🎉 🪟 More Windows features 🪟, lots of fixes 🔨 and docs improvements 📖 ! 🎉

-Docs @ v0.33.0
-Examples @ v0.33.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.33.0/release.yaml

Attestation

The Rekor UUID for this release is 5d258716457107c85cf59b80c0091c333463eb7c2a9f2d6f5b642ca69ef2671f

Obtain the attestation:

REKOR_UUID=5d258716457107c85cf59b80c0091c333463eb7c2a9f2d6f5b642ca69ef2671f
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | base64 --decode | jq

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.33.0/release.yaml 
REKOR_UUID=5d258716457107c85cf59b80c0091c333463eb7c2a9f2d6f5b642ca69ef2671f

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | base64 --decode | jq -r '.subject[]|.name + ":v0.33.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do 
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Deprecation Notices

The scope-when-expressions-to-task flag will be removed in the next release.
We recommend migrating Pipelines to using when expressions scoped to the guarded Task only.

Upgrade Notices

🚨 Tekton v0.33.0 requires Kubernetes v1.21+ 🚨

The configuration flags disable-working-dir-overwrite and disable-home-env-overwrite and associated features are not available anymore. Users that rely on automatic workingDir and HOME overwrite must update their Tasks to explicitly them before updating to
this release.

The when expressions in a given Task are scoped to guard the Task only by default. Users that rely the Branch scope can use the scope-when-expressions-to-task to continue guarding the Task and its dependent Tasks.

Changes

Features

• ✨ [TEP-0059] Scope expressions to only (#4580)

The when expressions in a given Task are scoped to guard the Task only by default. Set scope-when-expressions-to-task to continue guarding the Task and its dependent Tasks. The scope-when-expressions-to-task flag will be removed soon so we recommend migrating Pipelines to using when expressions scoped to the guarded Task only.

• ✨ Add Step and Sidecar Overrides to TaskRun API (#4575)

[Feature] Adds API fields for Step and Sidecar Overrides to TaskRun. This feature is not yet implemented.

• ✨ Add resolution types to the API (#4502)

Syntax support for remote resolution, an alpha feature in development, has been added to pipelineRef and taskRef fields. Using the remote resolution fields is not yet possible, however, and will only result in errors.

• ✨ Support workingDir init on Windows (#4475)

Working dir initialization is now done using a Go binary in a new container image included in the release, which makes it portable to run on Windows nodes.

• ✨ Include Windows builds of cmd/nop in release process (#4474)

Include Windows support for the nop image, to enable Affinity Assistant for Windows, and more.

Backwards incompatible changes

In current release:

• 🚨 Remove deprecated flags home-env and working-dir 🧹 (#4587)

The configuration flags disable-working-dir-overwrite and disable-home-env-overwrite, after defaulting
to True for nine months (i.e. feature disabled), have now been removed completely, along with the associated
features which are not available in Tekton anymore.

Fixes

• 🐛 Fix for some arm64 machines. (#4588)

Fix problems on some arm64 machines.

• 🐛 Consider osversion when determining platform uniqueness (#4569)

Tweaks platform-specific command selection logic to handle images that provide multiple images for the same os+architecture, differing only by osversion (e.g., golang:1.17)

• 🐛 Ignore variant when looking up command for platform in entrypoint (#4550)

Loosen runtime platform selection logic to account for platforms with CPU variants

• 🐛 Add validation for PR infinite timeouts (#4539)

[Bug Fix] Add validation for 0 timeout for pipelinerun.timeouts.tasks and pipelinerun.timeouts.finally

• 🐛 Set correct timeout for PR tasks with elapsed time (#4532)

[Bug Fix] Account for elapsed time, pipeline.timeouts.tasks, and pipeline.tasks[].timeout when setting taskrun timeout

• 🐛 Account for PipelineRun elapsed time for timeouts (#4506)

[Bug fix]: Respect pipelinerun.timeouts.tasks for sequential TaskRuns or TaskRun retries

• 🐛 Fix Pipeline/Task to *Run label/annotation propagation 🥨 (#4478)

Fix labels and annotation propagation from Task/Pipeline to TaskRun/PipelineRun and thus the generated Pod

• 🐛 Use pr.Timeouts.Pipeline in Custom Task reconcile (#4440)

[Bug fix]: Use pipeline.spec.timeouts.pipeline to determine pipeline timeout during custom task reconcile

• 🐛 Patch temp GOPATH hack script to handle nounset option (#4574)
• 🐛 Add taskSpec resources validation (#4547)
• 🐛 add default seccomp profile (#4520)
• 🐛 Update hack scripts to shim temp GOPATH as needed (#4465)
• 🐛 Fix incorrect format specifier in test files (#4495)
• 🐛 Fix tekton_pipelines_controller_taskrun_count recount bug (#4469)

Misc

• 🔨 Remove deprecated flags home-env and working-dir 🧹 (#4587)

The configuration flags disable-working-dir-overwrite and disable-home-env-overwrite, after defaulting
to True for nine months (i.e. feature disabled), have now been removed completely, along with the associated
features which are not available in Tekton anymore.

• 🔨 Update write_test.go (#4570)
• 🔨 [refactor] Remove ImplicitParamEnabled context. (#4528)
• 🔨 Update k8schain (#4488)

Drops dependency on k8s cred providers, statically link GCR/ECR/ACR cred helpers' Go code instead

• 🔨 and supported in (#4481)
• 🔨 Revert 49a7fa to remove fake AWS creds (#4504)

The pipelines controller config previously included AWS environment variables as a workaround for a performance-related issue. The underlying issue appears to be fixed and so the environment variables have been removed from the controller.

• 🔨 use helper functions - MarkResource* (#4565)
• 🔨 cleanup - ApplyContext parameters (#4564)
• 🔨 minor cleanup - use MarkResource* instead of updating the status explicitly (#4561)
• 🔨 Add copyright notice to clock.go (#4505)
• 🔨 Move to Go 1.16 (#4497)
• 🔨 Drop minishift instructions (#4489)
• 🔨 Provide testing implementation of time.Now() (#4487)
• 🔨 Update the release notes to describe kustomize usage (#4509)
• 🔨 Separate buildPlatforms and publishPlatforms (#4486)
• 🔨 Bump knative.dev/pkg vendoring. Use klog/v2 (#4538)

🚨 Tekton now requires Kubernetes v1.21+ 🚨

• 🔨 Increase lease time of controller and webhook (#4541)
• 🔨 Use podTemplate ImagePullSecrets for Entrypoint Image Lookup (#4496)
• 🔨 Drop resource requests: from gohelloworld. (#4549)

Docs

• 📖 Update the feature flag docs (#4584)
• 📖 Add bash v4+ requirement to the development guide (#4498)
• 📖 Move kind development instructions to top of dev cluster instructions. (#4466)
• 📖 Update the deprecations table (#4586)
• 📖 debug is an alpha feature (#4573)
• 📖 Fix links to Why Aren't PipelineResources in Beta? (#4572)
• 📖 Fix kustomize invocation typo (#4537)
• 📖 Add doc links for Pipelines 0.28.3 (#4536)
• 📖 Add doc links for 0.29.1, 0.30.1, 0.31.1 and 0.32.1 (#4530)
• 📖 Update README.md (#4507)
• 📖 Add docs links for v0.32.0 (#4482)
• 📖 Update docs to reflect resource requests of pods (#4472)
• 📖 Update install docs to mention firewall reqs (#4517)

Thanks

Thanks to these contributors who contributed to v0.33.0!

