Skip to content

v0.50.0

Latest
Latest

Choose a tag to compare

View all tags
@tekton-pac-bot tekton-pac-bot released this 05 Aug 14:08
Immutable release. Only release title and notes can be modified.
v0.50.0
This tag was signed with the committer’s verified signature.
zakisk Zaki Shaikh
GPG key ID: 040C5FE40D779E62
Verified
Learn about vigilant mode.
d1e7b6c

Pipelines as Code version v0.50.0

OpenShift Pipelines as Code v0.50.0 has been released 🥳

✨ Features

  • Bitbucket Cloud HMAC webhook secret validation: Bitbucket Cloud webhooks can now be verified using X-Hub-Signature / X-Hub-Signature-256 HMAC validation, matching the existing GitHub and Bitbucket Data
    Center pattern. When a webhook_secret is configured on the Repository CR, incoming payloads are verified against the signature header. #2870
  • AI-powered code review pipeline (Paco): Added a new Tekton PipelineRun that integrates AI for automated code reviews on pull requests, triggered by PR comments with /paco review or /paco summary. Includes PR
    diff analysis, difficulty scoring with labels (Trivial through Very Hard), and security-sensitivity detection. #2840, #2860
  • Read-only queue debug endpoint: The watcher now exposes a read-only HTTP endpoint to inspect the concurrency queue state, useful for debugging queue drift issues. #2890
  • Container creation error messages in logs: When tasks fail due to secret or configuration issues, the actual error messages from container initialization failures (e.g. "secret not found") are now captured
    and displayed, replacing generic failure reason codes. #2853
  • GitHub comment strategy webhook validation: Added admission webhook validation for the GitHub comment_strategy repository setting and e2e CRD enum coverage, mirroring the existing checks for GitLab and
    Forgejo. #2901

🐛 Bug Fixes

  • Queue slot could permanently exceed concurrency limit: When setup failed after a queued PipelineRun was un-paused, PAC handed the slot back even though the run was already going in the cluster. The slot
    count drifted on every failure and never recovered — a repository limited to 3 could end up running 4, then 5. PAC now checks whether the run was actually un-paused before releasing the slot. #2890
  • Queue lost sync with cluster on watcher restart: A single PipelineRun missing an expected annotation made the watcher abort its entire queue rebuild on startup, leaving every repository it hadn't reached yet
    with an empty queue. It now skips the bad run and continues. Changing a concurrency limit also had no effect until an unrelated event woke the queue — PAC now watches Repository changes and re-examines queued
    runs immediately. #2890
  • Concurrent queue access crashed the watcher: Two concurrency-limited repositories reconciled simultaneously caused a data race that killed the process. The queue bookkeeping is now properly guarded. Three
    uncalled methods (~200 lines) including one that would crash on an empty queue are removed. #2890
  • Recover fork PR re-runs when GitHub omits PR metadata: Rerequest handling for check runs on fork PRs is now more resilient when GitHub's webhook payload omits pull request metadata or when the
    commits/{sha}/pulls API returns no matches. #2655
  • GitLab: verify secret write access before token rotation: The token auto-rotation feature now performs a server-side dry-run Secret update before revoking the old token, preventing irrecoverable credential
    loss if the Kubernetes Secret update would fail with a permission error. #2837
  • GitLab: handle branch creation without commits: GitLab can send a Push Hook with an empty commits array when a new branch is created at an existing commit. These payloads are now accepted and trigger
    PipelineRuns using the after SHA. #2875
  • GitLab: pin source lookups to event SHA: Use the immutable event SHA for GitLab source provenance instead of a mutable branch reference, pinning both .tekton PipelineRun definitions and repository-local
    Task/Pipeline references to the same revision. #2898
  • GitHub: query check runs for /retest: Implemented GetCommitStatuses for the GitHub provider so /retest only re-runs failed pipelines when PipelineRuns have been pruned, querying the Check Runs API in App
    mode and Commit Statuses API in PAT mode. #2876
  • Gitea: check write/admin permission instead of collaborator only: Replaced IsCollaborator (which returns true for read-only collaborators) with CollaboratorPermission to verify the sender has write or admin
    access before allowing pipeline runs. #2849
  • Gitea: guard nil content in GetFileInsideRepo: Fixed a controller crash (SIGSEGV → CrashLoopBackOff) when the forgejo-sdk returns nil content for a missing file instead of an error. #2894
  • CLI: set Bitbucket Cloud email in update-token: When updating a Bitbucket Cloud token via the CLI, the Atlassian account email is now prompted and saved, preventing stale username 401 errors after token
    rotation. #2851
  • Security: CVE-2026-33211 - upgrade github.com/tektoncd/pipeline to v1.14.1 to fix critical path traversal in the Tekton Pipelines git resolver. #2881
  • Security: CVE-2026-42505 - update Go to 1.26.5 to fix crypto/tls ECH privacy leak. #2842
  • Graceful shutdown for controller listener: The controller's HTTP listener now monitors context cancellation, allowing clean shutdown on SIGTERM instead of hanging until SIGKILL. #2877
  • Log sinker errors and emit event on repository config error: Errors returned from processEvent() now log with full context (repository URL, commit SHA, etc.) and emit a Kubernetes Event when the Repository
    CR has a missing or misconfigured GitProvider.Secret. #2848
  • Provider logging consistency: All provider code now uses the provider logger (v.Logger) instead of run.Clients.Log, ensuring standard context variables (provider, repository, event-id) are present in logs.
    #2827, #2836
  • Detect and prevent nil pointer crashes: Integrated NilAway static analysis into the linting pipeline and fixed 11 potential nil pointer issues across core packages. #2868
  • Expose metrics port 9090 for webhook: Added the missing containerPort and Service port for Prometheus metrics on the webhook deployment, matching the controller and watcher. #2895
  • Populate timestamp fields on emitted k8s events: Events now include FirstTimestamp, LastTimestamp, Count, and ReportingController, fixing in kubectl's LAST SEEN column. #2896
  • Bump knative.dev/pkg and semconv to fix otel schema panic. #2845
  • Fix e2e flakiness: Wait for push PipelineRun in gitea params test to prevent race condition failures. #2838

