bump tektoncd/pipeline version 1.9.2 to fix CVE-2026-33211 #446
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Triggers CI Presubmit Tests | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - release-* | |
| issue_comment: | |
| types: [created] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| env: | |
| SHELL: /bin/bash | |
| GOPATH: ${{ github.workspace }} | |
| GO111MODULE: on | |
| KO_DOCKER_REPO: registry.local:5000/tekton | |
| CLUSTER_DOMAIN: c${{ github.run_id }}.local | |
| ARTIFACTS: ${{ github.workspace }}/artifacts | |
| jobs: | |
| prepare-pr-check: | |
| if: | | |
| github.event_name == 'pull_request' || | |
| ( | |
| github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| ( | |
| startsWith(github.event.comment.body, '/ok-to-test') || | |
| startsWith(github.event.comment.body, '/retest') | |
| ) | |
| ) | |
| name: Check PR Author / ok-to-test | |
| runs-on: ubuntu-latest | |
| outputs: | |
| run_tests: ${{ steps.check.outputs.run_tests }} | |
| steps: | |
| - name: Install Python yq | |
| run: | | |
| python3 -m pip install --user yq | |
| - name: Debug context | |
| run: | | |
| echo "GITHUB_ACTOR=${GITHUB_ACTOR}" | |
| echo "Comment: $(jq -r .comment.body < $GITHUB_EVENT_PATH)" | |
| echo "Labels: $(jq -r '.pull_request.labels[].name' < $GITHUB_EVENT_PATH)" | |
| - name: Check PR author against org.yaml or /ok-to-test label | |
| id: check | |
| run: | | |
| echo "Fetching Tekton org.yaml..." | |
| ORG_YAML_URL="https://raw.githubusercontent.com/tektoncd/community/refs/heads/main/org/org.yaml" | |
| ORG_YAML=$(curl -sSL "$ORG_YAML_URL") | |
| # Use Python yq (wraps jq) to extract members and admins | |
| IS_MEMBER=$(echo "$ORG_YAML" | ~/.local/bin/yq -r '.orgs.tektoncd.members[]' | grep -Fx "$GITHUB_ACTOR" || true) | |
| IS_ADMIN=$(echo "$ORG_YAML" | ~/.local/bin/yq -r '.orgs.tektoncd.admins[]' | grep -Fx "$GITHUB_ACTOR" || true) | |
| if [[ -n "$IS_MEMBER" || -n "$IS_ADMIN" ]]; then | |
| echo " $GITHUB_ACTOR is a Tekton org member or admin." | |
| echo "run_tests=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo " $GITHUB_ACTOR is NOT a Tekton org member/admin. Checking for /ok-to-test label..." | |
| LABELS=$(jq -r '.pull_request.labels[].name' < "$GITHUB_EVENT_PATH") | |
| if echo "$LABELS" | grep -q '^ok-to-test$'; then | |
| echo " /ok-to-test label found." | |
| echo "run_tests=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo " Not a member and no /ok-to-test label. Skipping tests." | |
| echo "run_tests=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| env: | |
| GITHUB_ACTOR: ${{ github.actor }} | |
| unit-tests: | |
| name: Unit Tests | |
| needs: prepare-pr-check | |
| runs-on: ubuntu-latest | |
| if: needs.prepare-pr-check.outputs.run_tests == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| - name: Set up Go | |
| uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 | |
| with: | |
| cache-dependency-path: src/github.com/tektoncd/triggers/go.sum | |
| go-version-file: src/github.com/tektoncd/triggers/go.mod | |
| - name: Install dependencies | |
| run: | | |
| go install github.com/jstemmer/go-junit-report@v0.9.1 | |
| mkdir -p "${ARTIFACTS:-/tmp/artifacts}" | |
| echo "${GOPATH}/bin" >> "$GITHUB_PATH" | |
| - name: Run Unit Tests | |
| working-directory: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| run: ./test/presubmit-tests.sh --unit-tests | |
| integration-tests: | |
| name: Integration Tests | |
| needs: prepare-pr-check | |
| runs-on: ubuntu-latest | |
| if: needs.prepare-pr-check.outputs.run_tests == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| - name: Set up Go | |
| uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 | |
| with: | |
| cache-dependency-path: src/github.com/tektoncd/triggers/go.sum | |
| go-version-file: src/github.com/tektoncd/triggers/go.mod | |
| - name: Install dependencies | |
| working-directory: ./ | |
| run: | | |
| echo '::group::install ko' | |
| curl -L https://github.com/ko-build/ko/releases/download/v0.15.4/ko_0.15.4_Linux_x86_64.tar.gz | tar xzf - ko | |
| echo '::group:: install go-junit-report' | |
| go install github.com/jstemmer/go-junit-report@v0.9.1 | |
| echo '::endgroup::' | |
| chmod +x ./ko | |
| sudo mv ko /usr/local/bin | |
| echo '::endgroup::' | |
| echo '::group::create required folders' | |
| mkdir -p "${ARTIFACTS}" | |
| echo '::endgroup::' | |
| echo "${GOPATH}/bin" >> "$GITHUB_PATH" | |
| - name: Run Integration tests | |
| working-directory: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| run: | | |
| ${{ github.workspace }}/src/github.com/tektoncd/triggers/test/setup-kind.sh \ | |
| --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \ | |
| --cluster-suffix c${{ github.run_id }}.local \ | |
| --nodes 3 \ | |
| --k8s-version v1.29.x \ | |
| --e2e-script ./test/gh-e2e-tests.sh \ | |
| --e2e-env ./test/e2e-tests-kind-prow.env | |
| - name: Upload test results | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| if: ${{ failure() }} | |
| with: | |
| path: ${{ env.ARTIFACTS }} | |
| build-tests: | |
| name: Build Tests | |
| needs: prepare-pr-check | |
| runs-on: ubuntu-latest | |
| if: needs.prepare-pr-check.outputs.run_tests == 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| - name: Set up Go | |
| uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 | |
| with: | |
| cache-dependency-path: src/github.com/tektoncd/triggers/go.sum | |
| go-version-file: src/github.com/tektoncd/triggers/go.mod | |
| - name: Install dependencies (go-junit-report, go-licenses) | |
| run: | | |
| echo '::group::install go-junit-report' | |
| go install github.com/jstemmer/go-junit-report@v0.9.1 | |
| echo '::endgroup::' | |
| echo '::group::install go-licenses' | |
| go install github.com/google/go-licenses@latest | |
| echo '::endgroup::' | |
| mkdir -p "${ARTIFACTS:-/tmp/artifacts}" | |
| echo "${GOPATH}/bin" >> "$GITHUB_PATH" | |
| - name: Run Build Tests | |
| working-directory: ${{ github.workspace }}/src/github.com/tektoncd/triggers | |
| run: ./test/presubmit-tests.sh --build-tests |