feat: Add GitOps command support for tags in GitLab

This commit introduces the ability to trigger, retest, and cancel
pipeline runs on GitLab tags using GitOps comments on commits.

Key features:
- Support `/test tag:<tagname>`, `/retest tag:<tagname>`, and
  `/cancel tag:<tagname>` GitOps comments on commits
- Validate that the commented commit matches the tag before
  processing the request
- Enable retriggering pipelines on existing tagged commits without
  creating new tags

Testing:
- Add comprehensive unit tests covering success and error scenarios
- Add end-to-end test validating the complete workflow from tag
  creation to pipeline execution

Use cases:
- Release management: retrigger pipelines on tagged releases
- Troubleshooting: re-run failed pipelines on existing tags
- Flexible CI/CD workflows for version-specific builds

https://issues.redhat.com/browse/SRVKP-8612

Signed-off-by: Zaki Shaikh <zashaikh@redhat.com>

Author: zakisk

docs/content/docs/guide/gitops_commands.md

@@ -124,7 +124,7 @@ The PipelineRun will be restarted regardless of the annotations if the comment `
 
 ### Triggering PipelineRun on Git tags
 
-{{< support_matrix github_app="true" github_webhook="true" gitea="false" gitlab="false" bitbucket_cloud="false" bitbucket_server="false" >}}
+{{< support_matrix github_app="true" github_webhook="true" gitea="false" gitlab="true" bitbucket_cloud="false" bitbucket_server="false" >}}
 
 You can retrigger a PipelineRun against a specific Git tag by commenting on
 the tagged commit using a GitOps command. Pipelines-as-Code will resolve the

pkg/provider/gitlab/parse_payload.go

@@ -256,12 +256,20 @@ func (v *Provider) handleCommitCommentEvent(ctx context.Context, event *gitlab.C
 	var (
 		branchName string
 		prName     string
+		tagName    string
 		err        error
 	)
 
+	// since we're going to make an API call to ensure that the commit is HEAD of the branch
+	// therefore we need to initialize GitLab client here
+	processedEvent, err = v.initGitLabClient(ctx, processedEvent)
+	if err != nil {
+		return processedEvent, err
+	}
+
 	// get PipelineRun name from comment if it does contain e.g. `/test pr7`
 	if provider.IsTestRetestComment(event.ObjectAttributes.Note) {
-		prName, branchName, err = opscomments.GetPipelineRunAndBranchNameFromTestComment(event.ObjectAttributes.Note)
+		prName, branchName, tagName, err = provider.GetPipelineRunAndBranchOrTagNameFromTestComment(event.ObjectAttributes.Note)
 		if err != nil {
 			return processedEvent, err
 		}
@@ -270,23 +278,32 @@ func (v *Provider) handleCommitCommentEvent(ctx context.Context, event *gitlab.C
 
 	if provider.IsCancelComment(event.ObjectAttributes.Note) {
 		action = "cancellation"
-		prName, branchName, err = opscomments.GetPipelineRunAndBranchNameFromCancelComment(event.ObjectAttributes.Note)
+		prName, branchName, tagName, err = provider.GetPipelineRunAndBranchOrTagNameFromCancelComment(event.ObjectAttributes.Note)
 		if err != nil {
 			return processedEvent, err
 		}
 		processedEvent.CancelPipelineRuns = true
 		processedEvent.TargetCancelPipelineRun = prName
 	}
 
-	if branchName == "" {
-		branchName = processedEvent.HeadBranch
+	if tagName != "" {
+		tagPath := fmt.Sprintf("refs/tags/%s", tagName)
+		tag, _, err := v.gitlabClient.Tags.GetTag(v.sourceProjectID, tagName)
+		if err != nil {
+			return processedEvent, fmt.Errorf("error getting tag %s: %w", tagName, err)
+		}
+
+		if tag.Commit.ID != processedEvent.SHA {
+			return processedEvent, fmt.Errorf("provided SHA %s is not the tagged commit for the tag %s", processedEvent.SHA, tagName)
+		}
+
+		processedEvent.HeadBranch = tagPath
+		processedEvent.BaseBranch = tagPath
+		return processedEvent, nil
 	}
 
