diff --git a/go.mod b/go.mod index 00d2142c1f..5fcaed4224 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/spf13/pflag v1.0.10 github.com/tektoncd/chains v0.26.0 github.com/tektoncd/hub v1.22.2 - github.com/tektoncd/pipeline v1.3.1 + github.com/tektoncd/pipeline v1.3.4 github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 github.com/tektoncd/triggers v0.33.0 github.com/theupdateframework/go-tuf v0.7.0 diff --git a/go.sum b/go.sum index 3fe2e2d00c..e23d24bca6 100644 --- a/go.sum +++ b/go.sum @@ -1271,8 +1271,8 @@ github.com/tektoncd/chains v0.26.0 h1:TV4AyuMBb2/7TasVNePwLZLoZ8qKeju+j9RWpaPqkb github.com/tektoncd/chains v0.26.0/go.mod h1:0CmzkSfql6cltpKiiu6NHizPT+NPxHeGXHA+gV9Td9k= github.com/tektoncd/hub v1.22.2 h1:YqGs+c1umB7mZ3TlAiiwXNUxCBgn8zrIbHtNTMJlu0E= github.com/tektoncd/hub v1.22.2/go.mod h1:ZDTBuF/etOTcNBb2TNKhhLfTUErND6hd258owacg1sM= -github.com/tektoncd/pipeline v1.3.1 h1:GOp49pAMPCXYX1E/cSc2JAm7j4vEB68DOOhGkSoaAmI= -github.com/tektoncd/pipeline v1.3.1/go.mod h1:924mFZJC0FXYruna4kDisnfFnRowJQgRgLpJuGbjNPQ= +github.com/tektoncd/pipeline v1.3.4 h1:Y8XpHn9NQC7Xj4i6rritZAZ8X4MImhbhVBCVKE/5WxY= +github.com/tektoncd/pipeline v1.3.4/go.mod h1:W/lKN8J8skBVG7319wU56HJxnXcXunw9TMQr/u55bS4= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 h1:nv7BsOAZ1ifQX9Lw1hYFo1f7e62dTDyyVPJBuljgZKw= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1/go.mod h1:eDs4O8vTNkyKZ/+AEuo4nYDfpyn1AzbgIcQ1QMQaKJk= github.com/tektoncd/triggers v0.33.0 h1:pG2Kz/2FHjysGG4GGhiGp9hHdwA8BLZI3H7m9U9sj4M= diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/template.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/template.go index 5d23e967cb..71cecc33aa 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/template.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/template.go @@ -132,6 +132,18 @@ type Template struct { // +optional HostNetwork bool `json:"hostNetwork,omitempty"` + // HostUsers indicates whether the pod will use the host's user namespace. + // Optional: Default to true. + // If set to true or not present, the pod will be run in the host user namespace, useful + // for when the pod needs a feature only available to the host user namespace, such as + // loading a kernel module with CAP_SYS_MODULE. + // When set to false, a new user namespace is created for the pod. Setting false + // is useful to mitigating container breakout vulnerabilities such as allowing + // containers to run as root without their user having root privileges on the host. + // This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + // +optional + HostUsers *bool `json:"hostUsers,omitempty"` + // TopologySpreadConstraints controls how Pods are spread across your cluster among // failure-domains such as regions, zones, nodes, and other user-defined topology domains. // +optional @@ -229,6 +241,9 @@ func MergePodTemplateWithDefault(tpl, defaultTpl *PodTemplate) *PodTemplate { if !tpl.HostNetwork && defaultTpl.HostNetwork { tpl.HostNetwork = true } + if tpl.HostUsers == nil { + tpl.HostUsers = defaultTpl.HostUsers + } if tpl.TopologySpreadConstraints == nil { tpl.TopologySpreadConstraints = defaultTpl.TopologySpreadConstraints } diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/zz_generated.deepcopy.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/zz_generated.deepcopy.go index 350f3b7e1b..054c9e0346 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/zz_generated.deepcopy.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/pod/zz_generated.deepcopy.go @@ -153,6 +153,11 @@ func (in *Template) DeepCopyInto(out *Template) { (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.HostUsers != nil { + in, out := &in.HostUsers, &out.HostUsers + *out = new(bool) + **out = **in + } if in.TopologySpreadConstraints != nil { in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints *out = make([]v1.TopologySpreadConstraint, len(*in)) diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/container_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/container_validation.go index becf35411d..5167e8bb9b 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/container_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/container_validation.go @@ -20,6 +20,7 @@ import ( "context" "errors" "fmt" + "path/filepath" "regexp" "slices" "strings" @@ -197,8 +198,9 @@ func (s *Step) Validate(ctx context.Context) (errs *apis.FieldError) { } for j, vm := range s.VolumeMounts { - if strings.HasPrefix(vm.MountPath, "/tekton/") && - !strings.HasPrefix(vm.MountPath, "/tekton/home") { + cleanMountPath := filepath.Clean(vm.MountPath) + if strings.HasPrefix(cleanMountPath, "/tekton/") && + !strings.HasPrefix(cleanMountPath, "/tekton/home") { errs = errs.Also(apis.ErrGeneric(fmt.Sprintf("volumeMount cannot be mounted under /tekton/ (volumeMount %q mounted at %q)", vm.Name, vm.MountPath), "mountPath").ViaFieldIndex("volumeMounts", j)) } if strings.HasPrefix(vm.Name, "tekton-internal-") { diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/openapi_generated.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/openapi_generated.go index f8c9053b8f..46eab892bf 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/openapi_generated.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/openapi_generated.go @@ -369,6 +369,13 @@ func schema_pkg_apis_pipeline_pod_Template(ref common.ReferenceCallback) common. Format: "", }, }, + "hostUsers": { + SchemaProps: spec.SchemaProps{ + Description: "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + Type: []string{"boolean"}, + Format: "", + }, + }, "topologySpreadConstraints": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/pipelinerun_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/pipelinerun_validation.go index 16330aa215..c9ff4c634a 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/pipelinerun_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/pipelinerun_validation.go @@ -137,17 +137,32 @@ func (ps *PipelineRunSpec) ValidateUpdate(ctx context.Context) (errs *apis.Field if !ok || oldObj == nil { return } - old := &oldObj.Spec - - // If already in the done state, the spec cannot be modified. Otherwise, only the status field can be modified. - tips := "Once the PipelineRun is complete, no updates are allowed" - if !oldObj.IsDone() { - old = old.DeepCopy() - old.Status = ps.Status - tips = "Once the PipelineRun has started, only status updates are allowed" + if oldObj.IsDone() { + // try comparing without any copying first + // this handles the common case where only finalizers changed + if equality.Semantic.DeepEqual(&oldObj.Spec, ps) { + return nil // Specs identical, allow update + } + + // Specs differ, this could be due to different defaults after upgrade + // Apply current defaults to old spec to normalize + oldCopy := oldObj.Spec.DeepCopy() + oldCopy.SetDefaults(ctx) + + if equality.Semantic.DeepEqual(oldCopy, ps) { + return nil // Difference was only defaults, allow update + } + + // Real spec changes detected, reject update + errs = errs.Also(apis.ErrInvalidValue("Once the PipelineRun is complete, no updates are allowed", "")) + return errs } + + // Handle started but not done case + old := oldObj.Spec.DeepCopy() + old.Status = ps.Status if !equality.Semantic.DeepEqual(old, ps) { - errs = errs.Also(apis.ErrInvalidValue(tips, "")) + errs = errs.Also(apis.ErrInvalidValue("Once the PipelineRun has started, only status updates are allowed", "")) } return diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/swagger.json b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/swagger.json index 5f8710cf24..a5d1abe3dc 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/swagger.json +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/swagger.json @@ -95,6 +95,10 @@ "description": "HostNetwork specifies whether the pod may use the node network namespace", "type": "boolean" }, + "hostUsers": { + "description": "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + "type": "boolean" + }, "imagePullSecrets": { "description": "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", "type": "array", diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/taskrun_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/taskrun_validation.go index e162672a66..21a893a170 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/taskrun_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1/taskrun_validation.go @@ -131,20 +131,33 @@ func (ts *TaskRunSpec) ValidateUpdate(ctx context.Context) (errs *apis.FieldErro if !ok || oldObj == nil { return } - old := &oldObj.Spec + if oldObj.IsDone() { + // try comparing without any copying first + // this handles the common case where only finalizers changed + if equality.Semantic.DeepEqual(&oldObj.Spec, ts) { + return nil // Specs identical, allow update + } + + // Specs differ, this could be due to different defaults after upgrade + // Apply current defaults to old spec to normalize + oldCopy := oldObj.Spec.DeepCopy() + oldCopy.SetDefaults(ctx) - // If already in the done state, the spec cannot be modified. - // Otherwise, only the status, statusMessage field can be modified. - tips := "Once the TaskRun is complete, no updates are allowed" - if !oldObj.IsDone() { - old = old.DeepCopy() - old.Status = ts.Status - old.StatusMessage = ts.StatusMessage - tips = "Once the TaskRun has started, only status and statusMessage updates are allowed" + if equality.Semantic.DeepEqual(oldCopy, ts) { + return nil // Difference was only defaults, allow update + } + + // Real spec changes detected, reject update + errs = errs.Also(apis.ErrInvalidValue("Once the TaskRun is complete, no updates are allowed", "")) + return errs } + // Handle started but not done case + old := oldObj.Spec.DeepCopy() + old.Status = ts.Status + old.StatusMessage = ts.StatusMessage if !equality.Semantic.DeepEqual(old, ts) { - errs = errs.Also(apis.ErrInvalidValue(tips, "")) + errs = errs.Also(apis.ErrInvalidValue("Once the TaskRun has started, only status and statusMessage updates are allowed", "")) } return diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/openapi_generated.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/openapi_generated.go index 5b2dc4e7cf..0b71359bd9 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/openapi_generated.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/openapi_generated.go @@ -316,6 +316,13 @@ func schema_pkg_apis_pipeline_pod_Template(ref common.ReferenceCallback) common. Format: "", }, }, + "hostUsers": { + SchemaProps: spec.SchemaProps{ + Description: "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + Type: []string{"boolean"}, + Format: "", + }, + }, "topologySpreadConstraints": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/swagger.json b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/swagger.json index 0efc19a9a2..aad293ecbb 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/swagger.json +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1/swagger.json @@ -95,6 +95,10 @@ "description": "HostNetwork specifies whether the pod may use the node network namespace", "type": "boolean" }, + "hostUsers": { + "description": "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + "type": "boolean" + }, "imagePullSecrets": { "description": "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", "type": "array", diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/openapi_generated.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/openapi_generated.go index f0c68b778e..07a1ae283e 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/openapi_generated.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/openapi_generated.go @@ -394,6 +394,13 @@ func schema_pkg_apis_pipeline_pod_Template(ref common.ReferenceCallback) common. Format: "", }, }, + "hostUsers": { + SchemaProps: spec.SchemaProps{ + Description: "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + Type: []string{"boolean"}, + Format: "", + }, + }, "topologySpreadConstraints": { VendorExtensible: spec.VendorExtensible{ Extensions: spec.Extensions{ diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go index e0c9b7365e..65ef7a5edc 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go @@ -811,6 +811,10 @@ func findAndValidateResultRefsForMatrix(tasks []PipelineTask, taskMapping map[st func validateMatrixedPipelineTaskConsumed(expressions []string, taskMapping map[string]PipelineTask) (resultRefs []*ResultRef, errs *apis.FieldError) { var filteredExpressions []string for _, expression := range expressions { + // if it is not matrix result ref expression, skip + if !resultref.LooksLikeResultRef(expression) { + continue + } // ie. "tasks..results.