Add D601 Tekton CI

2026-05-17 03:22:55 +00:00
parent 857b4bc298
commit 1cafe6da6a
12 changed files with 1309 additions and 1 deletions
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: unidesk-tekton-install
+  namespace: unidesk
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+data:
+  pipelineVersion: "v1.12.0"
+  triggersVersion: "v0.34.0"
+  pipelineReleaseUrl: "https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.12.0/release.yaml"
+  triggersReleaseUrl: "https://infra.tekton.dev/tekton-releases/triggers/previous/v0.34.0/release.yaml"
+  triggersInterceptorsReleaseUrl: "https://infra.tekton.dev/tekton-releases/triggers/previous/v0.34.0/interceptors.yaml"
@@ -0,0 +1,590 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: unidesk-ci
+  labels:
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/purpose: ci
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: unidesk-ci-runner
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: unidesk-ci-runner
+  namespace: unidesk-ci
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "services"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - apiGroups: ["tekton.dev"]
+    resources: ["pipelineruns", "taskruns"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - apiGroups: ["triggers.tekton.dev"]
+    resources: ["eventlisteners", "triggers", "triggerbindings", "triggertemplates", "interceptors"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: unidesk-ci-runner
+  namespace: unidesk-ci
+subjects:
+  - kind: ServiceAccount
+    name: unidesk-ci-runner
+    namespace: unidesk-ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: unidesk-ci-runner
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: unidesk-ci-trigger-reader
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+rules:
+  - apiGroups: ["triggers.tekton.dev"]
+    resources: ["clusterinterceptors", "clustertriggerbindings"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: unidesk-ci-trigger-reader
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+subjects:
+  - kind: ServiceAccount
+    name: unidesk-ci-runner
+    namespace: unidesk-ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: unidesk-ci-trigger-reader
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: unidesk-ci-cross-namespace
+  namespace: unidesk
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: unidesk-ci-cross-namespace
+  namespace: unidesk
+subjects:
+  - kind: ServiceAccount
+    name: unidesk-ci-runner
+    namespace: unidesk-ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: unidesk-ci-cross-namespace
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: unidesk-ci-cache
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: unidesk-ci-budgets
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+data:
+  firstPaintMs: "2000"
+  traceSummaryMs: "700"
+  traceStepsMs: "900"
+  traceStepDetailMs: "700"
+  overviewP95Ms: "900"
+---
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: unidesk-repo-check
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/component: repo-check
+spec:
+  params:
+    - name: repo-url
+      type: string
+    - name: revision
+      type: string
+    - name: image
+      type: string
+      default: unidesk-code-queue:d601
+  workspaces:
+    - name: source
+  volumes:
+    - name: docker-sock
+      hostPath:
+        path: /var/run/docker.sock
+        type: Socket
+  steps:
+    - name: clone
+      image: alpine/git:2.45.2
+      env:
+        - name: HTTP_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: HTTPS_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: ALL_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: NO_PROXY
+          value: "localhost,127.0.0.1,::1,ci-git-mirror,ci-git-mirror.unidesk-ci,ci-git-mirror.unidesk-ci.svc,ci-git-mirror.unidesk-ci.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local"
+        - name: http_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: https_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: all_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: no_proxy
+          value: "localhost,127.0.0.1,::1,ci-git-mirror,ci-git-mirror.unidesk-ci,ci-git-mirror.unidesk-ci.svc,ci-git-mirror.unidesk-ci.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local"
+      script: |
+        #!/bin/sh
+        set -eu
+        rm -rf "$(workspaces.source.path)/repo"
+        git clone --filter=blob:none "$(params.repo-url)" "$(workspaces.source.path)/repo"
+        cd "$(workspaces.source.path)/repo"
+        git fetch --depth=1 origin "$(params.revision)"
+        git checkout --detach FETCH_HEAD
+        git rev-parse HEAD | tee "$(workspaces.source.path)/commit.txt"
+    - name: install-and-check
+      image: "$(params.image)"
+      env:
+        - name: DOCKER_HOST
+          value: unix:///var/run/docker.sock
+        - name: BUN_INSTALL_CACHE_DIR
+          value: "$(workspaces.source.path)/cache/bun"
+        - name: HTTP_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: HTTPS_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: ALL_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: NO_PROXY
+          value: "localhost,127.0.0.1,::1,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local"
+        - name: http_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: https_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: all_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: no_proxy