-	// since we're going to make an API call to ensure that the commit is HEAD of the branch
-	// therefore we need to initialize GitLab client here
-	processedEvent, err = v.initGitLabClient(ctx, processedEvent)
-	if err != nil {
-		return processedEvent, err
+	if branchName == "" {
+		branchName = processedEvent.HeadBranch
 	}
 
 	// check if the commit on which comment is made, is HEAD commit of the branch

pkg/provider/gitlab/parse_payload_test.go

@@ -201,12 +201,15 @@ func TestParsePayload(t *testing.T) {
 			wantErrMsg: "error parse_payload: the repository in event payload must not be nil",
 		},
 		{
-			name: "bad/commit comment wrong branch keyword",
+			name:   "bad/commit comment wrong branch keyword",
+			fields: fields{sourceProjectID: 200},
 			args: args{
 				event:   gitlab.EventTypeNote,
 				payload: sample.CommitNoteEventAsJSON("/test brrranch:fix", "create", "{}"),
 			},
-			wantErrMsg: "the GitOps comment brrranch does not contain a branch word",
+			wantErrMsg:     "does not contain a branch or tag word",
+			wantKubeClient: true,
+			wantClient:     true,
 		},
 		{
 			name:   "good/commit comment /test all pipelineruns",
@@ -307,6 +310,82 @@ func TestParsePayload(t *testing.T) {
 			wantKubeClient: true,
 			wantClient:     true,
 		},
+		{
+			name:   "good/commit comment /test on a tag",
+			fields: fields{sourceProjectID: 200},
+			args: args{
+				event:   gitlab.EventTypeNote,
+				payload: sample.CommitNoteEventAsJSON("/test tag:v1.0.0", "create", "{}"),
+			},
+			want: &info.Event{
+				EventType:     opscomments.TestSingleCommentEventType.String(),
+				TriggerTarget: triggertype.Push,
+				Organization:  "hello/this/is/me/ze",
+				Repository:    "project",
+				HeadBranch:    "refs/tags/v1.0.0",
+				BaseBranch:    "refs/tags/v1.0.0",
+			},
+			wantKubeClient: true,
+			wantClient:     true,
+		},
+		{
+			name:   "good/commit comment /retest on a tag",
+			fields: fields{sourceProjectID: 200},
+			args: args{
+				event:   gitlab.EventTypeNote,
+				payload: sample.CommitNoteEventAsJSON("/retest tag:v1.0.0", "create", "{}"),
+			},
+			want: &info.Event{
+				EventType:     opscomments.RetestSingleCommentEventType.String(),
+				TriggerTarget: triggertype.Push,
+				Organization:  "hello/this/is/me/ze",
+				Repository:    "project",
+				HeadBranch:    "refs/tags/v1.0.0",
+				BaseBranch:    "refs/tags/v1.0.0",
+			},
+			wantKubeClient: true,
+			wantClient:     true,
+		},
+		{
+			name:   "good/commit comment /cancel on a tag",
