add changed files to the github interceptor

This change enriches the github payload of an incoming request with
the list of changed files related to a pull_request or push event.
The changed files list can be verified using a CEL interceptor to
halt processing and/or can be passed down to the pipelineRun
where the file list can be used by a task

docs/interceptors.md

@@ -187,6 +187,76 @@ For reference, below is an example legacy GitHub `Interceptor` definition:
 
 For more information, see our [example](../examples/v1beta1/github) of using this `Interceptor`.
 
+#### Adding Changed Files
+
+The GitHub `Interceptor` also has the ability to add a comma delimited list of all files that have changed (added, modified or deleted) for the `push` and `pull_request` events. The list of changed files are added to the `changed_files` property of the event payload in the top-level `extensions` field
+
+Below is an example GitHub `Interceptor` that enables the `addChangedFiles` feature and uses the CEL `Interceptor` to filter incoming events by the files changed
+
+```yaml
+ triggers:
+    - name: github-listener
+      interceptors:
+        - ref:
+            name: "github"
+            kind: ClusterInterceptor
+            apiVersion: triggers.tekton.dev
+          params:
+          - name: "secretRef"
+            value:
+              secretName: github-secret
+              secretKey: secretToken
+          - name: "eventTypes"
+            value: ["pull_request", "push"]
+          - name: "addChangedFiles"
+            value:
+              enabled: true
+        - ref:
+            name: cel
+          params:
+          - name: filter
+            # execute only when a file within the controllers directory has changed
+            value: extensions.changed_files.matches('controllers/')
+```
+
+##### Adding Changed Files - Private Repository
+
+The ability to add changed files can also work with private repositories by supplying a [GitHub personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) in the `personalAccessToken` field. In the example below, the `personalAccessToken` uses the `github-pat` secret to get the GitHub personal access token used to make the API calls to get the list of changed files.
+
+```yaml
+ triggers:
+    - name: github-listener
+      interceptors:
+        - ref:
+            name: "github"
+            kind: ClusterInterceptor
+            apiVersion: triggers.tekton.dev
+          params:
+          - name: "secretRef"
+            value:
+              secretName: github-secret
+              secretKey: secretToken
+          - name: "eventTypes"
+            value: ["pull_request", "push"]
+          - name: "addChangedFiles"
+            value:
+              enabled: true
+              personalAccessToken:
+                secretName: github-pat
+                secretKey: token
+        - ref:
+            name: cel
+          params:
+          - name: filter
+            # execute only when a file within the controllers directory has changed
+            value: extensions.changed_files.matches('controllers/')
+```
+
+For more information around adding changed files, see the following examples
+
+- [github-add-changed-files-pr](../examples/v1beta1/github-add-changed-files-pr)
+- [github-add-changed-files-push-cel](../examples/v1beta1/github-add-changed-files-push-cel)
+
 ### GitLab Interceptors
 
 A GitLab `Interceptor` contains logic that validates and filters GitLab webhooks.

docs/triggers-api.md

@@ -3704,6 +3704,18 @@ SecretRef
 <td>
 </td>
 </tr>
+<tr>
+<td>
+<code>addChangedFiles</code><br/>
+<em>
+<a href="#triggers.tekton.dev/v1beta1.GithubAddChangedFiles">
+GithubAddChangedFiles
+</a>
+</em>
+</td>
+<td>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="triggers.tekton.dev/v1beta1.GitLabInterceptor">GitLabInterceptor
@@ -3743,6 +3755,45 @@ SecretRef
 </tr>
 </tbody>
 </table>
+<h3 id="triggers.tekton.dev/v1beta1.GithubAddChangedFiles">GithubAddChangedFiles
+</h3>
+<p>
+(<em>Appears on:</em><a href="#triggers.tekton.dev/v1beta1.GitHubInterceptor">GitHubInterceptor</a>)
+</p>
+<div>
+</div>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>enabled</code><br/>
+<em>
+bool
+</em>
+</td>
+<td>
+</td>
+</tr>
+<tr>
+<td>
+<code>personalAccessToken</code><br/>
+<em>
+<a href="#triggers.tekton.dev/v1beta1.SecretRef">
+SecretRef
+</a>
+</em>
+</td>
+<td>
+</td>
+</tr>
+</tbody>
+</table>
 <h3 id="triggers.tekton.dev/v1beta1.InterceptorInterface">InterceptorInterface
 </h3>
 <div>
@@ -4233,7 +4284,7 @@ CustomResource
 <h3 id="triggers.tekton.dev/v1beta1.SecretRef">SecretRef
 </h3>
 <p>
-(<em>Appears on:</em><a href="#triggers.tekton.dev/v1beta1.BitbucketInterceptor">BitbucketInterceptor</a>, <a href="#triggers.tekton.dev/v1beta1.GitHubInterceptor">GitHubInterceptor</a>, <a href="#triggers.tekton.dev/v1beta1.GitLabInterceptor">GitLabInterceptor</a>)
+(<em>Appears on:</em><a href="#triggers.tekton.dev/v1beta1.BitbucketInterceptor">BitbucketInterceptor</a>, <a href="#triggers.tekton.dev/v1beta1.GitHubInterceptor">GitHubInterceptor</a>, <a href="#triggers.tekton.dev/v1beta1.GitLabInterceptor">GitLabInterceptor</a>, <a href="#triggers.tekton.dev/v1beta1.GithubAddChangedFiles">GithubAddChangedFiles</a>)
 </p>
 <div>
 <p>SecretRef contains the information required to reference a single secret string

