Verify that all container images in the attestation are in the release file:
RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.6.0/release.yaml
REKOR_UUID=108e9186e8c5677a288ca8343f66259e4a615801fa37703480d82893d1c6a45a2935a6632beb4164
# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.6.0@sha256:" + .digest.sha256')
# Download the release file
curl "$RELEASE_FILE" > release.yaml
# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
:sparkles: feat: implement shared cache for bundle, git, and cluster resolvers (#9051)
Support caching for bundle, git, and cluster resolvers, reducing redundant fetches and improving pipeline performance.
Key Features:
Automatic caching for immutable references (digest-based bundles, git SHAs)
Three cache modes: always (cache everything), never (disable caching),auto (cache only immutable references - default)
Configurable via ConfigMap: Set cache size and TTL without restarting controllers
Per-task override: Tasks can override global cache settings using the cache parameter
Observability: Cache hits/misses and timestamps added to resource annotations
This helps reduce external API calls, improves pipeline exec speed, and provides better resilience during remote resource resolution.
:sparkles: feat: resolve array values in Input of When expressions (#9038)
Array values can now be resolved in the Input attribute of When expressions
:sparkles: Issue 9032 - Add support for step display name (#9033)
A Pipeline can now execute embedded Pipelines (Pipelines-in-Pipelines) using the PipelineSpec field under tasks. Refer to the TEP-0056 for more details.
Fixes
:bug: fix: do not fail PipelineRun when TaskRef reconciles with retryable err (#9099)
With this change, unknown DryRunValidation errors during TaskRef and PipelineRef resolution no longer cause PipelineRuns and TaskRuns to fail. Explicit Validation errors will still cause the Run to fail.
:bug: Added signal handling in SidecarLog results to support Kubernetes-native sidecar functionality (#9095)
Added signal handling to SidecarLog to support Kubernetes-native sidecar functionality, preventing repeated restarts of the init container.
:bug: Pods for timed out TaskRuns should not be deleted when keep-pod-on-cancel feature flag is true (#9075)
If Feature flag "keep-pod-on-cancel" is set to true then pods corresponding to TaskRun will be not be deleted when TaskRun Times Out. Earlier pod was retained only if it taskrun was canceled.
:bug: fix(taskrun): ensure status steps are ordered correctly when using StepAction (#9039)
Binary file (standard input) matches
:bug: entrypoint: handle linux in pkgs/platforms (#9096)
:bug: test/e2e: remove data race on global variable requireAlphaFeatureFlag (#9067)