+			fields: fields{sourceProjectID: 200},
+			args: args{
+				event:   gitlab.EventTypeNote,
+				payload: sample.CommitNoteEventAsJSON("/cancel tag:v1.0.0", "create", "{}"),
+			},
+			want: &info.Event{
+				EventType:     opscomments.CancelCommentSingleEventType.String(),
+				TriggerTarget: triggertype.Push,
+				Organization:  "hello/this/is/me/ze",
+				Repository:    "project",
+				HeadBranch:    "refs/tags/v1.0.0",
+				BaseBranch:    "refs/tags/v1.0.0",
+			},
+			wantKubeClient: true,
+			wantClient:     true,
+		},
+		{
+			name:   "bad/commit comment tag does not exist",
+			fields: fields{sourceProjectID: 200},
+			args: args{
+				event:   gitlab.EventTypeNote,
+				payload: sample.CommitNoteEventAsJSON("/test tag:nonexistent", "create", "{}"),
+			},
+			wantErrMsg:     "error getting tag nonexistent",
+			wantKubeClient: true,
+			wantClient:     true,
+		},
+		{
+			name:   "bad/commit comment SHA does not match tag commit",
+			fields: fields{sourceProjectID: 200},
+			args: args{
+				event:   gitlab.EventTypeNote,
+				payload: sample.CommitNoteEventAsJSON("/test tag:v1.0.0-mismatch", "create", "{}"),
+			},
+			wantErrMsg:     "provided SHA sha is not the tagged commit for the tag v1.0.0-mismatch",
+			wantKubeClient: true,
+			wantClient:     true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -375,6 +454,32 @@ func TestParsePayload(t *testing.T) {
 						bytes, _ := json.Marshal(branch)
 						_, _ = rw.Write(bytes)
 					})
+				// Mock tag API for v1.0.0 (valid tag with matching SHA)
+				mux.HandleFunc("/projects/200/repository/tags/v1.0.0",
+					func(rw http.ResponseWriter, _ *http.Request) {
+						tag := &gitlab.Tag{
+							Name:   "v1.0.0",
+							Commit: &gitlab.Commit{ID: "sha"},
+						}
+						bytes, _ := json.Marshal(tag)
+						_, _ = rw.Write(bytes)
+					})
+				// Mock tag API for v1.0.0-mismatch (tag with non-matching SHA)
+				mux.HandleFunc("/projects/200/repository/tags/v1.0.0-mismatch",
+					func(rw http.ResponseWriter, _ *http.Request) {
+						tag := &gitlab.Tag{
+							Name:   "v1.0.0-mismatch",
+							Commit: &gitlab.Commit{ID: "different-sha"},
+						}
+						bytes, _ := json.Marshal(tag)
+						_, _ = rw.Write(bytes)
+					})
+				// Mock tag API for nonexistent (return 404)
+				mux.HandleFunc("/projects/200/repository/tags/nonexistent",
+					func(rw http.ResponseWriter, _ *http.Request) {
+						rw.WriteHeader(http.StatusNotFound)
+						_, _ = rw.Write([]byte(`{"message":"404 Tag Not Found"}`))
+					})
 				defer tearDown()
 			}
 