• ❤️ @AlanGreene
• ❤️ @MrMYHuang
• ❤️ @R2wenD2
• ❤️ @Yongxuanzhang
• ❤️ @abayer
• ❤️ @afrittoli
• ❤️ @anu-baskar
• ❤️ @concaf
• ❤️ @guillaumerose
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @khrm
• ❤️ @lbernick
• ❤️ @mattmoor
• ❤️ @pritidesai
• ❤️ @psychosis448
• ❤️ @sbwsg
• ❤️ @vdemeester
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @MrMYHuang
• 😍 @Yongxuanzhang
• 😍 @afrittoli
• 😍 @anu-baskar
• 😍 @guillaumerose
• 😍 @imjasonh
• 😍 @jerop
• 😍 @khrm
• 😍 @lbernick
• 😍 @mattmoor
• 😍 @sbwsg
• 😍 @vdemeester
• 😍 @wlynch

🎉 Label Propagation Fix and Changes to Implicit Params 🎉

-Docs @ v0.28.3
-Examples @ v0.28.3

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.28.3/release.yaml

Fixes

• #4478 Fix Pipeline/Task to *Run label/annotation propagation
• #4484 Implicit params: don't apply PipelineSpec params to TaskRefs
• #4511 Implicit params: Disable implicit param behavior for Pipeline Objects
• #4521 Update Dockerfiles using golang images to Go 1.16.13

Thanks

Thanks to these contributors who contributed to v0.32.1!

• ❤️ @vdemeester
• ❤️ @wlynch
• ❤️ @sbwsg

🎉 Label Propagation Fix and Changes to Implicit Params 🎉

-Docs @ v0.32.1
-Examples @ v0.32.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.32.1/release.yaml

Fixes

• #4478 Fix Pipeline/Task to *Run label/annotation propagation
• #4484 Implicit params: don't apply PipelineSpec params to TaskRefs
• #4511 Implicit params: Disable implicit param behavior for Pipeline Objects
• #4521 Update Dockerfiles using golang images to Go 1.16.13

Thanks

Thanks to these contributors who contributed to v0.32.1!

• ❤️ @vdemeester
• ❤️ @wlynch
• ❤️ @sbwsg

🎉 Label Propagation Fix and Changes to Implicit Params 🎉

-Docs @ v0.31.1
-Examples @ v0.31.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.31.1/release.yaml

Fixes

• #4478 Fix Pipeline/Task to *Run label/annotation propagation
• #4484 Implicit params: don't apply PipelineSpec params to TaskRefs
• #4511 Implicit params: Disable implicit param behavior for Pipeline Objects
• #4521 Update Dockerfiles using golang images to Go 1.16.13

Thanks

Thanks to these contributors who contributed to v0.31.1!

• ❤️ @vdemeester
• ❤️ @wlynch
• ❤️ @sbwsg

🎉 Label Propagation Fix and Changes to Implicit Params 🎉

-Docs @ v0.30.1
-Examples @ v0.30.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.30.1/release.yaml

Fixes

• #4478 Fix Pipeline/Task to *Run label/annotation propagation
• #4484 Implicit params: don't apply PipelineSpec params to TaskRefs
• #4511 Implicit params: Disable implicit param behavior for Pipeline Objects
• #4521 Update Dockerfiles using golang images to Go 1.16.13

Thanks

Thanks to these contributors who contributed to v0.29.1!

• ❤️ @vdemeester
• ❤️ @wlynch
• ❤️ @sbwsg

🎉 Label Propagation Fix and Changes to Implicit Params 🎉

-Docs @ v0.29.1
-Examples @ v0.29.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.29.1/release.yaml

Fixes

• #4478 Fix Pipeline/Task to *Run label/annotation propagation
• #4484 Implicit params: don't apply PipelineSpec params to TaskRefs
• #4511 Implicit params: Disable implicit param behavior for Pipeline Objects
• #4521 Update Dockerfiles using golang images to Go 1.16.13

Thanks

Thanks to these contributors who contributed to v0.29.1!

• ❤️ @vdemeester
• ❤️ @wlynch
• ❤️ @sbwsg

🎉 Security & Performance Improvements 🎉

-Docs @ v0.32.0
-Examples @ v0.32.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.32.0/release.yaml

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Changes

Features

• ✨ Match k8s recommended restricted PSP. (#4439)

tekton-pipelines PodSecurityPolicy now drops all capabilities and enables default
seccomp/apparmor annotations. This should not affect user Runs unless you are
running in the tekton-pipelines namespace (which we generally do not recommend).

• ✨ Avoid API server call to get Pod when sidecars are stopped (#4374)

Avoids calls to the API server to stop sidecars when sidecars are already stopped

• ✨ Lockdown /tekton/step folders to their own steps. (#4352)

The /tekton/steps directory is now read-only and subdirectories in /tekton/steps are now symlinks. The content for the resolved paths remains the same.

Fixes

• 🐛 git: Remove usage of git symbolic-ref. (#4464)

• 🐛 scripts: remove set -x by default 🧣 (#4451)

Scripts will no longer print their commands and arguments by default in order to limit unexpected exposure of sensitive values.

• 🐛 set activeDeadlineSeconds to max for tasks with notimeouts (#4450)

Set activeDeadlineSeconds to max. permitted value (MaxInt32) for a task with 0s timeout (no timeouts).
This commit fixes the bug where a task with 0s timeout was failing with out of range error.

• 🐛 test/sidecar_test.go: replace t.Errorfs with t.Fatalfs (#4436)

• 🐛 Select entrypoint command based on runtime platform (#4420)

Changes the way image commands are passed to the entrypoint executor, enabling more correct behavior in heterogeneous clusters, and allowing for multi-platform image references to be passed to generated Pods.

• 🐛 Merge default PodTemplate's affinity field (#4406)

Fixes an issue that default PodTemplate's affinity field is ignored.

• 🐛 Pass explicit platforms list when publishing images (#4480)
• 🐛 Bump GoogleContainerTools/skaffold revision from v0.32.0 to v1.32.0 (#4423)

Misc

• 🔨 Fix links in expressions migrations announcements (#4462)

• 🔨 Pick up latest (k8s 0.22 libs) (#4449)

The pipelines clients are now compatible with k8s.io/client-go v0.22.x

• 🔨 Refactor PipelineRun timeout logic (#4447)

[Bug fix] Handle cases where PipelineRun task timeouts are greater than Pipeline.Timeouts.Task or Pipeline.Timeouts.Finally

• 🔨 Remove --enable-basic-auth from the development guide (#4442)

• 🔨 subcommands_test: Group command tests with t.Run. (#4437)

• 🔨 Reduce RBAC permissions for Tekton controller/webhook roles. (#4434)

Tekton tekton-pipelines-controller-tenant-access and tekton-pipelines-webhook-cluster-access
ClusterRole permissions are reduced to better fit least privilege.
This should have no effect on the Pipelines Controller/Webhook itself, but may impact users
if they were relying on these roles for other uses.

• 🔨 Don't install golangci-lint with curl|bash, use go install, introduce the tools folder (#4411)

• 🔨 Clean up RunsToCompletion interface (#4479)

• 🔨 Reduce duplication in TaskRun reconciler tests (#4441)

• 🔨 Add image replacement for amd64 specific image (#4456)

• 🔨 Skip creds-init-only-mounts-provided-credentials test for linux/s390x (#4452)

• 🔨 Remove unused informers (#4459)

Reduce memory footprint of the pipeline controller

Docs

• 📖 updating README to include v0.31.0 release links (#4429)

Adding links to the latest release - v0.31.0

Thanks

Thanks to these contributors who contributed to v0.32.0!

