pipeline

v1.18.0

tektoncd/pipeline

A cloud-native Pipeline resource.

Compare View on GitHub

Maintenance: ActiveBased on the last push: commit history is not collected yet
License: Apache-2.0Permissive · OSI-approved
Security: 8 advisories1 critical, 2 high, 4 medium, 1 low · Scorecard 6.7/10
Supported versions: No scheduleendoflife.date does not track this project

9.1k stars · 2k forks · 571 open issues · last release 16 days ago · data checked 4 hours ago

Overview Tour Releases Docker images Security Logos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

v1.18.0Oct 29, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: release: set SOURCE_DATE_EPOCH so published images get a real creation timestamp (#10860)
Published images now carry a real creation timestamp (the release commit's), instead of inheriting the base image's.
- :bug: fix: Make controller-managed labels immutable via webhook (#10687)
Controller-managed labels (tekton.dev/pipeline, tekton.dev/pipelineTask, tekton.dev/pipelineRun) are now immutable once set and cannot be changed by users updating a PipelineRun or TaskRun.
- :bug: fix: bump plumbing ko image to Go 1.27.3 (#10937)
- :bug: fix: Fix truncation of large Tekton bundles resolved from OCI images, which could cause the bundle to fail to parse. (#10395)
- :bug: fix early PVC cleanup for pipelines-in-pipelines child-pipelines (#9727)
Misc
- :hammer: build(deps): bump chainguard-dev/actions/setup-kind from 1.6.40 to 1.6.41 (#10935)
- :hammer: build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#10934)
- :hammer: build(deps): bump chainguard-dev/actions/kind-diag from 1.6.39 to 1.6.41 (#10933)
- :hammer: build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#10932)
- :hammer: build(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#10931)
- :hammer: build(deps): bump the codeql-action group with 3 updates (#10930)
- :hammer: build(deps): bump the all group in /tekton with 4 updates (#10921)
- :hammer: build(deps): bump github.com/jenkins-x/go-scm from 1.16.6 to 1.17.1 (#10913)
- :hammer: build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 (#10908)
- :hammer: build(deps): bump agilepathway/label-checker from 2.0.0 to 2.0.5 (#10906)
v1.6.8Oct 23, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: [release-v1.6.x] fix(release): copy vendor tarball into kodata instead of symlink (#10945)
- :bug: [release-v1.6.x] fix: bump plumbing ko image to Go 1.27.3 (#10942)
Misc
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10922)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10896)
- :hammer: [release-v1.6.x] bump tj-actions/changed-files from 9c9e94395b39f2628ceed2caba849f630866e9e0 to 1254cca6ac8b9c3047ba83a11b20c9dd8d9b0572 (#10893)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10869)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10846)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10810)
- :hammer: [release-v1.6.x] bump tj-actions/changed-files from 934b2d2c7e653bb8c968afed5a0428617f09aa24 to 9c9e94395b39f2628ceed2caba849f630866e9e0 (#10805)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10785)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 6 updates (#10772)
- :hammer: [release-v1.6.x] bump the all group in /tekton with 4 updates (#10700)
Docs
Thanks
Thanks to these contributors who contributed to v1.6.8!
- :heart: @app/dependabot
- :heart: @vdemeester
v1.12.3Oct 23, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: [release-v1.12.x] fix(release): copy vendor tarball into kodata instead of symlink (#10943)
- :bug: [release-v1.12.x] fix: bump plumbing ko image to Go 1.27.3 (#10940)
Misc
- :hammer: [release-v1.12.x] build(deps): bump golang.org/x/crypto to 0.55.0 (#10861)
Update Go security dependencies.
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/setup-kind from 1.6.40 to 1.6.41 (#10927)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/kind-diag from 1.6.40 to 1.6.41 (#10925)
- :hammer: [release-v1.12.x] bump the all group in /tekton with 4 updates (#10924)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/kind-diag from 1.6.39 to 1.6.40 (#10899)
- :hammer: [release-v1.12.x] bump actions/upload-artifact from 7.0.1 to 7.0.2 (#10897)
- :hammer: [release-v1.12.x] bump the all group in /tekton with 4 updates (#10894)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.39 (#10873)
- :hammer: [release-v1.12.x] bump the all group in /tekton with 4 updates (#10872)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/setup-kind from 1.6.37 to 1.6.40 (#10871)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/setup-kind from 1.6.36 to 1.6.37 (#10851)
- :hammer: [release-v1.12.x] bump agilepathway/label-checker from 1.6.98 to 1.6.115 (#10850)
- :hammer: [release-v1.12.x] bump chainguard-dev/actions/kind-diag from 1.6.36 to 1.6.37 (#10849)
- :hammer: [release-v1.12.x] bump the all group in /tekton with 4 updates (#10847)
v1.9.9Oct 23, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: [release-v1.9.x] fix(release): copy vendor tarball into kodata instead of symlink (#10944)
- :bug: [release-v1.9.x] fix: bump plumbing ko image to Go 1.27.3 (#10941)
Misc
- :hammer: [release-v1.9.x] build(deps): bump golang.org/x/crypto to 0.55.0 (#10862)
Update Go security dependencies.
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10923)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10895)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10870)
