Skip to content

chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0 - #1385

Open
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/github.com-openshift-pipelines-pipelines-as-code-0.x
Open

chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0#1385
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/github.com-openshift-pipelines-pipelines-as-code-0.x

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/openshift-pipelines/pipelines-as-code v0.36.0 → v0.49.0 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

openshift-pipelines/pipelines-as-code (github.com/openshift-pipelines/pipelines-as-code)

v0.49.0

Compare Source

Pipelines as Code version v0.49.0

Tekton Pipelines as Code v0.49.0 has been released 🥳

✨ Major changes and Features

  • Automatic GitLab access token rotation: When enabled, tokens approaching expiration (within 7 days) are automatically rotated by requesting a new token from the GitLab API and updating the Kubernetes Secret. Opt-in via spec.settings.gitlab.token_auto_rotation: true on the Repository CR or globally via the global Repository CR.
  • Forgejo CLI webhook setup: Added Forgejo support to tkn pac create repo and tkn pac webhook add, creating repository webhooks with the vendored Forgejo SDK for push, pull_request, and issue_comment events.
  • Bitbucket Data Center service account support: Removed the requirement to configure a user when using HTTP scoped tokens from project and repository scopes, allowing direct use of scoped token context for authentication.
  • Forgejo org team caching in policy check: Cache ListOrgTeams API responses per organization to avoid redundant API calls when checking policy for the same org across multiple allowed teams evaluations.
  • Bitbucket Cloud API token authentication: Switched Bitbucket Cloud authentication from app-passwords to scoped API tokens for improved security. CLI now prompts for Atlassian account email and uses x-token-auth username for git clone credentials.
  • Direct OTel SDK tracing setup: Switched tracing from Knative's config-observability to the OTel SDK directly, enabling parentbased_* samplers via OTEL_TRACES_SAMPLER so the whole trace chain is kept or dropped together.

🐛 Bug Fixes

  • Fix reconciler shared state race: Removed per-reconciliation state (globalRepo, secretNS) from the shared controller struct, preventing concurrent reconciliations from overwriting each other's namespace decisions.
  • Fix GitLab label removal triggering pipelines: Label removal events on GitLab merge requests were incorrectly triggering pipeline runs. Changed to compare current vs previous label count so only label additions are processed.
  • Fix AI analysis for successful pipeline runs: Default AI/LLM roles without an on_cel expression now run for completed PipelineRuns regardless of success or failure, not just failed runs.
  • Downgrade 404 API responses to debug log level: Missing-file 404 responses (e.g., missing OWNERS file) are now logged at debug level instead of error, keeping controller logs clean.
  • Enhance cancel-in-progress log message: Added a reason in the log message explaining why a PipelineRun is cancelled to make it clearer to users.
  • Fix error wrapping in DetectPacInstallation: Use %w instead of %s for error wrapping to preserve the error chain for errors.Is/errors.As.
  • Security: upgrade Go stdlib to go1.26.4: Fixes 23 Go standard library CVEs including XSS, DoS, and TLS issues.
  • Security: upgrade golang.org/x/net to v0.55.0: Fixes 6 CVEs in HTML parsing and DNS handling.
  • Security: upgrade golang.org/x/crypto to v0.52.0: Fixes 13 critical SSH-related CVEs.
  • Security: upgrade tektoncd/pipeline to v1.14.0: Fixes CVE-2026-33022 (controller panic via long resolver name).

📚 Documentation Updates

  • Clarify task resolution in pipeline documentation: Document the difference between PAC remote task annotations and native Tekton resolver syntax, preventing taskRef.name + taskRef.resolver conflicts.
  • Document required custom console settings: Added notes clarifying that custom-console-url-pr-details, custom-console-url-namespace, and custom-console-url-pr-tasklog must all be configured when custom-console-url is set.
  • Add validation failure note to GitLab comment strategy: Clarify that comment_strategy: "disable_all" only applies to PipelineRun status comments; validation failure comments are always posted.
  • Update Homebrew installation instructions: Document Homebrew tap trust requirement for 5.2+ and macOS Gatekeeper quarantine attribute workaround.