• ❤️ @Siddhesh-Ghadi
• ❤️ @barthy1
• ❤️ @devholic
• ❤️ @guillaumerose
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @lbernick
• ❤️ @mattmoor
• ❤️ @pritidesai
• ❤️ @sbwsg
• ❤️ @smaftoul
• ❤️ @vdemeester
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @devholic
• 😍 @guillaumerose
• 😍 @imjasonh
• 😍 @jerop
• 😍 @lbernick
• 😍 @mattmoor
• 😍 @pritidesai
• 😍 @smaftoul
• 😍 @vdemeester
• 😍 @wlynch

🎉 Fix for the debug mode, retry task resolution on transient error, and taskRun annotations updated to include the release version 🎉

-Docs @ v0.31.0
-Examples @ v0.31.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.31.0/release.yaml

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Changes

Fixes

• 🐛 Explicitly annotate TaskRuns with release version. (#4424)

More consistently apply the pipeline.tekton.dev/release annotation to TaskRun resources.

• 🐛 make debug scripts comply with new /tekton/run (#4416)

Debug scripts were unusable due to addition of the new /tekton/run behavior. This commit makes them usable again.

• 🐛 Retry TaskRef resolution on etcd errors (#4392)

Retry Task resolution on transient etcd errors

• 🐛 Fix TestDAGPipelineRun flakiness. (#4419)

• 🐛 Refactor CloudEvent related tests to use common set of helpers (#4387)

• 🐛 Put workspace-in-sidecar example into no-ci (#4380)

Misc

• 🔨 Move Events test helpers to test package (#4405)

Docs

• 📖 Document that k8s 1.20 is the minimum required (#4414)

• 📖 Add v0.30.0 to the README (#4413)

• 📖 Fix conflicting docs for /tekton/steps API Compatibility. (#4395)

action required: Users should not assume the directory/file structure of /tekton/steps. Use $(steps.step-.exitCode.path) instead.

• 📖 docs: add myself as topical owner for debug (#4390)

Thanks

Thanks to these contributors who contributed to v0.31.0!

• ❤️ @jerop
• ❤️ @lbernick
• ❤️ @mattmoor
• ❤️ @sbwsg
• ❤️ @waveywaves
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @jerop
• 😍 @lbernick
• 😍 @mattmoor
• 😍 @waveywaves
• 😍 @wlynch

🎉 PipelineResources Deprecated, Retries in Custom Tasks Added, and Linux Arm Supported 🎉

-Docs @ v0.30.0
-Examples @ v0.30.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.30.0/release.yaml

Upgrade Notices

⚠️ Kubernetes 1.20 is the new minimum required version. ⚠️

Deprecation Notices

• 🚨 PipelineResources are deprecated. Consider using replacement features, such as Tasks, instead. (#4376)

Backwards incompatible changes

N/A

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Changes

Features

• ✨ Add variable expansion in the workspaces.subPath (#4351)

  Users are able to use variable substitution in the subPath field of a Workspace within a Task in Pipeline

• ✨ Build images for linux/arm (arm32v7) (#4331)

  Images are built for linux/arm (arm32v7)

• ✨ TEP-69, Implementation. Support retry for custom tasks. (#4327)

  A custom task specification can be created with Retries as follows:

         apiVersion: tekton.dev/v1alpha1
         kind: Run
         metadata:
           generateName: simpleexample
         spec:
           retries: 3 # set retries
           params:
             - name: searching
               value: the purpose of my existence
           ref:
             apiVersion: custom.tekton.dev/v1alpha1
             kind: Example
             name: exampleName
  

Fixes

• 🐛 Breakout sidecar stopping if TaskSpec has no sidecar (#4372)

  The reconciliation of a completed TaskRun has been optimized so that it does not anymore try to stop sidecars for TaskRuns who have
  no sidecars in their TaskSpec.

• 🐛 Use kmeta.ChildName for child resources (#4361)

  Name of Pods and TaskRuns created by Tekton controllers are now generated with kmeta.ChildName:

  ChildName generates a name for the resource based upon the parent resource and suffix. If the concatenated name is longer than K8s permits the name is hashed and truncated to permit construction of the resource, but still keeps it unique. If the suffix itself is longer than 31 characters, then the whole string will be hashed and parent|hash|suffix will be returned, where parent and suffix will be trimmed to fit (prefix of parent at most of length 31, and prefix of suffix at most length 30).

  The name of the Pods owned by a TaskRun is univocally associated to the owning resource. If a TaskRun resource is deleted and created with the same name, the child Pod will be created with the same name as before.
  The base format of the name is <taskrun-name>-pod. The name may vary as described above if it becomes too long.
  In case of retries, starting from the first retry, the base format of the name is <taskrun-name>-retry<N> where N is the retry number.

  The name of the TaskRuns and Runs owned by a PipelineRun are univocally associated to the owning resource. If a PipelineRun resource is deleted and created with the same name, the child TaskRuns will be created with the same name as before.
  The base format of the name is <pipelinerun-name>-<pipelinetask-name>. The name may vary as described above if it becomes too long.

• 🐛 Escape git usernames with backslashes in .gitconfig (#4337)

  Git credential usernames containing a backslash will have that backslash escaped with an additional backslash in .gitconfig.

• 🐛 Stop using milli-quantities for memory and ephemeral storage (#4335)

  Adjusting the pod transformation code based on limit ranges to only use milli-quantities for CPU, but not for memory and ephemeral store and half bytes do not exist.

• 🐛 Use cmpopts.IgnoreFields instead of IgnoreType. (#4328)

• 🐛 TestTaskRunTimeout: Reduce timeout 30s -> 1s. (#4360)

• 🐛 Set explicit timeoutSeconds on example's readinessProbe (#4371)

• 🐛 Fix ignore annotation for gosec (#4345)

• 🐛 Rewrite flakey workspace-in-sidecar example (#4349)

Misc

• 🔨 Updates helm task e2e test to use v1 rbac api (#4369)

• 🔨 Bump Alpine base images from 3.11 to 3.14 (current latest) (#4332)

  Bump base image for git-init and pullrequest-init from alpine:3.11 to alpine:3.14

• 🔨 Bump the distroless image. (#4329)

  Update the distroless image to one that has been signed with cosign and Fulcio.

• 🔨 Deprecate PipelineResources (#4376)

  action required: PipelineResources are deprecated. Consider using replacement features, such as Tasks, instead.

• 🔨 Remove experimental disable resolution controller flag (#4346)

  An experimental controller flag was added in Pipelines v0.28.0 to disable resolution of taskrefs and pipelinerefs. This flag has now been removed.

• 🔨 Minor refactoring of taskRef validation. (#4370)

• 🔨 Improve test coverage for pkg/git (#4367)

• 🔨 Turn on most of golangci-lint's exclude-use-default rules, address problems (#4315)

• 🔨 Bump to release-1.0 of knative.dev/pkg (#4354)

• 🔨 Reduce integration test run times (#4353)

• 🔨 Makefile: allow override ko binary… (#4287)

• 🔨 Expose metrics and pprof ports on Pod and pprof on Service (#4233)

Docs

• 📖 Add docs for missing variable substitution fields (#4359)

• 📖 updating release cheat sheet (#4322)

  Updated the release cheat sheet to include creating a GitHub release branch such as release-v0.28.x as part of the release creation process.

• 📖 Fix structure and enable toc autogenerate (#4319)

  Fix structure and enable toc autogenerate

• 📖 document how to verify tekton pipelines release (#4257)

  Document step-by-step process of how to verify Tekton Pipelines release.

