Tekton Triggers release v0.37.0 "Tekton Triggers"

[khrm]

• Docs @ v0.37.0
• Examples @ v0.37.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/interceptors.yaml

REKOR_UUID=108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.37.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml
curl "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

• 🐛 fix: don't pre-parse url-encoded body for webhook-first interceptor chains (fix: don't pre-parse url-encoded body for webhook-first interceptor chains #2077)

Fix a bug where a webhook-type interceptor placed first in a trigger's
interceptor chain would receive a pre-parsed JSON body instead of the
original request body for application/x-www-form-urlencoded requests
(e.g. Slack slash commands), breaking custom interceptors that parse the
raw form-encoded payload themselves.

Misc

• 🔨 chore: switch base image to ghcr.io/tektoncd/plumbing/static-base (chore: switch base image to ghcr.io/tektoncd/plumbing/static-base #2043)
• 🔨 Fix ko build failure due to kodata symlink escaping root (Fix ko build failure due to kodata symlink escaping root #2092)
• 🔨 Bump ko in publish task (Bump ko in publish task #2091)
• 🔨 Bump the all group with 11 updates (Bump the all group with 11 updates #2087)
• 🔨 Update releases.md for v0.36.0 (Update releases.md for v0.36.0 #2085)
• 🔨 Bump github/codeql-action from 4.36.2 to 4.37.6 (Bump github/codeql-action from 4.36.2 to 4.37.6 #2082)
• 🔨 Bump golangci-lint from v2.8.0 to v2.12.2 (Bump golangci-lint from v2.8.0 to v2.12.2 #2081)
• 🔨 Bump the all group across 1 directory with 15 updates (Bump the all group across 1 directory with 15 updates #2080)
• 🔨 Bump github.com/google/cel-go from 0.28.1 to 0.29.0 (Bump github.com/google/cel-go from 0.28.1 to 0.29.0 #2079)
• 🔨 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (Bump google.golang.org/grpc from 1.81.1 to 1.82.1 #2076)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 #2075)
• 🔨 Bump step-security/harden-runner from 2.19.4 to 2.20.0 (Bump step-security/harden-runner from 2.19.4 to 2.20.0 #2072)
• 🔨 Ignore otel major/minor updates in dependabot (Ignore otel major/minor updates in dependabot #2070)
• 🔨 ci(.github/workflows): enable Codecov coverage reporting (ci(.github/workflows): enable Codecov coverage reporting #2069)
• 🔨 fix: pass --insecure-registry to ko for plain-HTTP KinD registry (fix: pass --insecure-registry to ko for plain-HTTP KinD registry #2067)
• 🔨 Bump golang.org/x/crypto from 0.50.0 to 0.52.0 (Bump golang.org/x/crypto from 0.50.0 to 0.52.0 #2066)
• 🔨 Bump ko-build/setup-ko from 0.9 to 0.10 (Bump ko-build/setup-ko from 0.9 to 0.10 #2065)
• 🔨 Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 #2063)
• 🔨 Bump golang.org/x/net from 0.54.0 to 0.55.0 (Bump golang.org/x/net from 0.54.0 to 0.55.0 #2060)
• 🔨 Bump actions/cache from 5.0.5 to 6.1.0 (Bump actions/cache from 5.0.5 to 6.1.0 #2059)
• 🔨 Bump actions/setup-go from 6.4.0 to 6.5.0 (Bump actions/setup-go from 6.4.0 to 6.5.0 #2058)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 #2057)
• 🔨 fix: replace kodata LICENSE symlinks with actual files (fix: replace kodata LICENSE symlinks with actual files #2056)
• 🔨 Bump actions/checkout from 6.0.3 to 7.0.0 (Bump actions/checkout from 6.0.3 to 7.0.0 #2054)
• 🔨 Bump github/codeql-action from 4.36.1 to 4.36.2 (Bump github/codeql-action from 4.36.1 to 4.36.2 #2050)
• 🔨 Bump actions/checkout from 6.0.2 to 6.0.3 (Bump actions/checkout from 6.0.2 to 6.0.3 #2046)
• 🔨 Bump github/codeql-action from 4.35.4 to 4.36.1 (Bump github/codeql-action from 4.35.4 to 4.36.1 #2045)
• 🔨 Add agentic workflows context files (Add agentic workflows context files #2042)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 #2040)
• 🔨 Bump step-security/harden-runner from 2.19.3 to 2.19.4 (Bump step-security/harden-runner from 2.19.3 to 2.19.4 #2039)
• 🔨 Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 #2038)
• 🔨 Update pod-template.yaml example in cheat sheet (Update pod-template.yaml example in cheat sheet #2036)
• 🔨 feat: add retest workflow using plumbing reusable workflow (feat: add retest workflow using plumbing reusable workflow #1929)
• 🔨 Add dependabot config generator for active release branches (Add dependabot config generator for active release branches #2048)

Docs

Thanks

Thanks to these contributors who contributed to v0.37.0!

• ❤️ @app/dependabot
• ❤️ @enarha
• ❤️ @jkhelil
• ❤️ @khrm
• ❤️ @pujitha24
• ❤️ @vdemeester

Extra shout-out for awesome release notes:

• 😍 @pujitha24

---

This discussion was created from the release Tekton Triggers release v0.37.0 "Tekton Triggers".