tektoncd/triggers v0.35.1 on GitHub

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.1/release.yaml
kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.1/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677afcbbd2fbbeb11137aa3b20516853ad8927ca19f4009f533f8669a1749ef4221b

Obtain the attestation:

REKOR_UUID=108e9186e8c5677afcbbd2fbbeb11137aa3b20516853ad8927ca19f4009f533f8669a1749ef4221b
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.1/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.1/interceptors.yaml
REKOR_UUID=108e9186e8c5677afcbbd2fbbeb11137aa3b20516853ad8927ca19f4009f533f8669a1749ef4221b

REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.35.1@sha256:" + .digest.sha256')

curl -L "$RELEASE_FILE" > release.yaml
curl "$INTERCEPTORS_FILE" >> release.yaml

for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Patch release on top of v0.35.0.

Fixes

🐛 fix(github): require SecretRef for GitHub interceptor to process requests
Action Required: Users using the GitHub Interceptor must ensure the interceptor uses a secretRef.
🐛 fix(cve): Fix critical and important CVEs
🐛 fix: Skip GitHub API-dependent examples in e2e tests
🐛 fix: bump pinned plumbing precheck revision to fix alpine/git pull
🐛 fix: bump pinned ko image to fix go toolchain mismatch
🐛 fix: cp instead of symlink source tarball into kodata

Features

✨ feat: add enterprise host allowlist for GitHub interceptor

Misc

bump(deps): bump tektoncd/pipeline and google.golang.org/grpc to fix CVEs
fix: pass --insecure-registry to ko for plain-HTTP KinD registry
fix: replace kodata LICENSE symlinks with actual files

This release was created manually; automated GitHub draft release creation for triggers is being added in #2171.

tektoncd/triggers v0.35.1 Tekton Triggers release v0.35.1 on GitHub