Skip to content

v0.49.0

Choose a tag to compare

View all tags
@tekton-pac-bot tekton-pac-bot released this 06 Jul 12:59
· 70 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.49.0
1433ee8

Pipelines as Code version v0.49.0

Tekton Pipelines as Code v0.49.0 has been released 🥳

✨ Major changes and Features

  • Automatic GitLab access token rotation: When enabled, tokens approaching expiration (within 7 days) are automatically rotated by requesting a new token from the GitLab API and updating the Kubernetes Secret. Opt-in via spec.settings.gitlab.token_auto_rotation: true on the Repository CR or globally via the global Repository CR.
  • Forgejo CLI webhook setup: Added Forgejo support to tkn pac create repo and tkn pac webhook add, creating repository webhooks with the vendored Forgejo SDK for push, pull_request, and issue_comment events.
  • Bitbucket Data Center service account support: Removed the requirement to configure a user when using HTTP scoped tokens from project and repository scopes, allowing direct use of scoped token context for authentication.
  • Forgejo org team caching in policy check: Cache ListOrgTeams API responses per organization to avoid redundant API calls when checking policy for the same org across multiple allowed teams evaluations.
  • Bitbucket Cloud API token authentication: Switched Bitbucket Cloud authentication from app-passwords to scoped API tokens for improved security. CLI now prompts for Atlassian account email and uses x-token-auth username for git clone credentials.
  • Direct OTel SDK tracing setup: Switched tracing from Knative's config-observability to the OTel SDK directly, enabling parentbased_* samplers via OTEL_TRACES_SAMPLER so the whole trace chain is kept or dropped together.

🐛 Bug Fixes

  • Fix reconciler shared state race: Removed per-reconciliation state (globalRepo, secretNS) from the shared controller struct, preventing concurrent reconciliations from overwriting each other's namespace decisions.
  • Fix GitLab label removal triggering pipelines: Label removal events on GitLab merge requests were incorrectly triggering pipeline runs. Changed to compare current vs previous label count so only label additions are processed.
  • Fix AI analysis for successful pipeline runs: Default AI/LLM roles without an on_cel expression now run for completed PipelineRuns regardless of success or failure, not just failed runs.
  • Downgrade 404 API responses to debug log level: Missing-file 404 responses (e.g., missing OWNERS file) are now logged at debug level instead of error, keeping controller logs clean.
  • Enhance cancel-in-progress log message: Added a reason in the log message explaining why a PipelineRun is cancelled to make it clearer to users.
  • Fix error wrapping in DetectPacInstallation: Use %w instead of %s for error wrapping to preserve the error chain for errors.Is/errors.As.
  • Security: upgrade Go stdlib to go1.26.4: Fixes 23 Go standard library CVEs including XSS, DoS, and TLS issues.
  • Security: upgrade golang.org/x/net to v0.55.0: Fixes 6 CVEs in HTML parsing and DNS handling.
  • Security: upgrade golang.org/x/crypto to v0.52.0: Fixes 13 critical SSH-related CVEs.
  • Security: upgrade tektoncd/pipeline to v1.14.0: Fixes CVE-2026-33022 (controller panic via long resolver name).

📚 Documentation Updates

  • Clarify task resolution in pipeline documentation: Document the difference between PAC remote task annotations and native Tekton resolver syntax, preventing taskRef.name + taskRef.resolver conflicts.
  • Document required custom console settings: Added notes clarifying that custom-console-url-pr-details, custom-console-url-namespace, and custom-console-url-pr-tasklog must all be configured when custom-console-url is set.
  • Add validation failure note to GitLab comment strategy: Clarify that comment_strategy: "disable_all" only applies to PipelineRun status comments; validation failure comments are always posted.
  • Update Homebrew installation instructions: Document Homebrew tap trust requirement for 5.2+ and macOS Gatekeeper quarantine attribute workaround.

⚙️ Chores

  • Bump tektoncd/pipeline to v1.13.1: Co-upgrades cel-go, go-scm, otel, zap, k8s.io, and grpc dependencies.
  • Add Codecov OIDC upload: Moved unit coverage publishing to a dedicated GitHub Actions workflow using Codecov OIDC.
  • Use official ArtifactHub StepActions for git-clone: Replace the vendored git-clone StepAction with a reference to the upstream tektoncd catalog via the hub resolver.
  • Bump actions/checkout from 6.0.2 to 7.0.0: Updated CI checkout action across two dependency bump PRs.
  • Bump actions/setup-go from 6.4.0 to 6.5.0: Updated CI Go setup action.
  • Bump actions/cache from 5.0.5 to 6.1.0: Updated CI cache action.
  • Bump ko-build/setup-ko from 0.9 to 0.10: Updated ko setup action.
  • Configure Dependabot to group GitHub Actions updates: Group all GitHub Actions dependency updates into a single weekly PR.
  • Enforce gofumpt formatting check in lint pipeline: Added lint-fmt Makefile target and CI step to verify Go formatting with gofumpt.
  • Remove testrr test reporting: Removed unused testrr integration, upload script, and CI environment variables.
  • Reformat code with fumpt: Code reformatted for consistency with Go formatting standards.
  • CI fixes: Multiple CI/CD fixes including gosmee TLS verification, e2e workflow triggers, fork PR checkout, YAML document markers, and vale linting.
  • Add Gitea parse_payload unit tests: Table-driven tests for pull request, push, and error paths.

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.49.0/release.yaml

Kubernetes

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.49.0/release.k8s.yaml

Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.49.0

Changelog

Contributors

chmouel, Ru13en, and 8 other contributors
Assets 21
Loading