Update module github.com/tektoncd/pipeline to v1.12.2 (release-v0.7) by renovate[bot] · Pull Request #3461 · conforma/cli

renovate · 2026-08-05T02:23:49Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/tektoncd/pipeline	`v1.12.0` → `v1.12.2`

Release Notes

tektoncd/pipeline (github.com/tektoncd/pipeline)

`v1.12.2`: Tekton Pipeline release v1.12.2 "Exotic Shorthair Elektrobots LTS"

Compare Source

-Docs @ v1.12.2
-Examples @ v1.12.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.12.2/release.yaml

Attestation

The Rekor UUID for this release is cb0a4d44223cf8dd164d8eec84c25d204f7a37a023c2d28f1f8dcde79ca3c187

Obtain the attestation:

REKOR_UUID=cb0a4d44223cf8dd164d8eec84c25d204f7a37a023c2d28f1f8dcde79ca3c187
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.12.2/release.yaml
REKOR_UUID=cb0a4d44223cf8dd164d8eec84c25d204f7a37a023c2d28f1f8dcde79ca3c187

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.12.2@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

🔨 build(deps): bump k8s.io/client-go from 0.35.5 to 0.35.6 (#10289)

Docs

Thanks

Thanks to these contributors who contributed to v1.12.2!

❤️ @app/dependabot

Extra shout-out for awesome release notes:

`v1.12.1`: Tekton Pipeline release v1.12.1 "Exotic Shorthair Elektrobots LTS"

Compare Source

-Docs @ v1.12.1
-Examples @ v1.12.1

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.12.1/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a9cfc575e256441da4223e4767ebb840a62e4b5ad18ed6219842a81686a4a8586

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a9cfc575e256441da4223e4767ebb840a62e4b5ad18ed6219842a81686a4a8586
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.12.1/release.yaml
REKOR_UUID=108e9186e8c5677a9cfc575e256441da4223e4767ebb840a62e4b5ad18ed6219842a81686a4a8586

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.12.1@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

🐛 [cherry-pick: release-v1.12.x] fix(resolvers): Allow ResolutionRequests to resolve all Tekton kinds (#10252)

efore this change, ResolutionRequests could only resolve Pipelines, Tasks, and StepActions. After this change, ResolutionRequests can resolve PipelineRuns, Pipelines, TaskRuns, Tasks, Runs, CustomRuns, and StepActions.

🐛 [cherry-pick: release-v1.12.x] fix: TaskRun stuck in Running when init container is OOMKilled with enableKubernetesSidecar (#10186)

ix: TaskRun no longer gets stuck in Running when an init container (e.g. prepare) is OOMKilled while enableKubernetesSidecar is enabled. The TaskRun is now correctly marked as Failed immediately.

🐛 [cherry-pick: release-v1.12.x] Fix cross-arch platform command lookup in entrypoint (#10164)

ix entrypoint command lookup when controller and worker nodes run on different CPU architectures (e.g., ARM controller with AMD64 workloads). The controller's CPU variant was leaking into TEKTON_PLATFORM_COMMANDS keys via platforms.NewPlatform(), causing "could not find command for platform" errors on worker nodes of a different architecture.

🐛 [cherry-pick: release-v1.12.x] fix: truncate affinity assistant volume names to 63 characters (#10137)

ffinity assistant StatefulSet no longer fails when workspace volumeClaimTemplate names exceed 63 characters. Long volume names are now automatically truncated with a hash suffix to stay within the Kubernetes limit.

🐛 [cherry-pick: release-v1.12.x] fix(pipelinerun): use generateName for anonymous pipeline label (#10079)

Previously, TaskRuns' tekton.dev/pipeline label for anonymous Pipelines would use their PipelineRun's name in their tekton.dev/pipeline label and pipeline metrics tag. After this change, TaskRun and PipelineRun which are created from anonymous Pipelines now reference a sanitized metadata.generateName, when present, for the label tekton.dev/pipeline. Similarly, these TaskRruns and PipelineRuns will populate their respective metrics' pipeline tag with the sanitized generateName instead of using anonymous.

🐛 [release-v1.12.x] Fix gen-crd-api-reference-docs require to use fetchable version (#10001)

ix gen-crd-api-reference-docs go.mod require to use a fetchable upstream version, fixing module resolution failures for downstream consumers.

🐛 [cherry-pick: release-v1.12.x] fix(resolvers): validate data is Tekton object in resolver framework (#9963)

Fixes a bug which lets Tekton Resolvers resolve non-tekton objects and arbitrary data. After this change, resolving a non-tekton object causes the ResolutionRequest to fail.
Action Required: Tekton Resolvers are now only permitted to resolve StepActions, Tasks, and Pipelines. Custom resolvers or ResolutionRequest which use the Resolver API for other object types will no longer function.

🐛 [release-v1.12.x] fix: replace symlinks with subpath params and fix Rekor UUID in release pipeline (#10216)
🐛 [cherry-pick: release-v1.12.x] Fix PipelineRun premature failure when TaskRun recovers after pod eviction (#10161)