- :hammer: [release-v1.9.x] bump agilepathway/label-checker from 1.6.98 to 1.6.115 (#10848)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10845)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10808)
- :hammer: [release-v1.9.x] bump agilepathway/label-checker from 1.6.66 to 1.6.98 (#10807)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10786)
- :hammer: [release-v1.9.x] bump agilepathway/label-checker from 1.6.65 to 1.6.66 (#10771)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 6 updates (#10767)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10737)
- :hammer: [release-v1.9.x] bump the all group in /tekton with 4 updates (#10705)
Docs
v1.15.5Oct 23, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: [release-v1.15.x] fix: bump plumbing ko image to Go 1.27.3 (#10939)
Misc
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/setup-kind from 1.6.40 to 1.6.41 (#10929)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/kind-diag from 1.6.40 to 1.6.41 (#10928)
- :hammer: [release-v1.15.x] bump the all group in /tekton with 4 updates (#10926)
- :hammer: fix(deps): bump golang.org/x/crypto from v0.55.0 to v0.58.0 (#10910)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/kind-diag from 1.6.39 to 1.6.40 (#10901)
- :hammer: [release-v1.15.x] bump actions/upload-artifact from 7.0.1 to 7.0.2 (#10900)
- :hammer: [release-v1.15.x] bump the all group in /tekton with 4 updates (#10898)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/setup-kind from 1.6.37 to 1.6.40 (#10876)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.39 (#10875)
- :hammer: [release-v1.15.x] bump the all group in /tekton with 4 updates (#10874)
- :hammer: [release-v1.15.x] bump agilepathway/label-checker from 1.6.98 to 1.6.115 (#10855)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/setup-kind from 1.6.36 to 1.6.37 (#10854)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/kind-diag from 1.6.36 to 1.6.37 (#10853)
- :hammer: [release-v1.15.x] bump the all group in /tekton with 4 updates (#10852)
Docs
Thanks
v1.17.1Oct 23, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: [release-v1.17.x] fix: bump plumbing ko image to Go 1.27.3 (#10938)
Misc
Docs
Thanks
Thanks to these contributors who contributed to v1.17.1!
- :heart: @vdemeester
Extra shout-out for awesome release notes:
- :heart_eyes: @vdemeester
v1.15.4Oct 22, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
Misc
- :hammer: [release-v1.15.x] bump the kubernetes group with 5 updates (#10833)
- :hammer: [release-v1.15.x] bump the kubernetes group in /test/custom-task-ctrls/wait-task-beta with 3 updates (#10832)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/setup-kind from 1.6.35 to 1.6.36 (#10817)
- :hammer: [release-v1.15.x] bump chainguard-dev/actions/kind-diag from 1.6.35 to 1.6.36 (#10816)
- :hammer: [release-v1.15.x] bump agilepathway/label-checker from 1.6.66 to 1.6.101 (#10815)
- :hammer: [release-v1.15.x] bump the all group in /tekton with 4 updates (#10813)
- :hammer: [release-v1.15.x] bump github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2 (#10797)
- :hammer: [release-v1.15.x] bump the sigstore group across 1 directory with 4 updates (#10796)
- :hammer: [release-v1.15.x] Bump github.com/google/cel-go v0.29.2 to v0.30.0 (#10794)
Docs
Thanks
Thanks to these contributors who contributed to v1.15.4!
- :heart: @app/dependabot
- :heart: @khrm
Extra shout-out for awesome release notes:
v1.17.0Oct 1, 2026
Deprecation Notices
- :rotating_light: [Deprecation Notice Title]
[Detailed deprecation notice description] (#Number).
[Fill list here]
-->
Fixes
- :bug: fix: use non-expandable here-string for windows script placement (#10822)
Fixed a Windows script-injection defense-in-depth gap: placeScriptInContainer now uses a non-expandable PowerShell here-string, so a script body containing a literal "@ line can no longer terminate the generated command early.
- :bug: fix: add task name in error on task resolution failure (#10800)
Before this update, when resolver fails to get any task, controller showed the error message without containing the task name which was hard to detect which one is failed or having bad resolution config. Now task name is added to the error message from template.
- :bug: Allow tt.params as a valid variable-reference prefix (#10688)
Pipelines can now reference $(tt.params.) in task params, when expressions, and matrix params/includes. This lets a PipelineSpec embedded by Tekton Triggers keep its tt.params.* substitutions without failing pipeline validation.
- :bug: Enqueue only a resolver's own ResolutionRequests (#10548)
Resolvers no longer fail ResolutionRequests belonging to a different resolver after a leader election or a resolver pod restart.
- :bug: fix: correct verb in controller startup panic logs (#10430)
Fixed controller startup panic messages that printed a malformed %!w(...) marker instead of the underlying error when an informer event handler failed to register.
- :bug: Fix release_names.go: update regex for Wikipedia HTML changes and fix bugs (#10508)
Misc
- :hammer: chore: delete dead code in test/per_feature_flags_test.go file (#10802)
NOT REQUIRED
- :hammer: chore: group sigstore dependency updates in dependabot (#10761)
- :hammer: Eliminate discontinued gopkg.in/yaml.v3 library (#10683)
- :hammer: build(deps): bump the kubernetes group with 5 updates (#10829)
- :hammer: build(deps): bump the kubernetes group in /test/custom-task-ctrls/wait-task-beta with 3 updates (#10828)

