Workspaces can be volumes in the case of 'data' or scratch space, or they can be secrets in the case of being able to access K8s secrets within the CI path. These workspaces do need to be defined during PipelineRun, so secrets should be available too.
Also added tests for the pipeline run with workspaces. Just basic unit tests, but it was straight forward enough to copy the others.