examples/v1beta1/github-add-changed-files-pr/README.md

@@ -0,0 +1,47 @@
+## GitHub EventListener
+
+Creates an EventListener that listens for GitHub webhook events and adds the files that have changed within the pull request or push to the github payload. The list of changed files are added to the `changed_files` property of the event payload in the top-level `extensions` field
+
+### Try it out locally:
+
+1. To create the GitHub trigger and all related resources, run:
+
+   ```bash
+   kubectl apply -f .
+   ```
+
+1. Port forward:
+
+   ```bash
+   kubectl port-forward service/el-github-add-changed-files-pr-listener 8080
+   ```
+
+1. Test by sending the sample payload.
+
+   ```bash
+    curl -v \
+    -H 'X-GitHub-Event: pull_request' \
+    -H 'Content-Type: application/json' \
+    -d '{"action": "opened","number": 1503,"pull_request": {"head": {"sha": "16dd484bb4888dd30154f5ccb765beae1aaf72de"}},"repository": {"full_name": "tektoncd/triggers","clone_url": "https://github.com/tektoncd/triggers.git"}}' \
+    http://localhost:8080
+   ```
+
+   The response status code should be `202 Accepted`
+
+   [`HMAC`](https://www.freeformatter.com/hmac-generator.html) tool used to create X-Hub-Signature.
+
+   In [`HMAC`](https://www.freeformatter.com/hmac-generator.html) `string` is the *body payload ex:* `{"action": "opened", "pull_request":{"head":{"sha": "28911bbb5a3e2ea034daf1f6be0a822d50e31e73"}},"repository":{"clone_url": "https://github.com/tektoncd/triggers.git"}}`
+   and `secretKey` is the *given secretToken ex:* `1234567`.
+
+1. You should see a new TaskRun that got created:
+
+   ```bash
+   kubectl get taskruns | github-add-changed-files-pr-run-
+   ```
+
+1. Get the pod created from the TaskRun and show the logs to see the changed files:
+
+   ```bash
+   kubectl get pods | grep github-add-changed-files-pr-run-
+   kubectl logs <POD NAME>
+   ```

examples/v1beta1/github-add-changed-files-pr/curl.sh

@@ -0,0 +1,5 @@
+curl -v \
+-H 'X-GitHub-Event: pull_request' \
+-H 'Content-Type: application/json' \
+-d '{"action": "opened","number": 1503,"pull_request": {"head": {"sha": "16dd484bb4888dd30154f5ccb765beae1aaf72de"}},"repository": {"full_name": "tektoncd/triggers","clone_url": "https://github.com/tektoncd/triggers.git"}}' \
+http://localhost:8080