Release history

All releases on GitHub

Atom feed/feed/tektoncd/pipeline

Badge

[![version](/badge/tektoncd/pipeline)](/p/tektoncd/pipeline)

Tekton Pipeline release v1.18.0 "Ukrainian Levkoy Ultron LTS"

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.18.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.18.0/release.yaml
REKOR_UUID=108e9186e8c5677a60b5706509f09f5e185c25597018b15d790c34d2a4f4357d357cb747b9fe0109

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.18.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

:sparkles: Add option continueAndFail on step.onError (#10536)

Step onError now supports continueAndFail, which continues executing subsequent steps but fails the TaskRun after all steps complete.

Fixes

:bug: release: set SOURCE_DATE_EPOCH so published images get a real creation timestamp (#10860)

Published images now carry a real creation timestamp (the release commit's), instead of inheriting the base image's.

:bug: fix: Make controller-managed labels immutable via webhook (#10687)

Controller-managed labels (tekton.dev/pipeline, tekton.dev/pipelineTask, tekton.dev/pipelineRun) are now immutable once set and cannot be changed by users updating a PipelineRun or TaskRun.

:bug: fix: bump plumbing ko image to Go 1.27.3 (#10937)

:bug: fix: Fix truncation of large Tekton bundles resolved from OCI images, which could cause the bundle to fail to parse. (#10395)

:bug: fix early PVC cleanup for pipelines-in-pipelines child-pipelines (#9727)

Misc

:hammer: build(deps): bump chainguard-dev/actions/setup-kind from 1.6.40 to 1.6.41 (#10935)
:hammer: build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#10934)
:hammer: build(deps): bump chainguard-dev/actions/kind-diag from 1.6.39 to 1.6.41 (#10933)
:hammer: build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#10932)
:hammer: build(deps): bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#10931)
:hammer: build(deps): bump the codeql-action group with 3 updates (#10930)
:hammer: build(deps): bump the all group in /tekton with 4 updates (#10921)
:hammer: build(deps): bump github.com/jenkins-x/go-scm from 1.16.6 to 1.17.1 (#10913)
:hammer: build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 (#10908)
:hammer: build(deps): bump agilepathway/label-checker from 2.0.0 to 2.0.5 (#10906)
:hammer: build(deps): bump chainguard-dev/actions/setup-kind from 1.6.39 to 1.6.40 (#10905)
:hammer: build(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 (#10904)
:hammer: build(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 (#10903)
:hammer: build(deps): bump the codeql-action group with 3 updates (#10902)
:hammer: build(deps): bump the all group in /tekton with 4 updates (#10892)
:hammer: build(deps): bump github.com/prometheus/common from 0.72.0 to 0.72.1 (#10886)
:hammer: build(deps): bump github.com/spiffe/go-spiffe/v2 from 2.8.2 to 2.9.0 (#10883)
:hammer: build(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 (#10881)
:hammer: build(deps): bump chainguard-dev/actions/setup-kind from 1.6.37 to 1.6.39 (#10878)
:hammer: build(deps): bump chainguard-dev/actions/kind-diag from 1.6.37 to 1.6.39 (#10877)
:hammer: build(deps): bump github.com/jenkins-x/go-scm from 1.16.5 to 1.16.6 (#10868)
:hammer: build(deps): bump the all group in /tekton with 5 updates (#10867)
:hammer: build(deps): bump github.com/tektoncd/pipeline from 1.16.0 to 1.17.0 in /test/custom-task-ctrls/wait-task-beta (#10865)
:hammer: build(deps): bump github.com/prometheus/common from 0.71.0 to 0.72.0 (#10858)

Full release notes Compare with previous

pipeline

Breaking changes

Deprecation Notices

Fixes

Misc

Deprecation Notices

Fixes

Misc

Docs

Thanks

Deprecation Notices

Fixes

Misc

Deprecation Notices

Fixes

Misc

Docs

Deprecation Notices

Fixes

Misc

Docs

Thanks

Deprecation Notices

Fixes

Misc

Docs

Thanks

Deprecation Notices

Fixes

Misc

Docs

Thanks

Deprecation Notices

Fixes

Misc

Release history

Installation one-liner

Attestation

Changes

Features

Fixes

Misc