Skip to content

Update tektoncd pipelines to v1.12.2 (main)#3373

Open
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-tektoncd-pipelines
Open

Update tektoncd pipelines to v1.12.2 (main)#3373
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-tektoncd-pipelines

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/tektoncd/pipeline v1.12.0 → v1.12.2 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux red-hat-konflux Bot enabled auto-merge June 29, 2026 01:22
@red-hat-konflux

red-hat-konflux Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/secure-systems-lab/go-securesystemslib v0.10.0 -> v0.11.0
github.com/sigstore/sigstore v1.10.5 -> v1.10.8
github.com/google/cel-go v0.28.0 -> v0.28.1
github.com/letsencrypt/boulder v0.20260223.0 -> v0.20260309.0
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 18 additional dependencies were updated

Details:

Package Change
github.com/secure-systems-lab/go-securesystemslib v0.10.0 -> v0.11.0
github.com/sigstore/sigstore v1.10.5 -> v1.10.8
github.com/aws/aws-sdk-go-v2 v1.41.4 -> v1.41.7
github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.17
github.com/aws/aws-sdk-go-v2/credentials v1.19.12 -> v1.19.16
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.23
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 -> v1.4.23
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 -> v2.7.23
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 -> v1.4.24
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.9
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 -> v1.13.23
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 -> v1.0.11
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 -> v1.30.17
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 -> v1.35.21
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 -> v1.42.1
github.com/aws/smithy-go v1.24.2 -> v1.25.1
github.com/google/cel-go v0.28.0 -> v0.28.1
github.com/letsencrypt/boulder v0.20260223.0 -> v0.20260309.0
File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 22 additional dependencies were updated

Details:

Package Change
github.com/aws/aws-sdk-go-v2 v1.41.4 -> v1.41.7
github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.17
github.com/aws/aws-sdk-go-v2/credentials v1.19.12 -> v1.19.16
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.23
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 -> v1.4.23
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 -> v2.7.23
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 -> v1.4.24
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.9
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 -> v1.13.23
github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 -> v1.0.11
github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 -> v1.30.17
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 -> v1.35.21
github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 -> v1.42.1
github.com/aws/smithy-go v1.24.2 -> v1.25.1
github.com/google/cel-go v0.28.0 -> v0.28.1
github.com/letsencrypt/boulder v0.20260223.0 -> v0.20260309.0
github.com/secure-systems-lab/go-securesystemslib v0.10.0 -> v0.11.0
github.com/sigstore/sigstore v1.10.5 -> v1.10.8
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.5 -> v1.10.8
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.5 -> v1.10.8
github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.5 -> v1.10.8
github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.5 -> v1.10.8

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:25 AM UTC · Completed 1:32 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Outcome: Approve

This is an automated dependency update from Renovate (red-hat-konflux bot) bumping github.com/tektoncd/pipeline from v1.12.0 → v1.12.2 (patch release on the LTS branch) across all three Go modules (root, acceptance, tools). No source code changes — only go.mod and go.sum files are modified.

Analysis

Dimension Result
Correctness ✅ No concerns. The go-securesystemslib minor bump (v0.10.0 → v0.11.0) was verified — this project uses stable DSSE APIs (Envelope, Signature, NewEnvelopeVerifier, WrapSigner, Decrypt) that are unaffected. The tektoncd/pipeline v1.12.1 Resolver restriction (now only resolves StepActions, Tasks, Pipelines) does not affect this project — no ResolutionRequest usage found in the codebase. All three modules update consistently.
Security ✅ No concerns. No secrets, injection vectors, replace directive abuse, or permission changes. Transitive updates (sigstore, go-securesystemslib, youmark/pkcs8) are from well-known, reputable libraries.
Intent & coherence ✅ Mechanical dependency bump — authorization implicit from automated nature.
Style & conventions ✅ No findings — value-only changes follow surrounding patterns.
Documentation currency ✅ No source code changes → no documentation staleness.
Cross-repo contracts ✅ No exported API changes in diff.

Dependency Changes Summary

Direct:

  • github.com/tektoncd/pipeline: v1.12.0 → v1.12.2

Transitive (notable):

  • github.com/secure-systems-lab/go-securesystemslib: v0.10.0 → v0.11.0
  • github.com/sigstore/sigstore: v1.10.5 → v1.10.8
  • github.com/google/cel-go: v0.28.0 → v0.28.1
  • github.com/youmark/pkcs8: added (new transitive)
  • Various AWS SDK, boulder, miekg/dns patch bumps

The v1.12.2 release contains only a k8s client-go bump; v1.12.1 includes several bug fixes (OOMKilled TaskRun handling, cross-arch platform fixes, affinity assistant volume name truncation). CI results should confirm compilation and test compatibility.

