TEP-0165: Ordering Finally Tasks with runAfterAlways

[jangel97]

Summary

This TEP proposes a new field runAfterAlways for finally tasks that enables ordering between finally tasks without breaking the guaranteed-execution contract.

Unlike runAfter (which implies dependency and can skip downstream tasks on failure), runAfterAlways means "wait for the referenced task to complete — regardless of success or failure — then run unconditionally."

Motivation

Today, all finally tasks execute in parallel. While this was a deliberate design decision, there are legitimate use cases where ordering is needed — not dependency, just sequencing. Current workarounds (merging tasks, chaining pipelines via Triggers, polling shared workspaces) are complex, fragile, or sacrifice task reusability.

Use Cases

• Infrastructure cleanup then notification: Destroy cloud VMs first, then send a notification that can report failed pipeline and whether cleanup succeeded. This implies a sequential final workflow.
• Multi-stage cleanup: Teardown interdependent resources in reverse order (load balancer → cache → database)
• Audit logging: Run an audit task last to capture the status of all other finally tasks

Key Design Decisions

• runAfterAlways only valid in spec.finally (validation rejects it on regular tasks)
• Referenced tasks must be other finally tasks
• Task executes unconditionally after predecessors reach terminal state (succeeded, failed, or skipped)
• No cycles allowed
• Existing runAfter remains forbidden in finally blocks
• Fully backward compatible

Related: tektoncd/pipeline#6919

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign sm43 after the PR has been reviewed.
You can assign the PR to them by writing /assign @sm43 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• teps/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: jangel97 / name: Jose Angel Morena (0590d40)

[tekton-robot]

@jangel97: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.