• 📖 Add instructions for replacing CloudEvent PipelineResource to pipeline docs (#4379)

• 📖 docs: fixing my name in topical-ownership 💅 (#4363)

• 📖 Fix broken links and clarify GCR setup instructions in DEVELOPMENT.md (#4336)

• 📖 Adding note regarding whitespace sensitivity of when expressions (#4333)

• 📖 adding entry for the latest release 0.29 🛎 (#4325)

• 📖 Fix link to API compatibility policy (#4323)

Thanks

Thanks to these contributors who contributed to v0.30.0!

• ❤️ @SaschaSchwarze0
• ❤️ @ScrapCodes
• ❤️ @abayer
• ❤️ @afrittoli
• ❤️ @bigfleet
• ❤️ @chenbh
• ❤️ @dalbar
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @koneko096
• ❤️ @lbernick
• ❤️ @mattmoor
• ❤️ @pritidesai
• ❤️ @sbwsg
• ❤️ @sm43
• ❤️ @squee1945
• ❤️ @vdemeester
• ❤️ @vinamra28
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @SaschaSchwarze0
• 😍 @ScrapCodes
• 😍 @abayer
• 😍 @afrittoli
• 😍 @imjasonh
• 😍 @jerop
• 😍 @koneko096
• 😍 @mattmoor
• 😍 @pritidesai
• 😍 @sbwsg
• 😍 @sm43
• 😍 @vinamra28
• 😍 @wlynch

🎉 🪟 Windows TaskRuns! 🪟 🎉

-Docs @ v0.29.0
-Examples @ v0.29.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.29.0/release.yaml

Attestation

The Rekor UUID for this release is 8ba5dcc45b9fad4d879a8b6815cdaa85fdee1d9fc24cf8811f103d537c602908

Obtain the attestation:

rekor-cli get --uuid 8ba5dcc45b9fad4d879a8b6815cdaa85fdee1d9fc24cf8811f103d537c602908 --format json | jq -r .Attestation | base64 --decode | jq

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.29.0/release.yaml 
REKOR_UUID=8ba5dcc45b9fad4d879a8b6815cdaa85fdee1d9fc24cf8811f103d537c602908

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | base64 --decode | jq -r '.subject[]|.name + ":v0.29.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do 
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Changes

Features

• ✨ Build entrypoint image for Windows (#4260)

The entrypoint multi-arch image now includes an image built for Windows, allowing TaskRuns to execute on Windows nodes.

Notes:

• 🪟 There is a Windows page in the docs folder which outlines some important details about running Windows workloads in Tekton
• 🪟 If a Windows task and a Linux task are both sharing a PersistentVolumeClaim workspace, the affinity assistant may need to be disabled (those two tasks cannot run on the same node).
• 🪟 PipelineResources have not been tested for Windows tasks and probably won't work.
• 🪟 Windows TaskRuns require - at least for now - privileged mode

Thanks for all the contributors for making this possible. We look forward to users feedback!

• ✨ Support for single-quote bracket notation for params (#4268)

Params and result can now be referenced with bracket notation using both single and double quotes in addition to dot notation. For example, the following are equivalent: $(param.myparam), $(param['myparam']), and $(param["myparam"]). Bracket notation has the additional benefit of allowing users to work with parameter names containing conflicting characters like "." (e.g. $(param['my.param']) or $(param["my.param"]).

• ✨ Promoting "onError" to beta 🎓 (#4251)

Announcement: onError in a step is now stable and available to include in your task definition without any flag.

Fixes

• 🐛 Verify failure of PipelineRun in TestGitPipelineRunFail (#4273)
• 🐛 release: Drop windows from pipeline-wide platforms (#4308)
• 🐛 Don't pass the pipeline's default platforms value to the publish-image task (#4305)
• 🐛 release: Include windows in pipeline default platforms (#4304)
• 🐛 nightly: Configure auth before pushing combined base image (#4302)
• 🐛 Fix nightly release process (#4301)
• 🐛 Updates webhook cluster role to work with Owner References (#4269)
• 🐛 Ignore env var ordering in taskrun reconciler tests (#4286)

Misc

• 🔨 Remove unused error type CannotConvertError (#4281)

Remove unused error type CannotConvertError

• 🔨 Split /tekton/run directories into separate volumes. (#4278)
• 🔨 Remove upgrade via defaulting (#4275)

Use only the conversion webhook to upgrade types, remove upgrade mechanism in the defaulter

• 🔨 Removing internal/builder/v1alpha1 and all usages (#4270)
• 🔨 Only add gcr.io images to publish results (#4283)

Due to a technical limitation, only images published to gcr.io, which are included in the release.yaml, are signed.
Images on eu.gcr.io, us.gcr.io and asia.gcr.io are not signed yet.

• 🔨 Fix unreachable code in TestReconcileCancelledFailsTaskRunCancellation (#4312)
• 🔨 Clean up a bunch of exported comments to actually match the element (#4311)
• 🔨 Update comment for dag.GetSchedulable (#4310)
• 🔨 Remove last lingering unnecessarily exported functions (#4296)
• 🔨 Switch test/*.go to using YAML rather than structs (#4288)
• 🔨 Convert test/cluster_resource_test.go's Tekton structs to YAML (#4284)
• 🔨 Removing internal/builder completely (#4277)
• 🔨 pkg/pod: extract overrideHomeEnv/WorkingDir outside (#4250)
• 🔨 pkgs: move affinity assistant to a pod transformer (#4245)
• 🔨 pkg/pod: simplify orderContainers returns (#4244)
• 🔨 Bump some stale dependencies in go.mod. (#4243)
• 🔨 Mount entrypoint volume as read-only. (#4242)
• 🔨 Mark Downward API VolumeMount as readonly. (#4236)
• 🔨 Have [Cluster]Task and Pipeline implement kmeta.OwnerRefable. (#4295)
• 🔨 Generate reconcilers for [Cluster]Tasks and Pipelines. (#4293)
• 🔨 Make sure images stored in registry mirrors are signed (#4262)
• 🔨 Remove sbwsg from OWNERS_ALIAS file (#4249)

Docs

• 📖 Add reference to authoring recommendations (#4318)
• 📖 fix couple of small typos (#4292)
• 📖 Fix Example in Service Account Documentation (#4274)
• 📖 Update ToC in TaskRuns documentation (#4265)
• 📖 Document Alpha Features (#4246)
• 📖 links to the patch release v0.28.2 (#4314)
• 📖 adding an entry for v0.28.1 📢 (#4267)
• 📖 adding links to pipeline release 0.28 (#4252)
• 📖 Revamp Tekton developer docs for /tekton paths. (#4238)

Thanks

Thanks to these contributors who contributed to v0.29.0!

• ❤️ @abayer
• ❤️ @afrittoli
• ❤️ @dlorenc
• ❤️ @guillaumerose
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @mattmoor
• ❤️ @nbaudis
• ❤️ @pritidesai
• ❤️ @priyawadhwa
• ❤️ @sbwsg
• ❤️ @skaegi
• ❤️ @vaikas
• ❤️ @vdemeester
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @abayer
• 😍 @afrittoli
• 😍 @guillaumerose
• 😍 @imjasonh
• 😍 @jerop
• 😍 @nbaudis
• 😍 @pritidesai
• 😍 @skaegi
• 😍 @vaikas
• 😍 @wlynch

🎉 Fix panic when pending pipelinerun is failed 🎉

-Docs @ v0.28.2
-Examples @ v0.28.2

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.28.2/release.yaml

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Fixes

• 🐛 Fix panic when pending pipelinerun is failed (#4306)

Fixed an issue where the PipelineRun reconciler could panic if a PipelineRun with spec.status set to PipelineRunPending was placed into a failed state before execution was able to begin.