⚙️ Chores

  • Bump tektoncd/pipeline to v1.13.1: Co-upgrades cel-go, go-scm, otel, zap, k8s.io, and grpc dependencies.
  • Add Codecov OIDC upload: Moved unit coverage publishing to a dedicated GitHub Actions workflow using Codecov OIDC.
  • Use official ArtifactHub StepActions for git-clone: Replace the vendored git-clone StepAction with a reference to the upstream tektoncd catalog via the hub resolver.
  • Bump actions/checkout from 6.0.2 to 7.0.0: Updated CI checkout action across two dependency bump PRs.
  • Bump actions/setup-go from 6.4.0 to 6.5.0: Updated CI Go setup action.
  • Bump actions/cache from 5.0.5 to 6.1.0: Updated CI cache action.
  • Bump ko-build/setup-ko from 0.9 to 0.10: Updated ko setup action.
  • Configure Dependabot to group GitHub Actions updates: Group all GitHub Actions dependency updates into a single weekly PR.
  • Enforce gofumpt formatting check in lint pipeline: Added lint-fmt Makefile target and CI step to verify Go formatting with gofumpt.
  • Remove testrr test reporting: Removed unused testrr integration, upload script, and CI environment variables.
  • Reformat code with fumpt: Code reformatted for consistency with Go formatting standards.
  • CI fixes: Multiple CI/CD fixes including gosmee TLS verification, e2e workflow triggers, fork PR checkout, YAML document markers, and vale linting.
  • Add Gitea parse_payload unit tests: Table-driven tests for pull request, push, and error paths.

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.49.0/release.yaml
Kubernetes
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.49.0/release.k8s.yaml
Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.49.0

Changelog

v0.48.1

Compare Source

Pipelines as Code version v0.48.1

OpenShift Pipelines as Code v0.48.1 has been released 🥳

This release is exclusively for bumping go version to 1.26.4 in fa5b3da

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.1/release.yaml
Kubernetes
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.1/release.k8s.yaml
Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.48.1

Changelog

v0.48.0

Compare Source

Pipelines as Code version v0.48.0

OpenShift Pipelines as Code v0.48.0 has been released 🥳

[!IMPORTANT]
This is a security release. It includes fixes for GitHub Enterprise header hijacking, webhook secret leakage in logs, and GitHub App token over-scoping. All users are encouraged to upgrade as soon as possible.

✨ Major changes and Features

  • TLS configuration support: Add configurable TLS settings (min version, cipher suites, curve preferences) for the PAC controller via deployment environment variables, allowing the Tekton Operator to propagate TLS configuration without code changes.
  • Deprecation warnings for Tekton Hub integration: Deprecated the Tekton Hub catalog integration across documentation, configuration, and resource resolution. The public Tekton Hub has been shut down, and support for self-hosted Tekton Hub instances is now formally deprecated ahead of full removal in a future release.
  • Gitea remote task resolution: Enable Gitea/Forgejo provider to resolve remote taskRef URLs using the provider's authenticated API instead of returning "not supported". Supports branch, tag, and commit SHA URL formats.

🐛 Bug Fixes

  • Prevent GitHub Enterprise header hijacking: Validate webhook signature before minting App tokens and restrict the GitHub Enterprise host header to prevent an attacker from redirecting token requests to an arbitrary host.
  • Redact query string from incoming webhook log: Fix secret leakage in the incoming-webhook handler where the full URL including ?secret=<value> was logged verbatim. Now logs only the URL path.
  • Scope GitHub App token and deep-copy cached remote resources: Scope GitHub App token to the triggering repository when no extra scope config is present, preventing remote task annotations from accessing private repos. Also deep-copy cached remote Pipeline and Task objects before inlining to prevent mutation from contaminating subsequent PipelineRuns.
  • Remove unused secrets/delete permission from controller: Remove the unused cluster-wide secrets/delete permission from the controller ServiceAccount, following the principle of least privilege.
  • Enable controller profiling: Bump knative/eventing to v0.49.0 which includes the pprof server fix so controller profiling actually works, and update the profiling guide for the OpenCensus to OpenTelemetry migration.

