The PipelineRun executor does not properly validate referenced volumes before the PipelineRun is created.
validateExecutorVolumes calls GetUnderlyingTaskRuns on the newly generated PipelineRun. Since the PipelineRun hasn't been created yet, it has no Status.ChildReferences, so GetUnderlyingTaskRuns returns an empty list.
As a result, the volume existence check is skipped entirely for the PipelineRun executor path.
This means a Build referencing a missing Secret or ConfigMap can proceed to create the PipelineRun instead of getting the VolumeDoesNotExist condition early. The failure is then left for Tekton to surface later, making the problem harder to understand.
Suggested fix: For the PipelineRun executor, validate the volumes directly from PipelineRun.Spec.PipelineSpec.Tasks[*].TaskSpec.Volumes before creating the PipelineRun, rather than relying on GetUnderlyingTaskRuns.
The PipelineRun executor does not properly validate referenced volumes before the PipelineRun is created.
validateExecutorVolumescallsGetUnderlyingTaskRunson the newly generated PipelineRun. Since the PipelineRun hasn't been created yet, it has noStatus.ChildReferences, soGetUnderlyingTaskRunsreturns an empty list.As a result, the volume existence check is skipped entirely for the PipelineRun executor path.
This means a Build referencing a missing Secret or ConfigMap can proceed to create the PipelineRun instead of getting the
VolumeDoesNotExistcondition early. The failure is then left for Tekton to surface later, making the problem harder to understand.Suggested fix: For the PipelineRun executor, validate the volumes directly from
PipelineRun.Spec.PipelineSpec.Tasks[*].TaskSpec.Volumesbefore creating the PipelineRun, rather than relying onGetUnderlyingTaskRuns.