+          value: "localhost,127.0.0.1,::1,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local"
+      volumeMounts:
+        - name: docker-sock
+          mountPath: /var/run/docker.sock
+      script: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        cd "$(workspaces.source.path)/repo"
+        command -v bun
+        command -v git
+        command -v docker
+        docker compose version >/dev/null
+        bun install --frozen-lockfile
+        (cd src && bun install --frozen-lockfile)
+        bun scripts/cli.ts check
+---
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: unidesk-code-queue-read-perf
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/component: code-queue-performance
+spec:
+  params:
+    - name: revision
+      type: string
+    - name: app-image
+      type: string
+      default: unidesk-code-queue:d601
+  workspaces:
+    - name: source
+  steps:
+    - name: start-read-service
+      image: "$(params.app-image)"
+      env:
+        - name: HTTP_PROXY
+          value: ""
+        - name: HTTPS_PROXY
+          value: ""
+        - name: ALL_PROXY
+          value: ""
+        - name: NO_PROXY
+          value: "localhost,127.0.0.1,::1,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"
+        - name: http_proxy
+          value: ""
+        - name: https_proxy
+          value: ""
+        - name: all_proxy
+          value: ""
+        - name: no_proxy
+          value: "localhost,127.0.0.1,::1,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"
+      script: |
+        #!/bin/bash
+        set -euo pipefail
+        kube_api="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
+        kube_token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
+        kube_ca="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+        kube_namespace="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
+        kube() {
+          local method="$1"
+          shift
+          curl -fsS --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" -X "$method" "$@"
+        }
+        cat >/tmp/code-queue-ci-read-deployment.yaml <<YAML
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: code-queue-ci-read
+          namespace: unidesk-ci
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: ci-read
+            app.kubernetes.io/part-of: unidesk
+            unidesk.ai/ci-revision: "$(params.revision)"
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app.kubernetes.io/name: code-queue
+              app.kubernetes.io/component: ci-read
+          template:
+            metadata:
+              labels:
+                app.kubernetes.io/name: code-queue
+                app.kubernetes.io/component: ci-read
+                app.kubernetes.io/part-of: unidesk
+                unidesk.ai/node-id: D601
+            spec:
+              nodeSelector:
+                unidesk.ai/node-id: D601
+              terminationGracePeriodSeconds: 10
+              containers:
+                - name: code-queue
+                  image: "$(params.app-image)"
+                  imagePullPolicy: IfNotPresent
+                  ports:
+                    - name: http
+                      containerPort: 4222
+                  envFrom:
+                    - secretRef:
+                        name: code-queue-env
+                        optional: true
+                  env:
+                    - name: HOST
+                      value: "0.0.0.0"
+                    - name: PORT
+                      value: "4222"
+                    - name: DATABASE_URL
+                      value: "postgres://unidesk:unidesk_dev_password@d601-tcp-egress-gateway.unidesk.svc.cluster.local:15432/unidesk"
+                    - name: CODE_QUEUE_INSTANCE_ID
+                      value: "CI-read"
+                    - name: CODE_QUEUE_SERVICE_ROLE
+                      value: "read"
+                    - name: CODE_QUEUE_SCHEDULER_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+                      value: "true"
+                    - name: CODE_QUEUE_EGRESS_PROXY_URL
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: CODE_QUEUE_EGRESS_PROXY_NO_PROXY
+                      value: "localhost,127.0.0.1,::1,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+                    - name: HTTP_PROXY
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: HTTPS_PROXY
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: ALL_PROXY
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: NO_PROXY
+                      value: "localhost,127.0.0.1,::1,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+                    - name: http_proxy
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: https_proxy
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: all_proxy
+                      value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+                    - name: no_proxy
+                      value: "localhost,127.0.0.1,::1,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,backend-core,oa-event-flow,database,hyueapi.com,.hyueapi.com"
+                    - name: CODE_QUEUE_DATA_DIR
+                      value: "/var/lib/unidesk/code-queue-ci"
+                    - name: CODE_QUEUE_WORKDIR
+                      value: "/workspace"
+                    - name: CODE_QUEUE_CODEX_HOME
+                      value: "/var/lib/unidesk/code-queue-ci/codex-home"
+                    - name: CODE_QUEUE_OPENCODE_XDG_DIR
+                      value: "/var/lib/unidesk/code-queue-ci/opencode-xdg"