[*]" subExpressions := strings.Split(expression, ".") pipelineTask := subExpressions[1] // pipelineTaskName diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipelinerun_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipelinerun_validation.go index 834c7493df..2b386b40fa 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipelinerun_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipelinerun_validation.go @@ -158,17 +158,32 @@ func (ps *PipelineRunSpec) ValidateUpdate(ctx context.Context) (errs *apis.Field if !ok || oldObj == nil { return } - old := &oldObj.Spec + if oldObj.IsDone() { + // try comparing without any copying first + // this handles the common case where only finalizers changed + if equality.Semantic.DeepEqual(&oldObj.Spec, ps) { + return nil // Specs identical, allow update + } + + // Specs differ, this could be due to different defaults after upgrade + // Apply current defaults to old spec to normalize + oldCopy := oldObj.Spec.DeepCopy() + oldCopy.SetDefaults(ctx) + + if equality.Semantic.DeepEqual(oldCopy, ps) { + return nil // Difference was only defaults, allow update + } - // If already in the done state, the spec cannot be modified. Otherwise, only the status field can be modified. - tips := "Once the PipelineRun is complete, no updates are allowed" - if !oldObj.IsDone() { - old = old.DeepCopy() - old.Status = ps.Status - tips = "Once the PipelineRun has started, only status updates are allowed" + // Real spec changes detected, reject update + errs = errs.Also(apis.ErrInvalidValue("Once the PipelineRun is complete, no updates are allowed", "")) + return errs } + + // Handle started but not done case + old := oldObj.Spec.DeepCopy() + old.Status = ps.Status if !equality.Semantic.DeepEqual(old, ps) { - errs = errs.Also(apis.ErrInvalidValue(tips, "")) + errs = errs.Also(apis.ErrInvalidValue("Once the PipelineRun has started, only status updates are allowed", "")) } return diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/swagger.json b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/swagger.json index 4340e77451..200fc78133 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/swagger.json +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/swagger.json @@ -95,6 +95,10 @@ "description": "HostNetwork specifies whether the pod may use the node network namespace", "type": "boolean" }, + "hostUsers": { + "description": "HostUsers indicates whether the pod will use the host's user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new user namespace is created for the pod. Setting false is useful to mitigating container breakout vulnerabilities such as allowing containers to run as root without their user having root privileges on the host. This field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + "type": "boolean" + }, "imagePullSecrets": { "description": "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", "type": "array", diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/task_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/task_validation.go index c2d918d4b3..8578375af7 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/task_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/task_validation.go @@ -434,8 +434,9 @@ func validateStep(ctx context.Context, s Step, names sets.String) (errs *apis.Fi } for j, vm := range s.VolumeMounts { - if strings.HasPrefix(vm.MountPath, "/tekton/") && - !strings.HasPrefix(vm.MountPath, "/tekton/home") { + cleanMountPath := filepath.Clean(vm.MountPath) + if strings.HasPrefix(cleanMountPath, "/tekton/") && + !strings.HasPrefix(cleanMountPath, "/tekton/home") { errs = errs.Also(apis.ErrGeneric(fmt.Sprintf("volumeMount cannot be mounted under /tekton/ (volumeMount %q mounted at %q)", vm.Name, vm.MountPath), "mountPath").ViaFieldIndex("volumeMounts", j)) } if strings.HasPrefix(vm.Name, "tekton-internal-") { diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/taskrun_validation.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/taskrun_validation.go index ae14965c77..8783a2ac65 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/taskrun_validation.