Thanks

Thanks to these contributors who contributed to v0.28.2!

• ❤️ @sbwsg
• ❤️ @pritidesai

Extra shout-out for awesome release notes:

• 😍 @sbwsg
• 😍 @pritidesai

🎉 onError with workspaces, enforcing step timeout, and documentation for disabling ref resolution 🎉

-Docs @ v0.28.1
-Examples @ v0.28.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.28.1/release.yaml

Backwards incompatible changes

In current release:

• 🚨 Breaking change in the controller signatures

Breaking signature change in taskrun.NewController and pipelinerun.NewController to take advantage of pipeline.NewFlagOptions(flag.CommandLine) to reduce churn due to flag changes:

New Signature:

func NewController(opts *pipeline.Options) func(context.Context, configmap.Watcher) *controller.Impl {...}

Old signature:

func NewController(namespace string, conf ControllerConfiguration) func(context.Context, configmap.Watcher) *controller.Impl {...}

Fixes

• 🐛 V0.28 Cherry-Pick: disable resolution flag, onError with workspaces, enforce step timeout, and refactor controllers (#4263)

  • Fixing a bug where the specified step timeout was lost and not propagated to the entrypoint. This fix enforces the step timeout.

  • Fixing a bug where onError was not honored in presence of a workspace. Now, onError can be set to continue to ignore a step error in a task with a workspace.

  • Documented a controller flag that disables ref resolution in pipelineruns and taskruns.

  • (New in v0.28.1, will be part of v0.29.0) Downstream consumers of taskrun.NewController and pipelinerun.NewController will have to fix a breaking signature change; however, they can now take advantage of pipeline.NewFlagOptions(flag.CommandLine) to reduce churn due to flag changes.

Thanks

Thanks to these contributors who contributed to v0.28.1!

• ❤️ @pritidesai
• ❤️ @sbwsg
• ❤️ @mattmoor

Extra shout-out for awesome release notes:

• 😍 @pritidesai
• 😍 @sbwsg
• 😍 @mattmoor

🎉 Metrics options, better LimitRange support, marking Pod as Terminating and implicit parameters 🎉

-Docs @ v0.28.0
-Examples @ v0.28.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.28.0/release.yaml

⚠️ Known Issues

• #4483 Implicit parameter mapping incorrectly passes params from the top-level Pipeline or PipelineRun to taskRef Pipeline Tasks. Mapping should only occur from top-level resource to Pipeline Tasks with in-line taskSpec. This issue only affects users with enable-api-fields: alpha in the feature-flags ConfigMap stored in the tekton-pipelines namespace.

Changes

Features

• ✨ Support activeDeadlineSeconds for Tekton pods 🦌 (#4217)

Set activeDeadlineSeconds on Tekton's Pod so that they are considered Terminating for Kubernetes.
This helps supporting ResourceQuota a bit better as now Tekton Pipeline's pod are considered terminating and thus can be using a specific scoped ResourceQuota for those.

• ✨ Allow in param/result names via subscript. (#4215)

Parameter and result names may now contain . and be referenced via the subscript operator (e.g. $(params["foo.bar"])

• ✨ Add Configuration for Metrics Cardinality Simplification (#4201)

Metrics tags/labels type on taskrun/pipelinerun and task/pipeline can be eliminated metrics using configmap. Also, the type of metrics for duration - histogram or gauge/last value, can also be configured.

• ✨ Attempt to lookup cached entrypoint by digest, if possible (#4188)

Attempt to avoid incurring a rate limited image pull to lookup cached image entrypoints, if we can avoid it.

• ✨ Revamp how pipeline supports Limitranges (#4176)

Support fully LimitRange by taking into account the Min, Max, Default and DefaultRequest fields as well as the MaxLimitRequestRatio) to define the coherent Requests and Limits on the Pod.

• ✨ Add Cancelled Pipelinerun metrics (#4144)

Add Cancelled Pipelinerun metrics

• ✨ Add script mode support to windows tasks (#4128)

Add script mode support for windows Tasks/Pipelines

• ✨ Implement implicit parameter resolution. (#4127)

  • Tasks can now accept more parameters than are actually used.
  • Parameters can now be implicitly propagated to inlined specs (alpha feature flag must be enabled) -
    e.g. an inlined Task can access parameters of its parent PipelineRun without
    needing to explicitly define each param.

Backwards incompatible changes

In current release:

• 🚨 The default value for the new Step onError alpha feature has changed its name from fail to stopAndFail. #4151. Note: this only affects user of v0.27.0 as this behavior change was backported into v0.27.1.

• 🐛 Patch vendor/ apimachinery to work on 1.22 (#4164)

Backport adding Subresource field to ManagedField entries in our vendor/ folder to make tektoncd/pipeline work on k8s 1.22

• 🐛 Propagate Pipeline name label to PipelineRun (#4163)

pipeline name label is propagated to pipelinerun, even when the pipelinerun is pending or cancelled

• 🐛 Set the scripts dir to readonly after init (#4161)

Mount script workspace as readonly

• 🐛 Fix Concurrency issue in the metrics (#4222)
• 🐛 Un-randomize TestConvertScripts_WithBreakpoint_OnFailure (#4197)
• 🐛 Configure user.name in git_test.go run method. (#4192)
• 🐛 Don't modify the lister cache's copy. (#4180)
• 🐛 Switch from -Z to -w (#4178)

Misc

• 🔨 Remove the pkg/jsonpath library. (#4208)

The package pkg/jsonpath has been removed. This does not effect anyone using tektoncd/pipeline directly, but may break users importing this code as a library during an update. We're unaware of any usage of this package right now.

• 🔨 Converts ResultType from string to int enum (#4186)

• 🔨 cleaning up label keys 🧹 (#4154)

The constants defined for the Tekton specific labels now include GroupName(tekton.dev) in the definition, for example:

Before this change:
const TaskLabelKey = "/task"

After this change:
const TaskLabelKey = GroupName + "/task"

If you are importing these constants in your application from the pipeline source, you don't need to add GroupName anymore.

• 🔨 (cleanup) use skipping reason instead of existence of variables (#4147)

• 🔨 Poll for the status of Runs (#4213)

• 🔨 Add controller flag to turn off built-in resolution (#4168)

Introduce experimental flag to disable built-in resolution behaviour of the taskrun and pipelinerun reconcilers.

• 🔨 Add metadata to our publish task for Tekton Chains to observe & sign (#4156)

Tekton Pipelines releases are now signed by Tekton Chains.

• 🔨 Use an Informer to list LimitRanges 🥼 (#4234)
• 🔨 Remove unnecessary replace directives in go.mod (#4229)
• 🔨 Skipping the CI secret sauce 🦕 (#4221)
• 🔨 Bump github.com/cloudevents/sdk-go to v2.5.0 (#4216)
• 🔨 Switch the linter from golint to revive, and fix warnings. (#4212)
• 🔨 Make NewRecorder a proper singleton (#4210)
• 🔨 Don't rely on condition ordering. (#4209)
• 🔨 Remove the gosec Makefile target. (#4207)
• 🔨 Bump golangci-lint to v1.42.0 from v1.30.0. (#4206)
• 🔨 Bump the go-scm, docker/cli and docker/docker libraries. (#4205)
• 🔨 Adjust the way {pipeline,task}run metrics are surfaced. (#4204)
• 🔨 Bump the version of K8s clients and knative/pkg (#4198)
• 🔨 Improve the logging in pkg/git testing (#4191)
• 🔨 Deduplicate timeout constants. (#4189)
• 🔨 Add CE Client to dynamic injection (#4183)
• 🔨 Adjust several log lines (#4182)
• 🔨 Fix a small copy/pasta typo (#4181)
• 🔨 pkg/entrypoint: clean after running tests (#4175)
• 🔨 Remove confusing comment (◎_◎ (#4171)
• 🔨 Update to latest knative.dev/pkg (#4170)
• 🔨 Replace snooze with NewRequeueKey (#4131)

Docs

• 📖 Document Pipeline's use of Pod termination messages (#4226)

Our developer docs now include more details on how Tekton Pipelines uses Pod termination messages to communicate information between Task pods and the Tekton Pipelines controller.