Misc

🔨 build(deps): bump the all group in /tekton with 4 updates (#10265)
🔨 build(deps): bump the all group in /tekton with 4 updates (#10234)
🔨 build(deps): bump chainguard-dev/actions from 1.6.21 to 1.6.22 (#10229)
🔨 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#10200)
🔨 build(deps): bump chainguard-dev/actions from 1.6.19 to 1.6.21 (#10199)
🔨 build(deps): bump the all group in /tekton with 4 updates (#10194)
🔨 build(deps): bump github.com/sigstore/sigstore from 1.10.6 to 1.10.8 (#10168)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/azure from 1.10.6 to 1.10.8 (#10150)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.6 to 1.10.8 (#10149)
🔨 build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.6 to 1.14.7 (#10148)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp from 1.10.6 to 1.10.8 (#10147)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.10.6 to 1.10.8 (#10146)
🔨 build(deps): bump the all group in /tekton with 4 updates (#10130)
🔨 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#10129)
🔨 build(deps): bump the all group across 1 directory with 4 updates (#10094)
🔨 build(deps): bump step-security/harden-runner from 2.19.2 to 2.19.4 (#10093)
🔨 build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#10092)
🔨 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#10091)
🔨 build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 (#10070)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp from 1.10.5 to 1.10.6 (#10065)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/azure from 1.10.5 to 1.10.6 (#10064)
🔨 build(deps): bump github.com/sigstore/sigstore from 1.10.5 to 1.10.6 (#10063)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.5 to 1.10.6 (#10062)
🔨 build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.10.5 to 1.10.6 (#10061)
🔨 build(deps): bump step-security/harden-runner from 2.19.1 to 2.19.2 (#10046)
🔨 build(deps): bump the all group in /tekton with 4 updates (#10041)
🔨 build(deps): bump k8s.io/apiextensions-apiserver from 0.35.4 to 0.35.5 (#10034)
🔨 build(deps): bump k8s.io/client-go from 0.35.4 to 0.35.5 in /test/custom-task-ctrls/wait-task-beta (#10023)
🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.15.21 to 1.15.22 (#10018)
🔨 build(deps): bump github.com/google/cel-go from 0.28.0 to 0.28.1 (#10017)
🔨 build(deps): bump github/codeql-action from 4.35.2 to 4.35.4 (#9994)
🔨 build(deps): bump chainguard/go from 7ec9277 to a4477c3 in /tekton in the all group (#9993)
🔨 build(deps): bump chainguard-dev/actions from 1.6.17 to 1.6.19 (#9983)
🔨 build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1 (#9981)
🔨 build(deps): bump the all group in /tekton with 4 updates (#9976)

Docs

Thanks

Thanks to these contributors who contributed to v1.12.1!

❤️ @app/dependabot
❤️ @tekton-robot
❤️ @vdemeester
❤️ @waveywaves

Extra shout-out for awesome release notes:

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-08-05T02:23:52Z

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`github.com/docker/cli`	`v29.4.0+incompatible` -> `v29.4.3+incompatible`
`github.com/google/cel-go`	`v0.28.0` -> `v0.28.1`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.18.6`
`k8s.io/apiextensions-apiserver`	`v0.35.4` -> `v0.35.5`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`k8s.io/apiextensions-apiserver`	`v0.35.4` -> `v0.35.5`
`github.com/docker/cli`	`v29.4.0+incompatible` -> `v29.4.3+incompatible`
`github.com/google/cel-go`	`v0.28.0` -> `v0.28.1`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.18.6`

fullsend-ai-review · 2026-08-05T02:24:37Z

🤖 Finished Review · ✅ Success · Started 2:24 AM UTC · Completed 2:29 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-05T02:29:39Z

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Labels: Dependency version bump in Go module files

codecov · 2026-08-05T02:31:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	`69.55% <ø> (ø)`
integration	`69.55% <ø> (ø)`
unit	`69.55% <ø> (+1.47%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 107 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-08-10T15:23:20Z

🤖 Finished Review · ✅ Success · Started 3:23 PM UTC · Completed 3:29 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review · 2026-08-10T17:05:42Z

🤖 Finished Review · ✅ Success · Started 5:05 PM UTC · Completed 5:10 PM UTC

Commit: 87c4a29 · View workflow run →

renovate Bot added release-v0.7 renovate labels Aug 5, 2026

renovate Bot enabled auto-merge August 5, 2026 02:23

github-actions Bot added the size: M label Aug 5, 2026

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge dependencies Pull requests that update a dependency file labels Aug 5, 2026

renovate Bot force-pushed the renovate/release-v0.7-patch-tektoncd-pipelines branch from 398b81a to ce8c9d2 Compare August 10, 2026 15:21

This comment was marked as outdated.

Sign in to view

Update module github.com/tektoncd/pipeline to v1.12.2

efa5626

renovate Bot force-pushed the renovate/release-v0.7-patch-tektoncd-pipelines branch from ce8c9d2 to efa5626 Compare August 10, 2026 17:04

fullsend-ai-review Bot approved these changes Aug 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update module github.com/tektoncd/pipeline to v1.12.2 (release-v0.7) - #3461

Update module github.com/tektoncd/pipeline to v1.12.2 (release-v0.7)#3461
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-patch-tektoncd-pipelines

renovate Bot commented Aug 5, 2026

Uh oh!

renovate Bot commented Aug 5, 2026

Uh oh!

fullsend-ai-review Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 5, 2026

Release Notes

v1.12.2: Tekton Pipeline release v1.12.2 "Exotic Shorthair Elektrobots LTS"

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Docs

Thanks

v1.12.1: Tekton Pipeline release v1.12.1 "Exotic Shorthair Elektrobots LTS"

Installation one-liner

Attestation

Changes

Features

Fixes

Misc

Docs

Thanks

Configuration

Uh oh!

renovate Bot commented Aug 5, 2026

ℹ️ Artifact update notice

File name: acceptance/go.mod

File name: go.mod

Uh oh!

fullsend-ai-review Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v1.12.2`: Tekton Pipeline release v1.12.2 "Exotic Shorthair Elektrobots LTS"

`v1.12.1`: Tekton Pipeline release v1.12.1 "Exotic Shorthair Elektrobots LTS"

fullsend-ai-review Bot commented Aug 5, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 5, 2026 •

edited

Loading

codecov Bot commented Aug 5, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 10, 2026 •

edited

Loading