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/taskrun_validation.go @@ -131,20 +131,33 @@ func (ts *TaskRunSpec) ValidateUpdate(ctx context.Context) (errs *apis.FieldErro if !ok || oldObj == nil { return } - old := &oldObj.Spec + if oldObj.IsDone() { + // try comparing without any copying first + // this handles the common case where only finalizers changed + if equality.Semantic.DeepEqual(&oldObj.Spec, ts) { + return nil // Specs identical, allow update + } + + // Specs differ, this could be due to different defaults after upgrade + // Apply current defaults to old spec to normalize + oldCopy := oldObj.Spec.DeepCopy() + oldCopy.SetDefaults(ctx) - // If already in the done state, the spec cannot be modified. - // Otherwise, only the status, statusMessage field can be modified. - tips := "Once the TaskRun is complete, no updates are allowed" - if !oldObj.IsDone() { - old = old.DeepCopy() - old.Status = ts.Status - old.StatusMessage = ts.StatusMessage - tips = "Once the TaskRun has started, only status and statusMessage updates are allowed" + if equality.Semantic.DeepEqual(oldCopy, ts) { + return nil // Difference was only defaults, allow update + } + + // Real spec changes detected, reject update + errs = errs.Also(apis.ErrInvalidValue("Once the TaskRun is complete, no updates are allowed", "")) + return errs } + // Handle started but not done case + old := oldObj.Spec.DeepCopy() + old.Status = ts.Status + old.StatusMessage = ts.StatusMessage if !equality.Semantic.DeepEqual(old, ts) { - errs = errs.Also(apis.ErrInvalidValue(tips, "")) + errs = errs.Also(apis.ErrInvalidValue("Once the TaskRun has started, only status and statusMessage updates are allowed", "")) } return diff --git a/vendor/github.com/tektoncd/pipeline/test/e2e-common.sh b/vendor/github.com/tektoncd/pipeline/test/e2e-common.sh index b908ed38ad..226a3b0ea9 100644 --- a/vendor/github.com/tektoncd/pipeline/test/e2e-common.sh +++ b/vendor/github.com/tektoncd/pipeline/test/e2e-common.sh @@ -18,6 +18,26 @@ source $(git rev-parse --show-toplevel)/vendor/github.com/tektoncd/plumbing/scripts/e2e-tests.sh +# Run the given five times or until it succeeds. +# Sleeps 5 seconds after earch retry. +# example usage: `with_retries ping fakeserver.com` +function with_retries() ( + set +eo pipefail + + success="" + for retry in 1 2 3 4 5; do + "$@" + success="$?" + if [ "${success}" -eq "0" ]; then + break + fi + sleep 5 + [[ "${retry}" != "5" ]] && echo "Retrying..." + done + + return "${success}" +) + function install_pipeline_crd() { echo ">> Deploying Tekton Pipelines" local ko_target="$(mktemp)" diff --git a/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow-alpha.env b/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-alpha.env similarity index 100% rename from vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow-alpha.env rename to vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-alpha.env diff --git a/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow-beta.env b/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-beta.env similarity index 100% rename from vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow-beta.env rename to vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-beta.env diff --git a/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow.env b/vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-stable.env similarity index 100% rename from vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-prow.env rename to vendor/github.com/tektoncd/pipeline/test/e2e-tests-kind-stable.env diff --git a/vendor/github.com/tektoncd/pipeline/test/e2e-tests.sh b/vendor/github.com/tektoncd/pipeline/test/e2e-tests.sh index 4ddd15ac88..4851100796 100644 --- a/vendor/github.com/tektoncd/pipeline/test/e2e-tests.sh +++ b/vendor/github.com/tektoncd/pipeline/test/e2e-tests.sh @@ -177,7 +177,7 @@ function run_e2e() { # and they cause a lot of noise in the logs, making it harder to debug integration # test failures. if [ "${RUN_YAML_TESTS}" == "true" ]; then - go_test_e2e -mod=readonly -tags=examples -timeout=${E2E_GO_TEST_TIMEOUT} ./test/ || failed=1 + go_test_e2e -mod=readonly -parallel=2 -tags=examples -timeout=${E2E_GO_TEST_TIMEOUT} ./test/ fi if [ "${RUN_FEATUREFLAG_TESTS}" == "true" ]; then