+                    - name: CODE_QUEUE_DEFAULT_MODEL
+                      value: "gpt-5.5"
+                    - name: CODE_QUEUE_MODELS
+                      value: "gpt-5.5,gpt-5.4-mini,gpt-5.4,minimax-m2.7"
+                    - name: CODE_QUEUE_DATABASE_POOL_MAX
+                      value: "2"
+                    - name: CODE_QUEUE_IN_MEMORY_OUTPUT_RECORDS
+                      value: "5"
+                    - name: CODE_QUEUE_IN_MEMORY_EVENT_RECORDS
+                      value: "5"
+                    - name: OA_EVENT_FLOW_BASE_URL
+                      value: "http://d601-tcp-egress-gateway.unidesk.svc.cluster.local:4255"
+                    - name: LOG_FILE
+                      value: "/var/log/unidesk/code-queue-ci-read.jsonl"
+                    - name: NODE_OPTIONS
+                      value: "--max-old-space-size=512"
+                  readinessProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 20
+                  livenessProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 10
+                    timeoutSeconds: 3
+                    failureThreshold: 6
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 256Mi
+                    limits:
+                      memory: 1Gi
+                  volumeMounts:
+                    - name: state
+                      mountPath: /var/lib/unidesk/code-queue-ci
+                    - name: logs
+                      mountPath: /var/log/unidesk
+              volumes:
+                - name: state
+                  emptyDir: {}
+                - name: logs
+                  emptyDir: {}
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: code-queue-ci-read
+          namespace: unidesk-ci
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: ci-read
+            app.kubernetes.io/part-of: unidesk
+        spec:
+          type: ClusterIP
+          selector:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: ci-read
+          ports:
+            - name: http
+              port: 4222
+              targetPort: http
+        YAML
+        csplit -s -f /tmp/code-queue-ci-read- /tmp/code-queue-ci-read-deployment.yaml '/^---$/' '{*}'
+        kube PATCH \
+          -H "Content-Type: application/apply-patch+yaml" \
+          --data-binary @/tmp/code-queue-ci-read-00 \
+          "$kube_api/apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH \
+          -H "Content-Type: application/apply-patch+yaml" \
+          --data-binary @/tmp/code-queue-ci-read-01 \
+          "$kube_api/api/v1/namespaces/$kube_namespace/services/code-queue-ci-read?fieldManager=unidesk-ci&force=true" >/dev/null
+        deadline=$((SECONDS + 180))
+        while [ "$SECONDS" -lt "$deadline" ]; do
+          status="$(kube GET "$kube_api/apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read")"
+          replicas="$(printf '%s' "$status" | jq -r '.spec.replicas // 1')"
+          available="$(printf '%s' "$status" | jq -r '.status.availableReplicas // 0')"
+          updated="$(printf '%s' "$status" | jq -r '.status.updatedReplicas // 0')"
+          observed="$(printf '%s' "$status" | jq -r '.status.observedGeneration // 0')"
+          generation="$(printf '%s' "$status" | jq -r '.metadata.generation // 0')"
+          if [ "$available" -ge "$replicas" ] && [ "$updated" -ge "$replicas" ] && [ "$observed" -ge "$generation" ]; then
+            echo "code_queue_ci_read_rollout=available replicas=$available generation=$generation"
+            exit 0
+          fi
+          sleep 2
+        done
+        echo "code_queue_ci_read_rollout=timeout" >&2
+        kube GET "$kube_api/apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read" >&2
+        exit 1
+    - name: measure
+      image: "$(params.app-image)"
+      workingDir: "$(workspaces.source.path)/repo"
+      env:
+        - name: CI_CODE_QUEUE_URL
+          value: "http://code-queue-ci-read.unidesk-ci.svc.cluster.local:4222"
+        - name: HTTP_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: HTTPS_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: ALL_PROXY
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: NO_PROXY
+          value: "localhost,127.0.0.1,::1,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local"
+        - name: http_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: https_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: all_proxy
+          value: "http://d601-provider-egress-proxy.unidesk.svc.cluster.local:18789"
+        - name: no_proxy
+          value: "localhost,127.0.0.1,::1,code-queue-ci-read,code-queue-ci-read.unidesk-ci,code-queue-ci-read.unidesk-ci.svc,code-queue-ci-read.unidesk-ci.svc.cluster.local,d601-tcp-egress-gateway,d601-tcp-egress-gateway.unidesk,d601-tcp-egress-gateway.unidesk.svc,d601-tcp-egress-gateway.unidesk.svc.cluster.local,d601-provider-egress-proxy,d601-provider-egress-proxy.unidesk,d601-provider-egress-proxy.unidesk.svc,d601-provider-egress-proxy.unidesk.svc.cluster.local"
+        - name: FIRST_PAINT_BUDGET_MS
+          valueFrom:
+            configMapKeyRef:
+              name: unidesk-ci-budgets
+              key: firstPaintMs
+        - name: TRACE_SUMMARY_BUDGET_MS
+          valueFrom:
+            configMapKeyRef:
+              name: unidesk-ci-budgets
+              key: traceSummaryMs
+        - name: TRACE_STEPS_BUDGET_MS
+          valueFrom:
+            configMapKeyRef:
+              name: unidesk-ci-budgets