⚙️ Chores

  • Preserve dots in image tags for version tag pushes: Fix container workflow tag sanitization to keep dots in version tags, ensuring release manifests reference the correct image tags.
  • Update incoming webhook legacy params deprecation message: Update the deprecation message for secret passing in URL query parameters.
  • Parse JSON test output for Slack notifications: Switch CI notify-slack script to parse JSON test output instead of the nonexistent log file.
  • Bump mxschmitt/action-tmate from 3.23 to 3.24: Updated CI dependency to latest version.

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.0/release.yaml
Kubernetes
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.0/release.k8s.yaml
Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.48.0

Changelog

v0.47.0

Compare Source

Pipelines as Code version v0.47.0

OpenShift Pipelines as Code v0.47.0 has been released 🥳

✨ Major changes and Features

  • CEL string and list extension functions: Unlocks join(), replace(), substring(), split(), trim(), upperAscii(), lowerAscii() and other standard CEL string/list operations in on-cel-expression annotations and {{ cel: }} template expressions.
  • GitHub API rate limit Kubernetes event: Emits a Kubernetes Repository event when the GitHub API rate limit is exhausted, surfacing the issue to operators via kubectl describe.

🐛 Bug Fixes

  • Bitbucket Data Center: detect file changes on merged PR push: Fixes on-path-change and on-cel-expression filters silently skipping PipelineRuns when the push event is a merge commit with no listed file changes; the Bitbucket /changes API is now used to diff the actual modified files.
  • Skip key=value arguments as PipelineRun names in /test: When a user posts /test custom1=value, the key=value argument was incorrectly treated as a PipelineRun name and bypassed on-comment annotation matching; it is now correctly passed through as a parameter.
  • Label value sanitization and normalization: Ensures Kubernetes label values (e.g. branch names) are sanitized to comply with the 63-character limit and valid character set rules, preventing label validation errors.
  • Reconciler: skip watcher status updates: Fixes a regression introduced in #​2667 that caused forbidden errors on clusters where the watcher service account lacks pipelineruns/status update permissions; the generated status sync is now disabled for the watcher.
  • GitLab: post informative comment on inaccessible fork MR: When a merge request originates from a fork the bot cannot access, PAC now posts a comment on the MR explaining the situation rather than silently failing.

⚙️ Chores

  • Fix documentation reference in formatting package: Corrected the godoc comment in CleanValueKubernetes to point to the right Kubernetes label specification.
  • Update golangci-lint configuration: Replaced deprecated gomodguard linter with gomodguard_v2 and disabled the inline govet check to reduce false positives.
  • Update golangci-lint to v2.12.2: Bumped the CI golangci-lint image to match the updated linter configuration.

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.47.0/release.yaml
Kubernetes
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.47.0/release.k8s.yaml
Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.47.0