examples/v1beta1/github-add-changed-files-pr/github-eventlistener-interceptor.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: EventListener
+metadata:
+  name: github-add-changed-files-pr-listener
+spec:
+  triggers:
+    - name: github-add-changed-files-pr-listener
+      interceptors:
+        - ref:
+            name: "github"
+          params:
+            - name: "eventTypes"
+              value: ["pull_request", "push"]
+            - name: "addChangedFiles"
+              value:
+                enabled: true
+      bindings:
+        - ref: github-add-changed-files-pr-pr-binding
+      template:
+        ref: github-add-changed-files-pr-template
+  resources:
+    kubernetesResource:
+      spec:
+        template:
+          spec:
+            serviceAccountName: tekton-triggers-example-sa
+            containers:
+              - resources:
+                  requests:
+                    memory: "64Mi"
+                    cpu: "250m"
+                  limits:
+                    memory: "128Mi"
+                    cpu: "500m"
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerBinding
+metadata:
+  name: github-add-changed-files-pr-pr-binding
+spec:
+  params:
+    - name: changedfiles
+      value: $(extensions.changed_files)
+
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerTemplate
+metadata:
+  name: github-add-changed-files-pr-template
+spec:
+  params:
+    - name: changedfiles
+  resourcetemplates:
+    - apiVersion: tekton.dev/v1beta1
+      kind: TaskRun
+      metadata:
+        generateName: github-add-changed-files-pr-run-
+      spec:
+        taskSpec:
+          steps:
+            - image: ubuntu
+              script: |
+                #! /bin/bash
+                echo "Changed Files: $(tt.params.changedfiles)"

examples/v1beta1/github-add-changed-files-pr/rbac.yaml

@@ -0,0 +1 @@
+../../rbac.yaml

examples/v1beta1/github-add-changed-files-push-cel/README.md

@@ -0,0 +1,53 @@
+## GitHub EventListener
+
+Creates an EventListener that listens for GitHub webhook events and adds the files that have changed within the pull request or push to the github payload. The list of changed files are added to the `changed_files` property of the event payload in the top-level `extensions` field. It also contains a CEL interceptor that uses the list of changed files to determine whether or not to halt processing
+
+### Try it out locally:
+
+1. To create the GitHub trigger and all related resources, run:
+
+   ```bash
+   kubectl apply -f .
+   ```
+
+1. Port forward:
+
+   ```bash
+   kubectl port-forward service/el-github-add-changed-files-push-cel-listener 8080
+   ```
+
+1. Test by sending the sample payload.
+
+   ```bash
+    curl -v \
+    -H 'X-GitHub-Event: push' \
+    -H 'Content-Type: application/json' \
+    -d '{"repository":{"full_name":"testowner/testrepo","clone_url":"https://github.com/testowner/testrepo.git"},"commits":[{"added":["api/v1beta1/tektonhelperconfig_types.go","config/crd/bases/tekton-helper..com_tektonhelperconfigs.yaml"],"removed":["config/samples/tektonhelperconfig-oomkillpipeline.yaml","config/samples/tektonhelperconfig-timeout.yaml"],"modified":["controllers/tektonhelperconfig_controller.go"]}]}' \
+    http://localhost:8080
+   ```
+
+   The response status code should be `202 Accepted`
+
+   [`HMAC`](https://www.freeformatter.com/hmac-generator.html) tool used to create X-Hub-Signature.
+
+   In [`HMAC`](https://www.freeformatter.com/hmac-generator.html) `string` is the *body payload ex:* `{"action": "opened", "pull_request":{"head":{"sha": "28911bbb5a3e2ea034daf1f6be0a822d50e31e73"}},"repository":{"clone_url": "https://github.com/tektoncd/triggers.git"}}`
+   and `secretKey` is the *given secretToken ex:* `1234567`.
+
+1. You should see a new TaskRun that got created:
+
+   ```bash
+   kubectl get taskruns | grep github-add-changed-files-push-cel-run-
+   ```
+
+1. You should see a new TaskRun that got created:
+
+   ```bash
+   kubectl get taskruns | grep github-add-changed-files-push-cel-run-
+   ```
+
+1. Get the pod created from the TaskRun and show the logs to see the changed files:
+
+   ```bash
+   kubectl get pods | grep github-add-changed-files-push-cel-run-
+   kubectl logs <POD NAME>
+   ```

examples/v1beta1/github-add-changed-files-push-cel/curl.sh

@@ -0,0 +1,5 @@
+curl -v \
+-H 'X-GitHub-Event: push' \
+-H 'Content-Type: application/json' \
+-d '{"repository":{"full_name":"testowner/testrepo","clone_url":"https://github.com/testowner/testrepo.git"},"commits":[{"added":["api/v1beta1/tektonhelperconfig_types.go","config/crd/bases/tekton-helper..com_tektonhelperconfigs.yaml"],"removed":["config/samples/tektonhelperconfig-oomkillpipeline.yaml","config/samples/tektonhelperconfig-timeout.yaml"],"modified":["controllers/tektonhelperconfig_controller.go"]}]}' \
+http://localhost:8080