fix(resolve): deep-copy cached resources before inlining

Use DeepCopy when reusing cached Pipeline and Task objects across
PipelineRuns. Without this, inlineTasks mutates the cached
original, contaminating subsequent runs that reference the same
remote pipeline.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Akshay Pant <akpant@redhat.com>

Author: theakshaypant

pkg/resolve/remote.go

@@ -122,8 +122,8 @@ func resolveRemoteResources(ctx context.Context, rt *matcher.RemoteTasks, types
 				// making sure that the pipeline with same annotation name is not fetched
 				if alreadyFetchedResource(fetchedResourcesForEvent.Pipelines, remotePipeline) {
 					rt.Logger.Debugf("skipping already fetched pipeline %s in annotations on pipelinerun %s", remotePipeline, pipelinerun.GetName())
-					// already fetched, then just get the pipeline to add to run specific Resources
-					pipeline = fetchedResourcesForEvent.Pipelines[remotePipeline]
+					// already fetched, deep-copy so inlining for this run doesn't mutate the cached original
+					pipeline = fetchedResourcesForEvent.Pipelines[remotePipeline].DeepCopy()
 				} else {
 					// seems like a new pipeline, fetch it based on name in annotation
 					pipeline, err = rt.GetPipelineFromAnnotationName(ctx, remotePipeline)
@@ -181,7 +181,7 @@ func resolveRemoteResources(ctx context.Context, rt *matcher.RemoteTasks, types
 				// if task is already fetched in the event, then just copy the task
 				if alreadyFetchedResource(fetchedResourcesForEvent.Tasks, remoteTask) {
 					rt.Logger.Debugf("skipping already fetched task %s in annotations on pipelinerun %s", remoteTask, pipelinerun.GetName())
-					task = fetchedResourcesForEvent.Tasks[remoteTask]
+					task = fetchedResourcesForEvent.Tasks[remoteTask].DeepCopy()
 				} else {
 					// get the task from annotation name
 					task, err = rt.GetTaskFromAnnotationName(ctx, remoteTask)
@@ -213,7 +213,7 @@ func resolveRemoteResources(ctx context.Context, rt *matcher.RemoteTasks, types
 
 		// if PipelineRef is used then, first resolve pipeline and replace all taskRef{Finally/Task} of Pipeline, then put inlinePipeline in PipelineRun
 		if pipelinerun.Spec.PipelineRef != nil && pipelinerun.Spec.PipelineRef.Resolver == "" {
-			pipelineResolved := fetchedResourcesForPipelineRun.Pipeline
+			pipelineResolved := fetchedResourcesForPipelineRun.Pipeline.DeepCopy()
 			turns, err := inlineTasks(pipelineResolved.Spec.Tasks, ropt, fetchedResourcesForPipelineRun)
 			if err != nil {
 				return nil, err

pkg/resolve/remote_test.go

@@ -512,6 +512,84 @@ func TestRemote(t *testing.T) {
 	}
 }
 
+// Verifies that cached remote pipelines are deep-copied before modification.
+// Without deep copy, when the first PipelineRun applies its task annotation,
+// it would mutate the cached pipeline and leak that task into the second run.
+func TestSharedRemotePipelineCacheNotMutated(t *testing.T) {
+	taskName := "shared-task"
+
+	pipelineTask := tektonv1.TaskSpec{
+		Steps: []tektonv1.Step{
+			{Name: "from-pipeline", Image: "alpine", Command: []string{"true"}},
+		},
+	}
+	pipelinerunTask := tektonv1.TaskSpec{
+		Steps: []tektonv1.Step{
+			{Name: "from-pipelinerun", Image: "busybox", Command: []string{"false"}},
+		},
+	}
+
+	// remote pipeline with a single TaskRef
+	pipeline := ttkn.MakePipeline("shared-pipeline", []tektonv1.PipelineTask{
+		{Name: taskName, TaskRef: &tektonv1.TaskRef{Name: taskName}},
+	}, map[string]string{
+		apipac.Task: "http://remote/shared-task",
+	})
+	pipelineB, err := yaml.Marshal(pipeline)
+	assert.NilError(t, err)
+
+	pipelineTaskB, err := ttkn.MakeTaskB(taskName, pipelineTask)
+	assert.NilError(t, err)
+	pipelinerunTaskB, err := ttkn.MakeTaskB(taskName, pipelinerunTask)
+	assert.NilError(t, err)
+
+	remoteURLS := map[string]map[string]string{
+		"http://remote/shared-pipeline": {"body": string(pipelineB), "code": "200"},
+		"http://remote/shared-task":     {"body": string(pipelineTaskB), "code": "200"},
+		"http://remote/pr-task":         {"body": string(pipelinerunTaskB), "code": "200"},
+	}
+
+	// first run: overrides the task via pipelinerun annotation
+	// second run: same pipeline, no override — should get the original task
+	pipelineruns := []*tektonv1.PipelineRun{
+		ttkn.MakePR("first-run", map[string]string{
+			apipac.Pipeline: "http://remote/shared-pipeline",
+			apipac.Task:     "http://remote/pr-task",
+		}, tektonv1.PipelineRunSpec{
+			PipelineRef: &tektonv1.PipelineRef{Name: "shared-pipeline"},
+		}),
+		ttkn.MakePR("second-run", map[string]string{
+			apipac.Pipeline: "http://remote/shared-pipeline",
+		}, tektonv1.PipelineRunSpec{
+			PipelineRef: &tektonv1.PipelineRef{Name: "shared-pipeline"},
+		}),
+	}
+
+	observer, _ := zapobserver.New(zap.InfoLevel)
+	logger := zap.New(observer).Sugar()
+	ctx, _ := rtesting.SetupFakeContext(t)
+	httpTestClient := httptesthelper.MakeHTTPTestClient(remoteURLS)
+	rt := &matcher.RemoteTasks{
+		ProviderInterface: &testprovider.TestProviderImp{},
+		Logger:            logger,
+		Run: &params.Run{
+			Clients: clients.Clients{HTTP: *httpTestClient},
+		},
+	}
+
+	ret, err := resolveRemoteResources(ctx, rt, TektonTypes{PipelineRuns: pipelineruns}, &Opts{RemoteTasks: true, GenerateName: true})
+	assert.NilError(t, err)
+	assert.Equal(t, len(ret), 2)
+
+	firstStep := ret[0].Spec.PipelineSpec.Tasks[0].TaskSpec.Steps[0]
+	assert.Equal(t, firstStep.Name, "from-pipelinerun")
+	assert.Equal(t, firstStep.Image, "busybox")
+
+	secondStep := ret[1].Spec.PipelineSpec.Tasks[0].TaskSpec.Steps[0]
+	assert.Equal(t, secondStep.Name, "from-pipeline")
+	assert.Equal(t, secondStep.Image, "alpine")
+}
+
 func TestAssembleTaskFQDNs(t *testing.T) {
 	tests := []struct {
 		name        string