What's Changed

New Contributors

Full Changelog: tektoncd/pipelines-as-code@v0.46.0...v0.47.0

Changelog

v0.46.0

Compare Source

Pipelines as Code version v0.46.0

OpenShift Pipelines as Code v0.46.0 has been released 🥳

✨ Major changes and Features

  • Distributed tracing for webhook handling and PipelineRun timing: When tracing is enabled via the pipelines-as-code-config-observability ConfigMap, PaC emits OpenTelemetry trace spans for webhook event processing and PipelineRun lifecycle timing, with W3C trace context propagation.
  • Implement GetCommitStatuses on Forgejo: The Forgejo/Gitea provider now returns real commit statuses instead of nil, enabling the annotation matcher to correctly detect pruned-but-successful pipeline runs so /retest only re-runs failed pipelines.
  • Enable recursive .tekton dir retrieval for Forgejo: PipelineRuns nested in subdirectories under .tekton/ are now discovered and executed on Forgejo, instead of only top-level entries.
  • Handle Forgejo headers in CLI provider auto-detection: The tkn pac cel command now recognizes X-Forgejo-Event-Type headers for automatic Forgejo webhook provider detection.
  • Reduce informer cache memory usage: Added TransformFuncs to Repository and PipelineRun informers that strip large unnecessary fields (ManagedFields, Annotations, Status, Spec) before objects enter the cache.
  • Cache check-run lookups with retry: GitHub check-run API responses are now cached to avoid repeated paginated API calls during status updates, with concurrent goroutines sharing a single in-flight fetch.

🐛 Bug Fixes

  • Fix /ok-to-test not triggering CI on GitHub webhook PRs: The GitHub client was never initialized for webhook-based issue comment events, causing /ok-to-test from an admin to silently fail on unauthorized PRs.
  • Clear pending check on ok-to-test for GitHub webhook: The pending check run created for unauthorized PRs was never resolved after an admin commented /ok-to-test, leaving it stuck indefinitely.
  • Update /ok-to-test status to success for GitLab: Similar to Forgejo, GitLab now updates the "pending approval" commit status to success after /ok-to-test is posted on an unauthorized user's MR.
  • Pin GitLab commit statuses to the same pipeline: Caches the pipeline_id from the first SetCommitStatus response so all subsequent status updates for the same SHA stay on the same GitLab pipeline, preventing split statuses.
  • Map GitLab skipped status correctly: Use gitlab.Skipped state instead of gitlab.Canceled when the conclusion is skipped, so GitLab pipelines show the correct skipped status.
  • Restrict same-repo ACL permission to trusted context: Issue comment senders are no longer granted trust based solely on same-repo PR shape; they must pass collaborator, org-membership, or OWNERS checks.
  • Guard nil response and cap comment pagination in ACL checks: Prevents a panic when wrapAPI returns a nil response on transport-level failures, and caps comment pagination to avoid unbounded API calls.
  • Prevent duplicate Repository CR on trailing slash: The webhook admission controller now normalizes URLs before comparison, preventing bypass of uniqueness validation by appending a trailing slash.
  • Use provided target ref in GetFileInsideRepo: Fixed GetFileInsideRepo ignoring the caller-supplied target ref and substituting runevent.BaseBranch, which caused OWNERS ACL and remote task fetches to resolve against the wrong branch.
  • Resolve CEL expression failure on Bitbucket Cloud push events: Push events incorrectly set Event to a string instead of a JSON object, causing all CEL expressions to fail with an unmarshal error.
  • Truncate Bitbucket Cloud commit status key to 40-char limit: Bitbucket Cloud limits commit status keys to 40 characters; status keys are now properly truncated.
  • Use pull request number from issue comment payload: Use the PR number directly from the issue comment payload instead of parsing it from the pull request URL.
  • Fix skip-install option in bootstrap command: The bootstrap process now correctly allows users to bypass the installation check, preventing failures when Pipelines as Code is already installed.

📚 Documentation Updates

  • Align CLI docs and install guidance: Standardized Homebrew installation instructions, fixed README quickstart bootstrap example, expanded the CLI index, and clarified bootstrap github-app behavior.
  • Fix incorrect Forgejo webhook signature validation claim: Corrected the documentation that incorrectly stated PAC does not validate webhook signatures for Forgejo/Gitea — HMAC-SHA256 validation is fully implemented.
  • Update release notes documentation URL format: Changed documentation links to point to the new centralized documentation site.
  • Note about e2e permission in Bitbucket Cloud docs: Added a note about additional permissions required for running e2e tests.