+              key: traceStepsMs
+        - name: TRACE_STEP_DETAIL_BUDGET_MS
+          valueFrom:
+            configMapKeyRef:
+              name: unidesk-ci-budgets
+              key: traceStepDetailMs
+        - name: OVERVIEW_P95_BUDGET_MS
+          valueFrom:
+            configMapKeyRef:
+              name: unidesk-ci-budgets
+              key: overviewP95Ms
+      script: |
+        #!/usr/bin/env bash
+        set -euo pipefail
+        bun scripts/ci-code-queue-read-perf.ts
+    - name: cleanup
+      image: "$(params.app-image)"
+      env:
+        - name: HTTP_PROXY
+          value: ""
+        - name: HTTPS_PROXY
+          value: ""
+        - name: ALL_PROXY
+          value: ""
+        - name: NO_PROXY
+          value: "localhost,127.0.0.1,::1,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"
+        - name: http_proxy
+          value: ""
+        - name: https_proxy
+          value: ""
+        - name: all_proxy
+          value: ""
+        - name: no_proxy
+          value: "localhost,127.0.0.1,::1,kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local"
+      script: |
+        #!/bin/bash
+        set -euo pipefail
+        kube_api="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
+        kube_token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
+        kube_ca="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+        kube_namespace="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)"
+        delete_resource() {
+          local path="$1"
+          local code
+          code="$(curl -sS -o /tmp/unidesk-ci-delete-response -w "%{http_code}" --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" -X DELETE "$kube_api/$path")"
+          if [ "$code" = "200" ] || [ "$code" = "202" ] || [ "$code" = "404" ]; then
+            return 0
+          fi
+          cat /tmp/unidesk-ci-delete-response >&2
+          return 1
+        }
+        delete_resource "apis/apps/v1/namespaces/$kube_namespace/deployments/code-queue-ci-read"
+        delete_resource "api/v1/namespaces/$kube_namespace/services/code-queue-ci-read"
+---
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: unidesk-ci
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/part-of: unidesk
+spec:
+  params:
+    - name: repo-url
+      type: string
+      default: https://github.com/pikasTech/unidesk
+    - name: revision
+      type: string
+    - name: check-image
+      type: string
+      default: unidesk-code-queue:d601
+    - name: code-queue-image
+      type: string
+      default: unidesk-code-queue:d601
+  workspaces:
+    - name: shared-workspace
+  tasks:
+    - name: repo-check
+      taskRef:
+        name: unidesk-repo-check
+      params:
+        - name: repo-url
+          value: "$(params.repo-url)"
+        - name: revision
+          value: "$(params.revision)"
+        - name: image
+          value: "$(params.check-image)"
+      workspaces:
+        - name: source
+          workspace: shared-workspace
+    - name: code-queue-read-perf
+      runAfter:
+        - repo-check
+      taskRef:
+        name: unidesk-code-queue-read-perf
+      params:
+        - name: revision
+          value: "$(params.revision)"
+        - name: app-image
+          value: "$(params.code-queue-image)"
+      workspaces:
+        - name: source
+          workspace: shared-workspace
@@ -0,0 +1,80 @@
+apiVersion: triggers.tekton.dev/v1beta1
+kind: EventListener
+metadata:
+  name: unidesk-ci
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/component: triggers
+    app.kubernetes.io/part-of: unidesk
+spec:
+  serviceAccountName: unidesk-ci-runner
+  triggers:
+    - name: github-push
+      interceptors:
+        - ref:
+            name: cel
+          params:
+            - name: filter
+              value: >-
+                body.ref.startsWith('refs/heads/') &&
+                body.after.matches('^[0-9a-f]{40}$')
+      bindings:
+        - ref: unidesk-ci-github-push
+      template:
+        ref: unidesk-ci
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerBinding
+metadata:
+  name: unidesk-ci-github-push
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/component: triggers
+    app.kubernetes.io/part-of: unidesk
+spec:
+  params:
+    - name: repo-url
+      value: $(body.repository.clone_url)
+    - name: revision
+      value: $(body.after)
+---
+apiVersion: triggers.tekton.dev/v1beta1
+kind: TriggerTemplate
+metadata:
+  name: unidesk-ci
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-ci
+    app.kubernetes.io/component: triggers
+    app.kubernetes.io/part-of: unidesk
+spec:
+  params:
+    - name: repo-url
+      default: https://github.com/pikasTech/unidesk
+    - name: revision
+  resourcetemplates:
+    - apiVersion: tekton.dev/v1
+      kind: PipelineRun
+      metadata:
+        generateName: unidesk-ci-
+        namespace: unidesk-ci
+        labels:
+          app.kubernetes.io/name: unidesk-ci
+          app.kubernetes.io/part-of: unidesk
+          unidesk.ai/revision: $(tt.params.revision)
+      spec:
+        pipelineRef:
+          name: unidesk-ci
+        taskRunTemplate:
+          serviceAccountName: unidesk-ci-runner
+        params:
+          - name: repo-url
+            value: $(tt.params.repo-url)
+          - name: revision
+            value: $(tt.params.revision)
+        workspaces:
+          - name: shared-workspace
+            persistentVolumeClaim:
+              claimName: unidesk-ci-cache