chore(deps): update ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36 docker tag to v1 - autoclosed
-
Review changes -
-
Download -
Patches
-
Plain diff
This MR contains the following updates:
| Package | Update | Change | OpenSSF |
|---|---|---|---|
| ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36 (source) | major |
v0.70.0 -> v1.0.0
|
Warning Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
tektoncd/pipeline (ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36)
v1.0.0: Tekton Pipeline release v1.0.0 "Oriental Omnidroid" LTS
-Docs @ v1.0.0 -Examples @ v1.0.0
Installation one-liner
kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v1.0.0/release.yamlAttestation
The Rekor UUID for this release is 108e9186e8c5677a3c232a877172a3c7967bdcb84afa4bc0a3819fe35e8796e324bbc364356d4349
Obtain the attestation:
REKOR_UUID=108e9186e8c5677a3c232a877172a3c7967bdcb84afa4bc0a3819fe35e8796e324bbc364356d4349
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .Verify that all container images in the attestation are in the release file:
RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v1.0.0/release.yaml
REKOR_UUID=108e9186e8c5677a3c232a877172a3c7967bdcb84afa4bc0a3819fe35e8796e324bbc364356d4349
### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.0.0@​sha256:" + .digest.sha256')
### Download the release file
curl "$RELEASE_FILE" > release.yaml
### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
doneChanges
Features
-
RemoteResolutions using the Git Resolver now use the git binary instead of the Golang library go-git to shallow-clone, shallow-fetch, then checkout the provided repository at the given revision. This reduces resolution time and memory significantly. Some git providers such as Gitea may not support fetching revisions if the revision is a SHA which is not reachable via a ref or is not at a ref/head. In general, no user action is required.
See also: https://git-scm.com/docs/protocol-capabilities#\_allow_reachable_sha1\_in_want
Resolves https://github.com/tektoncd/pipeline/issues/8652
-
feat(pipeline): allow variable substitution in pipeline.tasks[].onError
-
Enables the configuration of backoffs for a bundle resolver requests.
-
StepActions promoted to GA and is available by default. The enable-step-actions feature flag exists as a no-op flag to ensure that existing user workflows which might rely on this flag are not disabled. This flag will be removed completely in a later release.
-
n optional token can now be passed to the git clone method (using go-git library) to bypass token limit when using the API.
Fixes
-
the hub resolver now validates StepActions as a valid kind
-
fix: avoid fan out matrix task failed due to result ref
-
Misc
-
Binary file (standard input) matches
-
Remove ClusterTask support completely
-
Updating go to 1.23
-
keep-pod-on-cancel feature flag will be enabled in default
-
-
-
-
-
-
-
be393a9toc34c1c1(#8721) -
-
6abeaa5tobe393a9(#8704) -
-
-
-
27ae6b3to6abeaa5(#8689) -
-
-
-
-
-
-
-
Docs
-
-
whenexpressions documentation from StepActions to Tasks documetnation. (#8672) -
-
Thanks
Thanks to these contributors who contributed to v1.0.0!
-
-
-
-
-
-
-
-
-
-
-
Extra shout-out for awesome release notes:
Configuration
-
If you want to rebase/retry this MR, check this box
This MR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.
Merge request reports
Activity
- Approvals
- Assignees & reviewers
- Comments (from bots)
- Comments (from users)
- Commits & branches
- Edits
- Labels
- Lock status
- Mentions
- Merge request status
- Tracking