github tektoncd/pipeline v1.18.0
Tekton Pipeline release v1.18.0 "Ukrainian Levkoy Ultron LTS"
on GitHub

2 hours ago

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.18.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109

Obtain the attestation: 

REKOR_UUID=108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file: 

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.18.0/release.yaml
REKOR_UUID=108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.18.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

  • ✨ Add option continueAndFail on step.onError (#10536)

Step onError now supports continueAndFail, which continues executing subsequent steps but fails the TaskRun after all steps complete.

Fixes

  • 🐛 release: set SOURCE_DATE_EPOCH so published images get a real creation timestamp (#10860)

Published images now carry a real creation timestamp (the release commit's), instead of inheriting the base image's.

  • 🐛 fix: Make controller-managed labels immutable via webhook (#10687)

Controller-managed labels (tekton.dev/pipeline, tekton.dev/pipelineTask, tekton.dev/pipelineRun) are now immutable once set and cannot be changed by users updating a PipelineRun or TaskRun.

  • 🐛 fix: bump plumbing ko image to Go 1.27.3 (#10937)

  • 🐛 fix: Fix truncation of large Tekton bundles resolved from OCI images, which could cause the bundle to fail to parse. (#10395)

  • 🐛 fix early PVC cleanup for pipelines-in-pipelines child-pipelines (#9727)

Misc

  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.40 to 1.6.41 (#10935)
  • 🔨 build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#10934)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.39 to 1.6.41 (#10933)
  • 🔨 build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#10932)
  • 🔨 build(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#10931)
  • 🔨 build(deps): bump the codeql-action group with 3 updates (#10930)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#10921)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.16.6 to 1.17.1 (#10913)
  • 🔨 build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 (#10908)
  • 🔨 build(deps): bump agilepathway/label-checker from 2.0.0 to 2.0.5 (#10906)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.39 to 1.6.40 (#10905)
  • 🔨 build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 (#10904)
  • 🔨 build(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 (#10903)
  • 🔨 build(deps): bump the codeql-action group with 3 updates (#10902)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#10892)
  • 🔨 build(deps): bump github.com/prometheus/common from 0.72.0 to 0.72.1 (#10886)
  • 🔨 build(deps): bump github.com/spiffe/go-spiffe/v2 from 2.8.2 to 2.9.0 (#10883)
  • 🔨 build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#10881)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.37 to 1.6.39 (#10878)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.39 (#10877)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.16.5 to 1.16.6 (#10868)
  • 🔨 build(deps): bump the all group in /tekton with 5 updates (#10867)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.16.0 to 1.17.0 in /test/custom-task-ctrls/wait-task-beta (#10865)
  • 🔨 build(deps): bump github.com/prometheus/common from 0.71.0 to 0.72.0 (#10858)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.16.4 to 1.16.5 (#10856)
  • 🔨 build(deps): bump fgrosse/go-coverage-report from 1.3.1 to 1.4.0 (#10844)
  • 🔨 build(deps): bump chainguard-dev/actions/kind-diag from 1.6.36 to 1.6.37 (#10843)
  • 🔨 build(deps): bump agilepathway/label-checker from 1.6.98 to 2.0.0 (#10842)
  • 🔨 build(deps): bump chainguard-dev/actions/setup-kind from 1.6.36 to 1.6.37 (#10841)
  • 🔨 build(deps): bump the codeql-action group with 3 updates (#10840)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.16.3 to 1.16.4 (#10839)
  • 🔨 build(deps): bump the all group in /tekton with 5 updates (#10838)

Docs

  • 📖 Fix typos and grammatical errors in api-spec.md (#10863)
  • 📖 docs: add v1.17.0 release entry, move v1.16 to EOL (#10837)

Thanks

Thanks to these contributors who contributed to v1.18.0!

Extra shout-out for awesome release notes:

Check out latest releases or
releases around tektoncd/pipeline v1.18.0

Don't miss a new pipeline release

NewReleases is sending notifications on new releases.

Get notifications