github tektoncd/pipeline v1.15.0
Tekton Pipeline release v1.15.0 "Toyger Orisa" LTS
on GitHub

6 hours ago

🎉 Steady under pressure — configurable backoffs and battle-tested fixes 🎉

-Docs @ v1.15.0
-Examples @ v1.15.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.15.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a045c87c57225dfff98b32437f52b89e344c449bcd535b462d41fff9004b89d29

Obtain the attestation: 

REKOR_UUID=108e9186e8c5677a045c87c57225dfff98b32437f52b89e344c449bcd535b462d41fff9004b89d29
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file: 

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.15.0/release.yaml
REKOR_UUID=108e9186e8c5677a045c87c57225dfff98b32437f52b89e344c449bcd535b462d41fff9004b89d29

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.15.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

  • ✨ Add configuration for custom git resolver backoff (#10422)

Enables the configuration of backoffs for git resolver requests.

  • ✨ feat: add configurable grace period for transient CreateContainerError (#10326)

Add default-create-container-error-timeout configuration option in config-defaults to provide a grace period before failing TaskRuns on transient CreateContainerError/CreateContainerConfigError with "context deadline exceeded". Default is 0 (fail fast, preserving existing behavior)

Fixes

  • 🐛 fix(resolutionrequest): preserve resolver-written status fields (#10487)

Prevent ResolutionRequest lifecycle updates from overwriting resolver-written status fields.

  • 🐛 fix(resolvers): honor leader-election bucket ownership (#10480)

Fix resolver replicas processing ResolutionRequests outside their leader-election bucket.

  • 🐛 Prevent matrix combination count int overflow (#10431)

Fixed an integer overflow in matrix combination counting that could let a very
large matrix bypass the max-matrix-combinations validation guard.

  • 🐛 Fix PipelineRun stuck in ResolvingTaskRef when ResolutionRequest enqueue is missed (#10429)

Fix PipelineRun remaining stuck in ResolvingTaskRef when a ResolutionRequest completion event is missed by periodically requeueing while remote resolution is in progress

  • 🐛 Fix RestrictLength panic on all-symbol input (#10421)

Fixed a panic in the PipelineRun controller when a PipelineRun using an embedded (anonymous) pipeline spec sets a generateName that contains no alphanumeric characters (for example --). Such names no longer crash the reconciler.

  • 🐛 Fix sidecar-logs result extraction for results exceeding 4096 bytes (#10403)

Fix sidecar-logs result extraction dropping all TaskRun results when a single result's JSON exceeds 4096 bytes but is within the configured max-result-size. Regression since v1.9.0.

  • 🐛 Preserve Sidecar RestartPolicy on API conversion (#10392)

Fixed a bug where a Sidecar's restartPolicy (native Kubernetes sidecar support)
was dropped when converting a Task or TaskRun between the v1beta1 and v1 API
versions, causing a sidecar requested as a native sidecar to be created as an
ordinary sidecar.

  • 🐛 Mount debug scripts read-only in step containers (#10362)

Debug breakpoint scripts are now mounted read-only in step containers, so a step can no longer overwrite them before a user execs in to continue or fail a breakpoint.

  • 🐛 fix(nightlies): restart webhook after CEL feature-flag patch (#10475)
  • 🐛 fix(deps): bump OTel SDK with knative.dev/pkg semconv alignment (#10447)
  • 🐛 fix(nightlies): skip draft-release tasks when releaseMode=nightly (#10441)
  • 🐛 Fix broken object param example links in API spec (#10397)
  • 🐛 fix: resolve in-toto attestation UUID in wait-for-chains (#10363)

Misc

  • 🔨 fix(release): copy vendor tarball into kodata instead of symlink (#10418)

Fix release pipeline ko resolve failure caused by ko >= v0.19.0 rejecting
the kodata/source.tar.gz symlink used to bundle vendored source.

  • 🔨 Add branch prefix to Dependabot PR titles for release branches (#10405)
  • 🔨 Fix wrong Deprecated godoc in affinity assistant (#10391)
  • 🔨 build(deps): bump github.com/prometheus/common from 0.70.0 to 0.70.1 (#10470)
  • 🔨 build(deps): bump the kubernetes group with 5 updates (#10469)
  • 🔨 build(deps): bump the kubernetes group across 1 directory with 3 updates (#10468)
  • 🔨 build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 (#10462)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.14.0 to 1.14.1 in /test/custom-task-ctrls/wait-task-beta (#10461)
  • 🔨 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#10456)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.26 to 1.6.27 (#10455)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 (#10454)
  • 🔨 build(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#10453)
  • 🔨 Ignore otel major/minor updates in dependabot (#10450)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#10446)
  • 🔨 ci(.github/workflows): enable Codecov coverage reporting (#10440)
  • 🔨 build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#10439)
  • 🔨 build(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 (#10437)
  • 🔨 build(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 (#10436)
  • 🔨 build(deps): bump github/codeql-action/init from 4.36.3 to 4.37.0 (#10435)
  • 🔨 build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 (#10434)
  • 🔨 build(deps): bump github.com/spiffe/spire-api-sdk from 1.15.1 to 1.15.2 (#10433)
  • 🔨 build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#10432)
  • 🔨 build(deps): bump github.com/google/cel-go from 0.29.1 to 0.29.2 (#10423)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.25 to 1.6.26 (#10417)
  • 🔨 build(deps): bump ko-build/setup-ko from 0.9 to 0.10 (#10416)
  • 🔨 build(deps): bump github.com/google/cel-go from 0.29.0 to 0.29.1 (#10415)
  • 🔨 build(deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 (#10413)
  • 🔨 build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 (#10412)
  • 🔨 build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#10411)
  • 🔨 build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 (#10410)
  • 🔨 build(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 (#10407)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.25 to 1.6.26 (#10406)
  • 🔨 build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#10404)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#10399)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.13.1 to 1.14.0 in /test/custom-task-ctrls/wait-task-beta (#10398)
  • 🔨 ci: fix mismatched setup-go version comment in dependabot-regen (#10389)
  • 🔨 build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#10384)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.24 to 1.6.25 (#10378)
  • 🔨 build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#10377)
  • 🔨 build(deps): bump actions/cache from 5.0.5 to 6.1.0 (#10376)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.24 to 1.6.25 (#10375)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#10374)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.15.30 to 1.15.31 (#10365)
  • 🔨 test: add e2e test for OpenCensus to OpenTelemetry metrics migration (#10355)
  • 🔨 [TEP-0056] Test ServiceAccount propagation in PinP (#10206)

Docs

  • 📖 Add PR template reminder to AGENTS.md (#10428)
  • 📖 Use folder-level symlinks for agent skill discovery (#10426)
  • 📖 Fix moved example links in pipeline docs (#10400)
  • 📖 docs: add v1.14.0 release to releases.md (#10364)
  • 📖 docs: add security threat model (#10313)
  • 📖 docs: document StepAction support in Hub Resolver (#10275)
  • 📖 docs(security): document workspace isolation across trust boundaries (#10241)

Thanks

Thanks to these contributors who contributed to v1.15.0!

Extra shout-out for awesome release notes:

Check out latest releases or
releases around tektoncd/pipeline v1.15.0

Don't miss a new pipeline release

NewReleases is sending notifications on new releases.

Get notifications