@@ -398,6 +503,12 @@ func TestParsePayload(t *testing.T) {
 				if tt.want.TargetCancelPipelineRun != "" {
 					assert.Equal(t, tt.want.TargetCancelPipelineRun, got.TargetCancelPipelineRun)
 				}
+				if tt.want.HeadBranch != "" {
+					assert.Equal(t, tt.want.HeadBranch, got.HeadBranch)
+				}
+				if tt.want.BaseBranch != "" {
+					assert.Equal(t, tt.want.BaseBranch, got.BaseBranch)
+				}
 			}
 		})
 	}

test/gitlab_push_gitops_command_test.go

@@ -166,3 +166,93 @@ func TestGitlabGitOpsCommandCancelOnPush(t *testing.T) {
 	err = wait.UntilPipelineRunHasReason(ctx, runcnx.Clients, v1.PipelineRunReasonCancelled, waitOpts)
 	assert.NilError(t, err)
 }
+
+func TestGitlabGitOpsCommandTestOnTag(t *testing.T) {
+	targetNs := names.SimpleNameGenerator.RestrictLengthWithRandomSuffix("pac-e2e-ns")
+	ctx := context.Background()
+	runcnx, opts, glprovider, err := tgitlab.Setup(ctx)
+	assert.NilError(t, err)
+	ctx, err = cctx.GetControllerCtxInfo(ctx, runcnx)
+	assert.NilError(t, err)
+	runcnx.Clients.Log.Info("Testing with Gitlab")
+	projectinfo, resp, err := glprovider.Client().Projects.GetProject(opts.ProjectID, nil)
+	assert.NilError(t, err)
+	if resp != nil && resp.StatusCode == http.StatusNotFound {
+		t.Errorf("Repository %s not found in %s", opts.Organization, opts.Repo)
+	}
+
+	tagName := "v1.0.0"
+	comment := "/test tag:" + tagName
+	sha := ""
+	targetBranch := "release-" + tagName
+	numberOfPRs := 1
+
+	err = tgitlab.CreateCRD(ctx, projectinfo, runcnx, opts, targetNs, nil)
+	assert.NilError(t, err)
+
+	runcnx.Clients.Log.Infof("Repository %s has been created successfully", targetNs)
+
+	tag, resp, err := glprovider.Client().Tags.GetTag(opts.ProjectID, tagName)
+	if err != nil && resp.StatusCode == http.StatusNotFound {
+		runcnx.Clients.Log.Infof("Tag %s not found in repository %s", tagName, projectinfo.Name)
+		runcnx.Clients.Log.Infof("Creating tag %s in repository %s", tagName, projectinfo.Name)
+
+		entries, err := payload.GetEntries(map[string]string{
+			".tekton/pipelinerun-on-tag.yaml": "testdata/pipelinerun-on-tag.yaml",
+		}, targetNs, "refs/tags/*", triggertype.Push.String(), map[string]string{})
+		assert.NilError(t, err)
+
+		cloneURL, err := scm.MakeGitCloneURL(projectinfo.WebURL, "git", *glprovider.Token)
+		assert.NilError(t, err)
+
+		scmOpts := &scm.Opts{
+			GitURL:        cloneURL,
+			Log:           runcnx.Clients.Log,
+			WebURL:        projectinfo.WebURL,
+			TargetRefName: targetBranch,
+			BaseRefName:   projectinfo.DefaultBranch,
+			CommitTitle:   "Test GitOps Commands on Tag - " + targetNs,
+		}
+		_ = scm.PushFilesToRefGit(t, scmOpts, entries)
+
+		branch, _, err := glprovider.Client().Branches.GetBranch(opts.ProjectID, targetBranch)
+		assert.NilError(t, err)
+
+		sha = branch.Commit.ID
+
+		_, _, err = glprovider.Client().Tags.CreateTag(opts.ProjectID, &gitlab.CreateTagOptions{
+			TagName: gitlab.Ptr(tagName),
+			Ref:     gitlab.Ptr(targetBranch),
+		})
+		assert.NilError(t, err)
+
+		// as we're creating a tag, we need to increment the number of PRs
+		// because the tag creation will also trigger a new PipelineRun
+		numberOfPRs++
+	} else {
+		runcnx.Clients.Log.Infof("Tag %s already created in repository %s", tagName, projectinfo.Name)
+		sha = tag.Commit.ID
+	}
+	defer tgitlab.TearDown(ctx, t, runcnx, glprovider, -1, "", targetNs, opts.ProjectID)
+
+	cc, _, err := glprovider.Client().Commits.PostCommitComment(opts.ProjectID, sha, &gitlab.PostCommitCommentOptions{
+		Note: gitlab.Ptr(comment),
+	})
+	assert.NilError(t, err)
+	runcnx.Clients.Log.Infof("Commit comment %s has been created", cc.Note)
+
+	waitOpts := wait.Opts{
+		RepoName:        targetNs,
+		Namespace:       targetNs,
+		MinNumberStatus: numberOfPRs,
+		PollTimeout:     wait.DefaultTimeout,
+		TargetSHA:       sha,
+	}
+
+	err = wait.UntilPipelineRunCreated(ctx, runcnx.Clients, waitOpts)
+	assert.NilError(t, err)
+
+	prsNew, err := runcnx.Clients.Tekton.TektonV1().PipelineRuns(targetNs).List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	assert.Assert(t, len(prsNew.Items) == numberOfPRs)
+}