipefail
-            value: |
+                git config --global user.email "fluxcdbot@users.noreply.github.com"
-              pwd
+                git config --global user.name "fluxcdbot"
                 git config --global --add safe.directory /workspace/source
                 git_status=$(git status --porcelain)
                 if [ -n "$git_status" ]; then
                   git commit -a -m "CI: autofix rust code."
-                ln -s /tekton/home/.ssh /root/.ssh
+                  GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" git push origin HEAD:$(params.PULL_BASE_REF)
-                git push origin HEAD:$(params.PULL_BASE_REF)
                 else
                   echo "No changes to commit."
                 fi

.webhook_bridge/webhook_bridge.toml

@@ -1,16 +1,16 @@
 version = "0.0.1"
 
-[[push]]
+# [[push]]
-  name = "rust-test"
+#   name = "rust-test"
-  source = "pipeline-rust-test.yaml"
+#   source = "pipeline-rust-test.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/natter.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/natter.git"
-  skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
+#   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
-[[push]]
+# [[push]]
-  name = "clippy"
+#   name = "clippy"
-  source = "pipeline-rust-clippy.yaml"
+#   source = "pipeline-rust-clippy.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/natter.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/natter.git"
-  skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
+#   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
 [[push]]
   name = "format"
@@ -18,8 +18,8 @@ version = "0.0.1"
   clone_uri = "git@code.fizz.buzz:talexander/natter.git"
   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
-[[push]]
+# [[push]]
-  name = "build"
+#   name = "build"
-  source = "pipeline-build-hash.yaml"
+#   source = "pipeline-build-hash.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/natter.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/natter.git"
-  branches = [ "^main$", "^master$" ]
+#   branches = [ "^main$", "^master$" ]