• 📖 Add docs and examples for Windows (#4138)
• 📖 Docs for Metrics Configuration (#4218)
• 📖 Add doc links for 0.27.2 and 0.27.3 (#4203)
• 📖 Update readme with release 0.27.1 links (#4162)
• 📖 Update docs with 0.27.0 info (#4152)

Thanks

Thanks to these contributors who contributed to v0.28.0!

• ❤️ @06kellyjac
• ❤️ @DrWadsy
• ❤️ @aiden-deloryn
• ❤️ @bobcatfish
• ❤️ @dlorenc
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @khrm
• ❤️ @mattmoor
• ❤️ @pritidesai
• ❤️ @sbwsg
• ❤️ @sm43
• ❤️ @vdemeester
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @06kellyjac
• 😍 @DrWadsy
• 😍 @aiden-deloryn
• 😍 @bobcatfish
• 😍 @dlorenc
• 😍 @imjasonh
• 😍 @jerop
• 😍 @khrm
• 😍 @mattmoor
• 😍 @pritidesai
• 😍 @sbwsg
• 😍 @sm43
• 😍 @vdemeester
• 😍 @wlynch

🎉 Support for Kubernetes 1.22 🎉

-Docs @ v0.27.3
-Examples @ v0.27.3

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.27.3/release.yaml

Upgrade Notices

This is the first Tekton Pipelines release with support for Kubernetes 1.22. There are no other changes.

Changes

Fixes

• 🐛 Patch vendor/ apimachinery to work on 1.22 (#4164)

Backport adding Subresource field to ManagedField entries in our vendor/ folder to make tektoncd/pipeline work on k8s 1.22.

Thanks

Thanks to these contributors who contributed to v0.27.3!

• ❤️ @vdemeester

🎉 Bug Squashed in PipelineRun<->Pipeline Labelling 🎉

-Docs @ v0.27.2
-Examples @ v0.27.2

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.27.2/release.yaml

Changes

Fixes

• 🐛: Propagate Pipeline name label to PipelineRun (#4163)

This bug fix allows PipelineRuns started in a Pending or Cancelled state to be identified using label queries for the associated Pipeline name.

Thanks

Thanks to these contributors who contributed to v0.27.2!

• ❤️ @jerop

🎉 Tekton Pipelines' images now signed by Tekton Chains 🎉

-Docs @ v0.27.1
-Examples @ v0.27.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.27.1/release.yaml

Changes

Features

• ✨ Tekton Pipelines' images are now being signed by Tekton Chains with Tekton's public key. Verify them with cosign).

Backwards incompatible changes

In current release:

• 🚨 The default value for the new Step onError alpha feature has changed its name from fail to stopAndFail. #4151

Thanks

Thanks to these contributors who contributed to v0.27.1!

• ❤️ @bobcatfish
• ❤️ @pritidesai
• ❤️ @priyawadhwa
• ❤️ @sbwsg

🎉 Step onError Handling, Skipping Strategies and Custom Task Timeouts! 🎉

-Docs @ v0.27.0
-Examples @ v0.27.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.27.0/release.yaml

Upgrade Notices

⚠️ Kubernetes 1.19 is the new minimum required version. ⚠️

Changes

Features

• ✨ TEP-0040 Specifying onError behaviour for Steps (#4106)

This is a brand new Alpha feature: Use onError: continue for a Step if you would like to ignore any errors and continue executing the rest of the Steps in a Task. When onError is set to continue, the Step's exit code is recorded and made available to subsequent Steps via two new variables in Tasks. A Step with onError set to continue does not fail a TaskRun and continues executing the rest of the steps in a task.

The default value for the onError field is fail, which matches existing Step behavior: an error results in the Task stopping and entering a failed state. 🚨 NOTE The name of the default value may change in a subsequent release from fail to stopAndFail to make this behaviour more explicit. Follow https://github.com/tektoncd/community/pull/497 to keep informed about this potential change. A Backwards Incompatibility note will be included with the release if this change moves ahead. 🚨

• ✨ TEP-0059 Skipping Strategies (#4085)

⚠️ This is a change to existing behaviour. It is behind its own feature flag to give time to adapt. ⚠️

When Expressions are changing scope: in a future release (and today, if you enable the flag) a when stanza will guard only the Task it is attached to instead of the Task and all of its dependents. To guard both a Task and its dependents the when stanza will need to be attached to each dependent Task as well. This change will roll out for all users of v1beta1 resources in 9 months, per our beta deprecation policy, and will be the default behaviour for When Expressions in any new apiVersions of Tekton's resources going forward.

New Feature Flag: scope-when-expressions-to-task
Default Value: "false"

To guard a Task only and unblock execution of its dependent Tasks, set the scope-when-expressions-to-task feature flag to "true".

Action Required: when expressions guarding a Task and its dependent Tasks is deprecated and will be removed - migrate by setting scope-when-expressions-to-task feature flag to "true" and updating your Pipelines to cascade when expressions to subsequent Tasks as needed.

For the rationale and use-cases that inspired this change please see TEP-0059.

• ✨ Implement timeout for custom tasks. (#3976)

⚠️ Existing custom task controllers will need to add support for this new field - by default it will be ignored. ⚠️

Custom Tasks can now include a timeout as part of their spec. Custom Task controllers can add support for responding to this field with new behaviour such as cleanup processes. Here's an example usage in a Run leveraging the TaskLoop Custom Task controller:

apiVersion: tekton.dev/v1alpha1
kind: Run
metadata:
  generateName: simpletasklooprun
spec:
  timeout: 10s # set timeout here.
  params:
    - name: word
      value:
        - jump
        - land
        - roll
    - name: suffix
      value: ing
  ref:
    apiVersion: custom.tekton.dev/v1alpha1
    kind: TaskLoop
    name: simpletaskloop

• ✨ A new label for TaskRuns to identify their place in Pipelines (#4121)

TaskRuns and Runs in a Pipeline will now receive an additional label, tekton.dev/memberOf. The value of this label will be: tekton.dev/memberOf=tasks for entries in the "tasks" section of a Pipeline and tekton.dev/memberOf=finally for entries in the "finally" section of a Pipeline.

• ✨ Add variable expansion in the workspaces.mountPath field of Tasks (#3934)

Users are now able to utilize variable substitution in the mountPath field of a Workspace within a Task. This is useful, for example, to parameterize the directory under which source code from a Workspace should appear in a Task's filesystem.

Deprecation Notices

• 🚨 Early Warning: When Expressions will change their scope in a future release

Please see the "Skipping Strategies" feature description above for fuller information. In short: When Expressions currently guard both a Task and all of that Task's dependents. In future this behaviour will be changed so that When Expressions only guard the Task they are attached to. As part of this release a new feature flag has been added called scope-when-expressions-to-task. The default value is "false", indicating no immediate change to behaviour. In 9 months, per our beta deprecation policy, this value will be changed to "true" by default and eventually the flag will be removed completely. It is strongly advised that you assess your current suite of Pipelines for any impact this change might have on you and your teams. (#4085).