⚙️ Chores

  • Update Go and third-party dependencies: Updated Go to 1.25.7 and refreshed several modules including cel-go, tektoncd/pipeline, and knative/eventing.
  • Refactor LLM package: Simplified the pkg/llm package with a registry-based provider pattern, removing the factory and orchestrator.
  • Return early from detect for edited comments: Moved the edited comment event filter earlier in the processing pipeline.
  • Remove outdated skipped tests and stabilize queue ordering: Fixed priority queue insertion-order stability and removed legacy v1beta1 test assertions.
  • Allow configuration of gotestsum output format: Added a Makefile variable to override the default test output style.
  • Add GitHub step summaries for e2e test suites: Added workflow step to generate markdown summaries of test results in CI.
  • Use provider-wide functions: Consolidated shared provider utility functions.
  • Update repository URLs to upstream tektoncd: Changed remote task and module URLs from the OpenShift downstream mirror to the upstream repository.
  • Replace e2e env variables from server to data center: Renamed Bitbucket Server env variables to Data Center.
  • Add reviewers and approvers in OWNERS: Updated the OWNERS file with approvers and reviewers.
  • Use GH_TOKEN secret in permission check step: Switched from GITHUB_TOKEN to GH_TOKEN for org membership checks.
  • Update tar extraction for new zizmor archive: Fixed binary extraction for newer zizmor releases.
  • Bump actions/upload-artifact from 7.0.0 to 7.0.1.
  • Bump actions/cache from 5.0.4 to 5.0.5.
  • Bump github.com/tektoncd/pipeline from 1.11.0 to 1.11.1.
  • Update go-github dependency.

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.46.0/release.yaml
Kubernetes
kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.46.0/release.k8s.yaml
Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.46.0

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux

red-hat-konflux Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 19 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.6 -> 1.26.4
k8s.io/api v0.35.1 -> v0.35.6
k8s.io/apiextensions-apiserver v0.35.1 -> v0.35.6
k8s.io/apimachinery v0.35.1 -> v0.36.2
github.com/prometheus/common v0.67.5 -> v0.69.0
github.com/prometheus/procfs v0.17.0 -> v0.20.1
github.com/tektoncd/pipeline v1.9.2 -> v1.14.0
go.opentelemetry.io/otel v1.43.0 -> v1.44.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/mod v0.36.0 -> v0.37.0
golang.org/x/net v0.54.0 -> v0.56.0
golang.org/x/sync v0.20.0 -> v0.21.0
golang.org/x/sys v0.44.0 -> v0.46.0
golang.org/x/term v0.43.0 -> v0.44.0
golang.org/x/text v0.37.0 -> v0.38.0
golang.org/x/tools v0.44.0 -> v0.46.0
google.golang.org/grpc v1.80.0 -> v1.81.1
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/code-generator v0.35.1 -> v0.35.6
knative.dev/pkg v0.0.0-20250811181739-e06d4c9af190 -> v0.0.0-20260531000007-52dbd5ece63f

@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0 chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0 - autoclosed Jul 18, 2026
@red-hat-konflux red-hat-konflux Bot closed this Jul 18, 2026
@red-hat-konflux
red-hat-konflux Bot deleted the konflux/mintmaker/main/github.com-openshift-pipelines-pipelines-as-code-0.x branch July 18, 2026 21:29
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0 - autoclosed chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.49.0 Jul 19, 2026
@red-hat-konflux red-hat-konflux Bot reopened this Jul 19, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/github.com-openshift-pipelines-pipelines-as-code-0.x branch 2 times, most recently from c21dc95 to 767c30b Compare July 19, 2026 01:25
@red-hat-konflux
chore(deps): update module github.com/openshift-pipelines/pipelines-a…
6cdd5c5 
…s-code to v0.49.0

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/github.com-openshift-pipelines-pipelines-as-code-0.x branch from 767c30b to 6cdd5c5 Compare August 3, 2026 14:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants