Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.38.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a5f36a3287f15f9acfe297c03b126ee9726e270cf1ad80268532062d7a514d2ca

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a5f36a3287f15f9acfe297c03b126ee9726e270cf1ad80268532062d7a514d2ca
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

VERSION_TAG=v0.38.0
RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.38.0/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/${VERSION_TAG}/interceptors.yaml
REKOR_UUID=108e9186e8c5677a5f36a3287f15f9acfe297c03b126ee9726e270cf1ad80268532062d7a514d2ca

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.38.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml
curl -L "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

✨ Add GitLab interceptor support for signing tokens. (#2151)

The GitLab interceptor can validate GitLab 19+ signing tokens via an optional signingSecretRef (Standard Webhooks HMAC-SHA256). Existing secretRef secret-token checks still work. When both are set, either a valid signature or a valid X-Gitlab-Token is enough, so that you can migrate without downtime.

✨ Add a request body size limit to the EventListener sink (#2143)

Breaking:
The EventListener sink now rejects event requests whose body exceeds a configurable limit with 413 Request Entity Too Large. The limit is set by the new controller flag -el-max-body-size (bytes, default 3145728 = 3 MiB); set it to 0 to keep the previous unbounded behaviour.

Fixes

🐛 Drop cluster-scoped resources from tekton-triggers-aggregate-edit (#2131)

action required: The tekton-triggers-aggregate-edit ClusterRole (aggregated into the built-in edit and admin roles) no longer grants write access to the cluster-scoped clusterinterceptors and clustertriggerbindings resources. Read access via tekton-triggers-aggregate-view is unchanged. Users who relied on a ClusterRoleBinding to edit/admin to manage ClusterInterceptors or ClusterTriggerBindings must be granted a dedicated ClusterRole explicitly. Namespace-scoped RoleBindings are unaffected.

🐛 Update koExtraArgs value from release.yaml (#2177)
🐛 chore(codegen): update codegen for new Core Interceptors Config (#2128)

Misc

🔨 Update ko image to a new SHA256 digest (#2262)
🔨 fix(deps): prefix release PR titles with branch (#2252)
🔨 chore(deps): bump zizmorcore/zizmor-action from 0.8.0 to 0.8.1 (#2229)
🔨 fix(deps): remove unsupported Actions cooldowns (#2213)
🔨 fix(deps): migrate CEL to cel.dev module path (#2211)
🔨 fix(deps): restore compatibility after dependency updates (#2209)
🔨 chore(ci): update CodeQL actions to v4.39.1 (#2208)
🔨 chore(deps): bump step-security/harden-runner from 2.22.1 to 2.22.3 (#2207)
🔨 chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 (#2206)
🔨 chore(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#2204)
🔨 chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 (#2201)
🔨 chore(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 (#2188)
🔨 chore(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 (#2184)
🔨 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#2183)
🔨 Remove koExtraArgs value from release-patch.yaml (#2182)
🔨 chore(deps): bump fgrosse/go-coverage-report from 1.3.1 to 1.4.0 (#2157)
🔨 chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 (#2149)
🔨 fix(ci): group github/codeql-action/* dependabot updates (#2138)
🔨 fix(ci): bump codeql-action init and analyze to v4.38.0 (#2137)
🔨 chore(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (#2135)
🔨 chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#2132)
🔨 Bump step-security/harden-runner from 2.21.0 to 2.21.1 (#2124)
🔨 Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#2122)
🔨 Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#2121)
🔨 Bump github/codeql-action/init from 4.37.6 to 4.37.9 (#2119)
🔨 Bump github/codeql-action/analyze from 4.37.6 to 4.37.9 (#2118)
🔨 Bump github/codeql-action/autobuild from 4.37.7 to 4.37.9 (#2117)
🔨 Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#2115)
🔨 Bump github/codeql-action/autobuild from 4.37.6 to 4.37.7 (#2110)
🔨 Bump step-security/harden-runner from 2.20.1 to 2.21.0 (#2107)
🔨 Bump actions/checkout from 7.0.0 to 7.0.1 (#2105)
🔨 Skip e2e tests when only non-e2e workflow files change (#2102)
🔨 Fix codecov ignore patterns to align with coverage dashboard (#2101)
🔨 Bump step-security/harden-runner from 2.20.0 to 2.20.1 (#2100)
🔨 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#2099)
🔨 Regenerate dependabot.yml configuration (#2097)
🔨 Bump fgrosse/go-coverage-report from 1.3.0 to 1.3.1 (#2090)
🔨 Bump actions/checkout from 7.0.0 to 7.0.1 (#2089)
🔨 Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#2088)
🔨 Bump actions/setup-go from 6.5.0 to 7.0.0 (#2086)
🔨 Add automatic GitHub draft release creation (#2171)
🔨 Update releases.md for v0.37.0 (#2094)
🔨 Add PAC release automation (#2062)
🔨 test: add e2e test for OpenCensus to OpenTelemetry metrics migration (#2055)

Docs

Thanks

Thanks to these contributors who contributed to v0.38.0!

❤️ @KR-Ravindra
❤️ @aThorp96
❤️ @app/dependabot
❤️ @jessesightler-redhat
❤️ @khrm
❤️ @rajnish-jais
❤️ @savitaashture
❤️ @tekton-robot
❤️ @vdemeester

Extra shout-out for awesome release notes:

tektoncd/triggers v0.38.0 Tekton Triggers release v0.38.0 "Tekton Triggers" on GitHub