🧪 Tests

  • Assert concurrency limits are actually respected: Existing e2e tests only checked that all runs eventually succeeded, which passes even without a working queue. New assertions verify true maximum overlap
    from PipelineRun start/end timestamps. #2890
  • Cover concurrency limit changes: New e2e tests for raising, lowering, and removing a concurrency limit — verifying the queue reacts immediately without needing an unrelated event. #2890
  • Assert the queue matches the cluster: New e2e test verifying the watcher survives parallel repository deletion and that queue state stays consistent with cluster state. #2890

📚 Documentation

  • Remove deprecated profiling key callout: Removed migration guidance for the old profiling.enable key since it no longer works. #2852

⚙️ Chores

  • Remove Tekton Hub support: Tekton Hub has been shut down. All TektonHub-specific code, configuration, tests, and documentation have been removed, leaving only Artifact Hub integration. #2855
  • Remove Repository CR pipelinerun_status field: Eliminated the Status field from the Repository CR to stop informer cache churn on every PipelineRun completion. CLI commands now query PipelineRuns directly
    via label selectors. #2841
  • Replace paco.yaml inline scripts with paco-cli binary: Replaced ~950 lines of bash/jq/awk/Node.js across three Tekton steps with invocations of the compiled paco-cli binary. #2885
  • Break Gitea e2e tests into focused files: Split the monolithic 42-test Gitea E2E file into 8 concern-grouped files (remote tasks, concurrency, YAML errors, etc.). #2889
  • Split gitea_test.go unit tests: Refactored the 1,511-line file into focused files (status_test.go, repository_test.go). #2826
  • Finish Repository.Status removal in e2e waits: Completed the refactoring to remove the deprecated Repository CR Status field from all E2E test wait helpers. #2835, #2789
  • Add display names to Tekton pipeline steps: Added displayName fields to all steps for better readability in the Tekton UI. #2867
  • Readd Go module updates in Dependabot: Added grouped Go module tracking to prevent excessive dependency PRs. #2844
  • Add bitbucket cloud secret in e2e: Added TEST_BITBUCKET_CLOUD_WEBHOOK_SECRET for webhook validation testing. #2869
  • Add provider logging guidance to AGENTS.md. #2836
  • Delete gemini config from repo: Removed decommissioned Gemini code review configuration. #2862
  • Use log lines for TestGithubGHEPullRequestGitCloneTask: Replaced sinceSecond with log lines to reduce test flakiness. #2872
  • Fix Python lint errors: Fixed import ordering and timezone-naive datetime calls. #2886
  • Dependency bumps: Updated go module dependencies #2900, k8s.io/client-go to 0.36.2 #2846, k8s.io/apiextensions-apiserver to v0.36.2 #2846, grpc to 1.82.1 #2873, go-dependencies group (5 updates) #2888,
    go-dependencies group (15 updates) #2845, go-isatty #2864.
  • CI bumps: actions/checkout to 7.0.1 #2887, actions/setup-go to 7.0.0 #2863, fix team slug format in workflow #2880, skip commit validation on dependabot PRs #2845, ignore go-github and ghinstallation in
    dependabot #2845.
  • Retry Gitea org/repo/hook creation on transient API errors: E2e test setup now retries transient Gitea API failures instead of failing immediately. #2890

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.50.0/release.yaml

Kubernetes

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.50.0/release.k8s.yaml

Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.50.0

Changelog

Contributors

chmouel, khrm, and 6 other contributors
Assets 21
Loading