fix: isolate PaC validation by selected consumer

scripts/src/platform-infra-pipelines-as-code-source-artifact.ts

@@ -428,7 +428,7 @@ export function renderPacSourceArtifactResult(result: Record<string, unknown>):
     `embedded=status:${text(embedded?.status)} name:${text(embedded?.name)} hash:${shortSha(embedded?.canonicalSha256)} provenance:${text(embedded?.provenanceAligned)} drift:${formatDrift(embeddedDrift)}`,
     `runtimeReason=live:${text(live?.reason)} embedded:${text(embedded?.reason)}`,
     `written=${Array.isArray(files.written) && files.written.length > 0 ? files.written.join(",") : "-"}`,
-    ...warnings.map((warning) => `warning=consumer:${text(warning.consumer)} blocking:${text(warning.blocking)} code:${text(warning.code)} config:${text(warning.configPath)}`),
+    ...warnings.map((warning) => `warning=object:${text(record(warning.object).kind)}:${text(record(warning.object).id)} blocking:${text(warning.blocking)} code:${text(warning.code)} config:${text(warning.configPath)}`),
   ];
   if (typeof result.next === "string") lines.push(`next=${result.next}`);
   return renderedCliResult(result.ok !== false, String(result.action), `${lines.join("\n")}\n`);
@@ -645,6 +645,7 @@ function copySourceWorktreeForRender(sourceWorktree: string, destination: string
 }
 
 function embeddedPipelineRun(binding: PacSourceArtifactBinding, desiredSpec: Record<string, unknown>, provenance: PacSourceArtifactProvenance): Record<string, unknown> {
+  const workspaces = pipelineRunWorkspaces(binding, desiredSpec);
   return {
     apiVersion: "tekton.dev/v1",
     kind: "PipelineRun",
@@ -666,13 +667,14 @@ function embeddedPipelineRun(binding: PacSourceArtifactBinding, desiredSpec: Rec
       pipelineSpec: desiredSpec,
       taskRunTemplate: taskRunTemplate(binding),
       params: pipelineRunParams(binding, desiredSpec),
-      workspaces: pipelineRunWorkspaces(binding, desiredSpec),
+      ...optionalPipelineRunWorkspaces(workspaces),
     },
   };
 }
 
 function remotePipelineRun(binding: PacSourceArtifactBinding, pipeline: Record<string, unknown>, provenance: PacSourceArtifactProvenance): Record<string, unknown> {
   const desiredSpec = requiredRecord(pipeline.spec, "rendered Pipeline.spec");
+  const workspaces = pipelineRunWorkspaces(binding, desiredSpec);
   const pipelinePath = requiredString(binding.consumer.sourceArtifact.pipelinePath, "sourceArtifact.pipelinePath");
   const annotations = {
     ...pipelineRunAnnotations(binding, provenance),
@@ -706,12 +708,16 @@ function remotePipelineRun(binding: PacSourceArtifactBinding, pipeline: Record<s
       timeouts: { pipeline: binding.repository.params.pipeline_timeout },
       taskRunTemplate: taskRunTemplate(binding),
       pipelineRef: { name: binding.consumer.pipeline },
-      workspaces: pipelineRunWorkspaces(binding, desiredSpec),
+      ...optionalPipelineRunWorkspaces(workspaces),
       params: pipelineRunParams(binding, desiredSpec),
     },
   };
 }
 
+export function optionalPipelineRunWorkspaces(workspaces: readonly Record<string, unknown>[]): Record<string, unknown> {
+  return workspaces.length === 0 ? {} : { workspaces };
+}
+
 function pipelineRunAnnotations(binding: PacSourceArtifactBinding, provenance: PacSourceArtifactProvenance): Record<string, string> {
   const branch = requiredParam(binding, "source_branch");
   return {