Allow modify the spec of a PipelineRun when it is in the PipelineRunPending state

[l-qing]

Feature request

Allow modify the spec of a PipelineRun when it is in the PipelineRunPending state.
(Feature flag control can be applied)

In this Issue #8148, I propose that once a TaskRun or PipelineRun is created, many fields in the spec should not be allowed to be modified.

The purpose is to avoid impacting tasks that are already in execution. In the vast majority of scenarios, the fields of the spec should not be modified.

However, there are some exceptions.

For instance, if the PipelineRun has not started executing any tasks and is still in the PipelineRunPending state, modifying the fields of the spec at this time will not result in unstable execution outcomes.

Use case

The existing webhook mechanism cannot complete the modifications.

• Modifications are very time-consuming and may even require third-party components.
• Multiple components need to be modified in sequence, with subsequent components referencing the modification results of the preceding components.

1. I trigger a Pending PipelineRun in OpenShift using Pipeline-as-Code.

apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
  name: pr-pending
  annotations:
    pipelinesascode.tekton.dev/on-event: "[pull_request, push]"

    pipelinesascode.tekton.dev/on-target-branch: "[main, master]"

    pipelinesascode.tekton.dev/on-comment: "^/test-pr"

    # Declare some configurations that can affect the modify of the pipeline
    custom.tekton.dev/timeouts: "For example, dynamically adjusting timeouts based on rules, and implementing complex logic that is inconvenient in webhooks."

    custom.tekton.dev/tasks: "It is necessary to orderly modify and add tasks through multiple components."

  labels:
    # Specify who needs to start the pipeline. The spec can also be modified before starting if needed.
    custom.tekton.dev/started-by: "other-components"
spec:
  status: PipelineRunPending
  pipelineRef:
    name: pipeline

2. I customized a controller to specifically watch for PipelineRuns with pipelineascode.tekton.dev/started-by: "other-components" in their labels and are in a Pending state.

3. In my controller, I can modify the PipelineRun’s spec as needed. I can even request time-consuming third-party services to complete the modifications without worrying about webhook timeout issues.

4. I can predefine multiple controllers to modify the PipelineRun’s spec in sequence orderly. This is something that webhooks cannot achieve.