Fixes

• 🐛 Graceful Termination: Cancelled Task is Failed (even with Retries) (#4136)

PipelineTasks with retries that were "gracefully cancelled" could result in a PipelineRun being left in a hung state. This has been fixed.

• 🐛 Invalidate passing Results between Finally Tasks (#4132)

Pipelines that attempted to pass results from one Finally Task to another were not being caught during validation. This is not supported because Finally Tasks are not allowed to have dependencies among themselves. This has been fixed.

In addition this bug fix also dramatically improves the validation of Finally Tasks by ensuring that all validation errors are returned to the user at once rather than only the first error that was encountered.

• 🐛 Mark webhook and controller as safe-to-evict (#4124)

By default, controller components are now marked as safe-to-evict by the cluster autoscaler. See docs/enabling-ha.md for more details.

• 🐛 Passes pipelines/tasks from bundles through defaulting before execution (#4117)

Pipelines and Tasks fetched from Tekton Bundles were not being passed through a defaulting step before being validated, which could result in spurious validation errors. This has been fixed.

• 🐛 Loosen permission checks on TestCp to handle umasks. (#4100)

• 🐛 support referencing array params in when expression values (#4075)

When expression values can now use array parameter references, for example: values: [$(params.arrayParam[*])]

Misc

• 🔨 Update to latest knative.dev/pkg (#4129)
• 🔨 Fix Example with Completed and Succeeded Execution Status (#4140)
• 🔨 Add e2e tests for Windows (#4139)
• 🔨 Get default sa from configmap defaultconfigs (#4095)
• 🔨 Small entrypoint unit test fixes prior to 0.27 release (#4149)
• 🔨 Switch Errorf to Fatalf in retry tests. (#4133)
• 🔨 Use knative.dev/pkg/changeset (#4126)
• 🔨 Use controller.FilterController(&v1beta1.TaskRun{}) (#4113)
• 🔨 Drop the tracker. (#4111)
• 🔨 Take advantage of kmeta.OwnerRefable. (#4110)
• 🔨 cleanup - homeDir constant and hardcoded path (#4079)
• 🔨 Cleanup multi-arch tests (#4045)

Docs

• 📖 GoogleContainerTools/skaffold mainline branch is called 'main' rather than 'master' (#4120)
• 📖 docs: rename to expressions (#4104)
• 📖 Add WhenExpressions to variable substitution documentation (#4091)
• 📖 updating readme to include 0.26 (#4089)
• 📖 minor doc fix (#4109)
• 📖 Fix misplaced fields in API spec (#4094)
• 📖 Always refer to "finally" tasks 📖 (#4090)
• 📖 Add issue link to comment in controller yaml (#4088)

Thanks

Thanks to these contributors who contributed to v0.27.0!

• ❤️ @ScrapCodes
• ❤️ @aiden-deloryn
• ❤️ @barthy1
• ❤️ @bobcatfish
• ❤️ @imjasonh
• ❤️ @jerop
• ❤️ @khalkie
• ❤️ @kim-fitness
• ❤️ @mattmoor
• ❤️ @praveen4g0
• ❤️ @pritidesai
• ❤️ @sbwsg
• ❤️ @sm43
• ❤️ @wlynch

Extra shout-out for awesome release notes:

• 😍 @ScrapCodes
• 😍 @aiden-deloryn
• 😍 @imjasonh
• 😍 @jerop
• 😍 @khalkie
• 😍 @kim-fitness
• 😍 @mattmoor
• 😍 @praveen4g0
• 😍 @pritidesai
• 😍 @sm43
• 😍 @wlynch

🎉 Debugging taskRuns and Merging podTemplates with default 🎉

-Docs @ v0.26.0
-Examples @ v0.26.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.26.0/release.yaml

Upgrade Notices

N/A

Features

• ✨ Merge *Run's PodTemplate with Default 🧙 (#4057)

TaskRun and PipelineRun's PodTemplate are now merge with the default PodTemplate. This means any field that is not specified in a TaskRun or PipelineRun's PodTemplate will come from the configured default PodTemplate (if defined).

• ✨ Add debug with breakpoint onFailure to TaskRun Spec (#3857)

  • Add -breakpoint_on_failure to entrypointer which disables exit of container upon failure
  • Add debug helper scripts to /tekton/debug/scripts
  • Add /tekton/debug/info/ mount which is used by helper scripts to understand which step they are running in where denotes the step number. First step = 0, Second step = 1 and so on.

Deprecation Notices

N/A

Backwards incompatible changes

N/A

Fixes

• 🐛 Set HOME=/tekton/home for GCS PipelineResources (#4081)

Fixed bug where GCS PipelineResource failed to upload unless HOME="/tekton/home" was explicitly set in task's pod template.

• 🐛 Fix the cp command in the release publish task (#4051)

Misc

• 🔨 Set fake AWS credentials on controller to workaround aws-sdk bug (#4073)

Work around a bug in the AWS go SDK that causes extremely long delays in task startup times.

• 🔨 Update knative/pkg to v0.23 and k8s.io to v0.20.7 (#4044)

Bump k8s.io and knative dependencies to v0.20.7 and v0.23.0 respectively, taking latest fixes and features in.

• 🔨 cleaning up task results constant (#4070)

• 🔨 Replace tmpfile with scriptfile in script init container (#4041)

Docs

• 📖 Updates to pipeline tutorial to handle skaffold Dockerfile and keep the yq syntax working (#4058)

  1. Updated kaniko executor image to latest
  2. Added --build-arg=BASE=alpine:3 to have kaniko correctly handle the skaffold leeroy-web Dockerfile (had the issue described in https://github.com/GoogleContainerTools/kaniko/issues/1271 before)
  3. Changed mikefarah/yq image to 3.4.1 (the latest working with the provided command) in deploy-using-kubectl task to get this working (ver. 4 changed the syntax completely: https://mikefarah.gitbook.io/yq/upgrading-from-v3, so the command gave a syntax error)

• 📖 Add v0.25.0 to the README (#4043)

• 📖 Update comment on RunControllerName const (#4065)

• 📖 Adjust weight in hermetic.md (#4056)

• 📖 Fix broken link (#4054)

• 📖 docs: update metrics name (#3945)

Thanks

Thanks to these contributors who contributed to v0.26.0!

• ❤️ @afrittoli
• ❤️ @eliasnorrby
• ❤️ @ggalloro
• ❤️ @jerop
• ❤️ @pritidesai
• ❤️ @pugangxa
• ❤️ @sbwsg
• ❤️ @vdemeester
• ❤️ @waveywaves
• ❤️ @zhouhaibing089

Extra shout-out for awesome release notes:

• 😍 @ggalloro
• 😍 @jerop
• 😍 @sbwsg
• 😍 @vdemeester
• 😍 @waveywaves

🎉 Hermetic Execution, Embedded Custom Tasks and Graceful Termination & Timeouts 🎉

-Docs @ v0.25.0
-Examples @ v0.25.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.25.0/release.yaml

Upgrade Notices

N/A

Features

• ✨ Add ConfigMap which can contain pipelines info and RBAC to access this ConfigMap (#3971)

• ✨ Add support for experimental hermetic execution mode to TaskRuns (#3956)

  Add support for experimental hermetic execution mode to TaskRuns

• ✨ Graceful Pipeline Run Termination (#3915)

  The new PipelineRun spec statuses have been added to control the way who a PipelineRun is being canceled or stopped.

