feat(cel): enable string and list extension functions in CEL expressions

Previously, CEL expressions in Pipelines-as-Code only had access to
the core CEL operators, which limited users to basic comparisons and
logical expressions. Functions like join(), replace(), substring(),
and other string/list manipulation operations were unavailable,
forcing users to work around these limitations.

This adds cel-go's ext.Strings() and ext.Lists() extensions to the
CEL environment in pkg/cel/cel.go. This unlocks the full set of
standard CEL string operations (join, replace, substring, split,
trim, upperAscii, lowerAscii, etc.) and list operations, which can
be used in both `on-cel-expression` annotations and `{{ cel: }}`
template expressions.

Changes:
- pkg/cel/cel.go: Register ext.Strings() and ext.Lists() extensions
  on the CEL environment alongside existing variable declarations
- pkg/templates/templating_test.go: Add unit tests for join(),
  replace(), and substring() via the template placeholder path;
  improve test failure message to show actual vs expected values
- test/testdata/pipelinerun-cel-string-join.yaml: New e2e test
  fixture that uses files.all.join(", ") in a cel: template
- test/github_pullrequest_test.go: Add GHE e2e test
  (TestGithubGHEPullRequestCELJoin) that verifies join() works
  end-to-end by checking the PipelineRun pod log output matches
  the expected changed file path

Note: The e2e test uses regex matching (empty goldenFile param)
rather than golden file comparison, since the output is a single
dynamic file path that varies per test run.

Signed-off-by: Zaki Shaikh <zashaikh@redhat.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: zakisk

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/google/cel-go v0.28.0
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-github/scrape v0.0.0-20260403152401-96a365122246
+	github.com/google/go-github/v84 v84.0.0
 	github.com/google/go-github/v85 v85.0.0
 	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
 	github.com/jenkins-x/go-scm v1.15.17
@@ -78,7 +79,6 @@ require (
 	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
 	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/google/go-github/v84 v84.0.0 // indirect
 	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/rickb777/plural v1.4.10 // indirect

pkg/cel/cel.go

@@ -9,6 +9,7 @@ import (
 	"github.com/google/cel-go/common/decls"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/ext"
 )
 
 func evaluate(expr string, env *cel.Env, data map[string]any) (ref.Val, error) {
@@ -90,7 +91,10 @@ func Value(query string, body any, headers, pacParams map[string]string, changed
 			decls.NewVariable("pull_request_labels", types.StringType),
 			decls.NewVariable("pull_request_number", types.StringType),
 			decls.NewVariable("git_auth_secret", types.StringType),
-		))
+		),
+		ext.Strings(),
+		ext.Lists(),
+	)
 	val, err := evaluate(query, celDec, map[string]any{
 		"body":    jsonMap,
 		"pac":     pacParams,

pkg/templates/templating_test.go

@@ -175,12 +175,59 @@ func TestReplacePlaceHoldersVariables(t *testing.T) {
 				"hello": "world",
 			},
 		},
+		{
+			name:     "Test CEL with string join",
+			template: `all files: {{ files.all.join(", ") }}`,
+			expected: `all files: file1.txt, file2.txt, file3.txt`,
+			dicto: map[string]string{
+				"revision": "main",
+			},
+			changedFiles: map[string]any{
+				"all": []string{"file1.txt", "file2.txt", "file3.txt"},
+			},
+			headers: http.Header{
+				"Test": []string{"value"},
+			},
+			rawEvent: map[string]any{
+				"hello": "world",
+			},
+		},
+		{
+			name:     "Test CEL with string replace",
+			template: `{{ cel: trigger_comment.replace("bad", "good") }}`,
+			expected: `a good comment!`,
+			dicto: map[string]string{
+				"trigger_comment": "a bad comment!",
+			},
+			changedFiles: map[string]any{},
+			headers: http.Header{
+				"Test": []string{"value"},
+			},
+			rawEvent: map[string]any{
+				"hello": "world",
+			},
+		},
+		{
+			name:     "Test CEL with string substring",
+			template: `{{ cel: "HELLOWORLD".substring(0, 5) }}`,
+			expected: `HELLO`,
+			dicto: map[string]string{
+				"trigger_comment": "a bad comment!",
+			},
+			changedFiles: map[string]any{},
+			headers: http.Header{
+				"Test": []string{"value"},
+			},
+			rawEvent: map[string]any{
+				"hello": "world",
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := ReplacePlaceHoldersVariables(tt.template, tt.dicto, tt.rawEvent, tt.headers, tt.changedFiles)
 			if d := cmp.Diff(got, tt.expected); d != "" {
-				t.Fatalf("-got, +want: %v", d)
+				t.Fatalf("-got %s, +want: %s", got, tt.expected)
 			}
 		})
 	}

test/github_pullrequest_test.go

@@ -765,6 +765,34 @@ func TestGithubGHEPullRequestCelPrefix(t *testing.T) {
 	assert.NilError(t, err)
 }
 
+func TestGithubGHEPullRequestCELJoin(t *testing.T) {
+	ctx := context.Background()
+	g := &tgithub.PRTest{
+		Label:     "Github CEL String Join",
+		YamlFiles: []string{"testdata/pipelinerun-cel-string-join.yaml"},
+		GHE:       true,
+	}
+	g.RunPullRequest(ctx, t)
+	defer g.TearDown(ctx, t)
+
+	prs, err := g.Cnx.Clients.Tekton.TektonV1().PipelineRuns(g.TargetNamespace).List(ctx, metav1.ListOptions{})
+	assert.NilError(t, err)
+	assert.Assert(t, len(prs.Items) >= 1, "Expected at least one PipelineRun")
+
+	err = twait.RegexpMatchingInPodLog(
+		ctx,
+		g.Cnx,
+		g.TargetNamespace,
+		fmt.Sprintf("tekton.dev/pipelineRun=%s,tekton.dev/pipelineTask=cel-string-join-test", prs.Items[0].Name),
+		"step-test-cel-string-join-values",
+		*regexp.MustCompile(".*tekton/pipelinerun-cel-string-join.yaml"),
+		"",
+		2,
+		nil,
+	)
+	assert.NilError(t, err)
+}
+
 // Local Variables:
 // compile-command: "go test -tags=e2e -v -info TestGithubPullRequest$ ."
 // End:

test/testdata/pipelinerun-cel-string-join.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: "\\ .PipelineName //"
+  annotations:
+    pipelinesascode.tekton.dev/target-namespace: "\\ .TargetNamespace //"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      target_branch == "\\ .TargetBranch //" && event == "\\ .TargetEvent //"
+spec:
+  pipelineSpec:
+    tasks:
+      - name: cel-string-join-test
+        taskSpec:
+          steps:
+            - name: test-cel-string-join-values
+              image: registry.access.redhat.com/ubi10/ubi-micro
+              script: |
+                echo "{{ cel: files.all.join(", ") }}"
+                exit 0