diff --git a/vendor/github.com/tektoncd/pipeline/test/multiarch_utils.go b/vendor/github.com/tektoncd/pipeline/test/multiarch_utils.go index a913e46904..b94525095f 100644 --- a/vendor/github.com/tektoncd/pipeline/test/multiarch_utils.go +++ b/vendor/github.com/tektoncd/pipeline/test/multiarch_utils.go @@ -55,24 +55,24 @@ func initImageNames() map[int]string { switch getTestArch() { case "s390x": return map[int]string{ - busyboxImage: "busybox@sha256:4f47c01fa91355af2865ac10fef5bf6ec9c7f42ad2321377c21e844427972977", - registryImage: "ibmcom/registry:2.6.2.5", + busyboxImage: "mirror.gcr.io/busybox@sha256:2f9af5cf39068ec3a9e124feceaa11910c511e23a1670dcfdff0bc16793545fb", + registryImage: "mirror.gcr.io/ibmcom/registry:2.6.2.5", kanikoImage: "gcr.io/kaniko-project/executor:s390x-9ed158c1f63a059cde4fd5f8b95af51d452d9aa7", - dockerizeImage: "ibmcom/dockerize-s390x", + dockerizeImage: "mirror.gcr.io/ibmcom/dockerize-s390x", } case "ppc64le": return map[int]string{ - busyboxImage: "busybox@sha256:4f47c01fa91355af2865ac10fef5bf6ec9c7f42ad2321377c21e844427972977", - registryImage: "ppc64le/registry:2", - kanikoImage: "ibmcom/kaniko-project-executor-ppc64le:v0.17.1", - dockerizeImage: "ibmcom/dockerize-ppc64le", + busyboxImage: "mirror.gcr.io/busybox@sha256:2f9af5cf39068ec3a9e124feceaa11910c511e23a1670dcfdff0bc16793545fb", + registryImage: "mirror.gcr.io/ppc64le/registry:2", + kanikoImage: "mirror.gcr.io/ibmcom/kaniko-project-executor-ppc64le:v0.17.1", + dockerizeImage: "mirror.gcr.io/ibmcom/dockerize-ppc64le", } default: return map[int]string{ - busyboxImage: "busybox@sha256:895ab622e92e18d6b461d671081757af7dbaa3b00e3e28e12505af7817f73649", - registryImage: "registry", + busyboxImage: "mirror.gcr.io/busybox@sha256:2f9af5cf39068ec3a9e124feceaa11910c511e23a1670dcfdff0bc16793545fb", + registryImage: "mirror.gcr.io/library/registry", kanikoImage: "gcr.io/kaniko-project/executor:v1.3.0", - dockerizeImage: "jwilder/dockerize", + dockerizeImage: "mirror.gcr.io/jwilder/dockerize", } } } diff --git a/vendor/github.com/tektoncd/pipeline/test/presubmit-tests.sh b/vendor/github.com/tektoncd/pipeline/test/presubmit-tests.sh index 076c62d3f7..75b705612a 100644 --- a/vendor/github.com/tektoncd/pipeline/test/presubmit-tests.sh +++ b/vendor/github.com/tektoncd/pipeline/test/presubmit-tests.sh @@ -46,18 +46,7 @@ function check_yaml_lint() { function ko_resolve() { header "Running `ko resolve`" - cat < .ko.yaml - defaultBaseImage: cgr.dev/chainguard/static - baseImageOverrides: - # Use the combined base image for images that should include Windows support. - # NOTE: Make sure this list of images to use the combined base image is in sync with what's in tekton/publish.yaml's 'create-ko-yaml' Task. - github.com/tektoncd/pipeline/cmd/entrypoint: ghcr.io/tektoncd/pipeline/github.com/tektoncd/pipeline/combined-base-image:latest - github.com/tektoncd/pipeline/cmd/nop: ghcr.io/tektoncd/pipeline/github.com/tektoncd/pipeline/combined-base-image:latest - github.com/tektoncd/pipeline/cmd/workingdirinit: ghcr.io/tektoncd/pipeline/github.com/tektoncd/pipeline/combined-base-image:latest - - github.com/tektoncd/pipeline/cmd/resolvers: ghcr.io/tektoncd/plumbing/tini-git@sha256:2c18f0b3ed4394e27068b5c70bb55419797e8fc743d8ea9e0c2766001b36b5b4 -EOF - + # Use the repository's .ko.yaml for consistent base images KO_DOCKER_REPO=example.com ko resolve -l 'app.kubernetes.io/component!=resolvers' --platform=all --push=false -R -f config 1>/dev/null KO_DOCKER_REPO=example.com ko resolve --platform=all --push=false -f config/resolvers 1>/dev/null } diff --git a/vendor/modules.txt b/vendor/modules.txt index d1379de518..16befda9d9 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1543,8 +1543,8 @@ github.com/tektoncd/hub/api/v1/gen/http/catalog/client github.com/tektoncd/hub/api/v1/gen/http/resource/client github.com/tektoncd/hub/api/v1/gen/resource github.com/tektoncd/hub/api/v1/gen/resource/views -# github.com/tektoncd/pipeline v1.3.1 -## explicit; go 1.24.0 +# github.com/tektoncd/pipeline v1.3.4 +## explicit; go 1.24.13 github.com/tektoncd/pipeline/internal/artifactref github.com/tektoncd/pipeline/pkg/apis/config github.com/tektoncd/pipeline/pkg/apis/config/resolver