  • "StoppedRunFinally" - To stop (i.e. let the tasks complete, then execute finally tasks) a PipelineRun
  • "CancelledRunFinally" - To cancel (i.e. interrupt any executing non finally tasks, then execute finally tasks)
  • "Cancelled" - replaces today's "PipelineRunCancelled" - i.e. interrupt any executing tasks without running finally tasks

  Support for existing statuses has been left unchanged. The status "PipelineRunCancelled" is deprecated and replaced by "Cancelled" (it would be removed in v1). The new states are released as alpha API features. Read more in TEP#0058.

• ✨ TEP-0061, Allow custom task to be embedded. (#3901)

  It is now possible to embed the spec of a custom task in a Run resource, whether stand-alone or embedded in a Pipeline.

  • API changes, This PR adds new APIs i.e. adds a field Spec *EmbeddedRunSpec to RunSpec
  • An embedded task will accepts new field Spec with type runtime.RawExtension in addition to
    ApiVersion and Kind fields of type string (as part of runtime.TypeMeta)
  • Validation changes, in addition to adding support for Run.RunSpec.Spec the validations will be changed
    to support "One of Run.RunSpec.Spec or Run.RunSpec.Ref " only and not both as part of a single
    API request to kubernetes.

  action required: Developers of custom controllers (existing and new), who would like to support
  embedded spec for their custom task, need to implement the logic required to extract, validate
  and use the custom task spec from the new RunSpec.Spec field. Please review the documentation
  on upgrading, for more details and some examples.

• ✨ Add a Timeouts optional field to pipelinerun (#3843)

  • API changes
    • Added field Timeouts to PipelineRun spec. It is a dict with the following sub-fields
      • pipeline, to control the pipeline failure timeout
      • tasks, to control the pipeline tasks failure timeout
      • finally, to control the pipeline finally tasks failure timeout
  • Changes in behavior
    • When supplied, a timeouts field combination permits deciding which part of the pipeline runtime is allocated to tasks and finally tasks.

• ✨ Add variables context.pipelineTask.retries and context.task.retry-count (#3770)

Deprecation Notices

• 🚨 "PipelineRunCancelled" is deprecated

  The status "PipelineRunCancelled" is deprecated and replaced by "Cancelled" (it would be removed in v1) (#3915)

Backwards incompatible changes

N/A

Fixes

• 🐛 Fix Windows image entrypoint paths for parity with Linux (#4018)

• 🐛 A custom task check could be true, even though the Provided Spec is invalid. (#4005)

• 🐛 Fix Workspaces in Sidecar to be serialized as workspaces not Workspaces (#3966)

• 🐛 Encode scripts as base 64 to avoid k8s mangling 40 (#3963)

  Scripts in Tasks are now written into the Task's pod using base64 to avoid kubernetes' built-in arg processing. This means they're a little larger than they were prior to this release but otherwise should continue working as expected.

• 🐛 Only fetch the definitions once 🧙 (#3941)

  Only fetch the definition once, and then used the spec stored in the status as source of truth.
  This reduce the probable race condition when a PipelineRun or a TaskRun refers to a Pipeline or Task that changes during its execution.

• 🐛 Skip heavy validation on deletion 🙃 (#3937)

  Skip heavy validation on deletion in the webhook

• 🐛 Validate run for both ref and spec as nil. (#3977)

Misc

• 🔨 Revert Fix issue with 69 in Script blocks (#3938)

  Revert fix for instances of "$$" in script blocks. Kubernetes replaces "$$" with a single "$" and your scripts need to deal appropriately with these instances.

• 🔨 Cleanup integraton tests for multi-arch case (#3998)

• 🔨 Fix list of proposed kind labels for PRs (#3987)

• 🔨 Use tektoncd/results repo for git-init symbolic ref tests (#4038)

• 🔨 Add Dockerfiles for Windows entrypoint and nop images (#3996)

• 🔨 Add hermetic test running as non-root user (#3973)

• 🔨 Change the way we run e2e tests with feature gates in pipelines (#3930)

Docs

• 📖 Update api-spec.md to fix some formatting (#4030)

• 📖 Add v0.24.2 to the README (#4015)

• 📖 Fix minor typo in auth docs (#3992)

• 📖 Document how to use the kind tool and the Tekton/plumbing convenience script (#3972)

  Documenting how to use the kind tool to setup the development environment.

• 📖 Organize DEVELOPMENT.md, provide consistent examples & reflect go mod support (#3955)

  Organized DEVELOPMENT.md to provide more consistent examples and instructions.

• 📖 Link to docs and examples for v0.24.3 (#4031)

• 📖 Update docs to use Kubernetes 1.18 as the minimum version (#3986)

• 📖 docs(pipelines): specify how to reference an array parameter (#3967)

• 📖 Document the safe-to-evict annotation on the webhook deployment (#3961)

• 📖 Add missing frontmatter to some docs (#3958)

• 📖 Update pipelines.md (#3946)

• 📖 Link to docs and examples for v0.24.1 (#3944)

• 📖 Format code blocks with prettier (#3911)

Thanks

Thanks to these contributors who contributed to v0.25.0!

• ❤️ @R2wenD2
• ❤️ @ScrapCodes
• ❤️ @afrittoli
• ❤️ @aiden-deloryn
• ❤️ @barthy1
• ❤️ @eliasnorrby
• ❤️ @imjasonh
• ❤️ @jeffmaury
• ❤️ @jerop
• ❤️ @jmlrt
• ❤️ @mrutkows
• ❤️ @n3wscott
• ❤️ @nikhil-thomas
• ❤️ @priyawadhwa
• ❤️ @rafalbigaj
• ❤️ @rguichard
• ❤️ @sbwsg
• ❤️ @souleb
• ❤️ @vdemeester
• ❤️ @vinamra28
• ❤️ @yaoxiaoqi

Extra shout-out for awesome release notes:

• 😍 @R2wenD2
• 😍 @ScrapCodes
• 😍 @aiden-deloryn
• 😍 @jeffmaury
• 😍 @jerop
• 😍 @mrutkows
• 😍 @nikhil-thomas
• 😍 @priyawadhwa
• 😍 @rafalbigaj
• 😍 @sbwsg
• 😍 @souleb
• 😍 @vdemeester
• 😍 @vinamra28
• 😍 @yaoxiaoqi

🎉 Align to v0.24.1, Setup WorkingDir for place-tools (#3978) 🎉

-Docs @ v0.24.3
-Examples @ v0.24.3

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.24.3/release.yaml

Changes

Fixes

• 🔨 Setup WorkingDir for place-tools init container to avoid permission error (#4025)

Fixes bug #3978

• 🔨 Release v0.24.3 (#4024)

This is a minor release to fix the delta between v0.24.1 and v0.24.2.

Release v0.24.1 included by mistake three extra commits.
The next minor release v0.24.2 did not include them, but the difference is problematic: https://github.com/tektoncd/pipeline/issues/4017

Release v0.24.3 builds on top of v0.24.2 and restores the three extra commits:

• https://github.com/tektoncd/pipeline/commit/d3666c263237a88bb02f68d9173a9fff7b5fd50e

`WhenExpressions` no longer support PascalCase fields, they only support lowercase fields

action required: if you applied a `Pipeline` with `WhenExpressions` in v0.16, you have to reapply it 

• https://github.com/tektoncd/pipeline/commit/bf511ddbb8392e3be8036ef697315f7d36089f7f
• https://github.com/tektoncd/pipeline/commit/b31327bd83512658fdcc61f12806dfad41353a40

Thanks

Thanks to these contributors who contributed to v0.24.3!

• ❤️ @barthy1
• ❤️ @jerop
• ❤️ @sbwsg
• ❤️ @afrittoli

Extra shout-out for awesome release notes:

• 😍 @jerop
• 😍 @afrittoli