Previous run

Review

Verdict: Approve

This is a standard automated dependency update PR from red-hat-konflux[bot] (Renovate/MintMaker). The change bumps github.com/tektoncd/pipeline from v1.12.0 → v1.12.2 (a patch-level update) across all three Go modules (go.mod, acceptance/go.mod, tools/go.mod) along with their corresponding go.sum files.

Changes summary

Primary dependency:

  • github.com/tektoncd/pipeline: v1.12.0 → v1.12.2 (patch)

Transitive dependency updates (pulled in by the primary):

  • github.com/secure-systems-lab/go-securesystemslib: v0.10.0 → v0.11.0
  • github.com/sigstore/sigstore (and KMS sub-packages): v1.10.5 → v1.10.8
  • github.com/google/cel-go: v0.28.0 → v0.28.1
  • github.com/letsencrypt/boulder: v0.20260223.0 → v0.20260309.0
  • github.com/aws/aws-sdk-go-v2 and related packages: minor version bumps
  • github.com/aws/smithy-go: v1.24.2 → v1.25.1
  • github.com/miekg/dns: v1.1.61 → v1.1.62
  • github.com/youmark/pkcs8: newly added transitive dependency
  • github.com/aws/aws-sdk-go-v2/internal/ini: removed (no longer needed as indirect)
  • github.com/aws/aws-sdk-go-v2, config entries removed from acceptance/go.mod indirect requires (still tracked in go.sum)

Analysis

  • No source code changes — only go.mod and go.sum files are modified.
  • Dependency versions are consistent across all three modules (go.mod, acceptance/go.mod, tools/go.mod).
  • Patch-level primary update — v1.12.0 → v1.12.2 is expected to contain only bug fixes.
  • Security-relevant libraries updated — sigstore and securesystemslib bumps are positive from a security posture standpoint.
  • No injection concerns in PR body — standard Renovate bot template.
  • No documentation or test updates needed — no behavioral changes introduced.

No blocking findings. This is a low-risk, well-scoped automated dependency update.

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Looks good to me

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

Labels: Dependency version bump PR updating Go modules — adding dependencies and go labels.

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 29, 2026
@red-hat-konflux red-hat-konflux Bot changed the title Update tektoncd pipelines to v1.12.2 (main) Update tektoncd pipelines to v1.12.2 (main) - autoclosed Jun 29, 2026
@red-hat-konflux red-hat-konflux Bot closed this Jun 29, 2026
auto-merge was automatically disabled June 29, 2026 21:53

Pull request was closed

@red-hat-konflux red-hat-konflux Bot deleted the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch June 29, 2026 21:53
@fullsend-ai-retro

fullsend-ai-retro Bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 9:56 PM UTC · Completed 10:01 PM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-retro

fullsend-ai-retro Bot commented Jun 29, 2026

Copy link
Copy Markdown

Retro: PR #3373 — Update tektoncd pipelines to v1.12.2

Timeline:

  1. red-hat-konflux[bot] opened PR #3373 at 01:22 UTC to bump github.com/tektoncd/pipeline from v1.12.0 to v1.12.2 (with transitive dep updates across 3 go.mod files).
  2. The review agent (run 28342843269) approved at 01:32 UTC with "Looks good to me" and applied the ready-for-merge label.
  3. CI checks failed with multiple breaking errors: undefined symbols in downloader.go (due to goci.Transport/ghttp.Transport API changes), type errors in attestation.go (sigstore/cosign v3 interface change), missing go.sum entries for tektoncd/cli, and Go version mismatches.
  4. red-hat-konflux[bot] autoclosed the PR at 21:53 UTC.
  5. The retro agent was dispatched at 21:56 UTC on the autoclosed PR.

Key observations:

  • The review agent approved and labeled ready-for-merge before CI results were available. The dependency update introduced breaking API changes that static review missed.
  • A retro was dispatched on an autoclosed bot-authored dependency PR — low-value analysis that consumes tokens.

No new proposals — all findings covered by existing issues:

  • Review agent approving without CI check → #369, #1424, #2667
  • Review agent missing breaking API changes in dep bumps → #1778
  • Retro dispatched on autoclosed bot PR → #2461
  • Lightweight review path for trivial bot dep bumps → #1358, #2639

@red-hat-konflux red-hat-konflux Bot changed the title Update tektoncd pipelines to v1.12.2 (main) - autoclosed Update tektoncd pipelines to v1.12.2 (main) Jul 1, 2026
@red-hat-konflux red-hat-konflux Bot reopened this Jul 1, 2026
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch 2 times, most recently from 6d81b81 to 9a4757b Compare July 1, 2026 02:05
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:15 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Jul 1, 2026
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch 3 times, most recently from 6d81b81 to d885f71 Compare July 1, 2026 02:25
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:28 AM UTC · Completed 2:34 AM UTC
Commit: 47d3320 · View workflow run →

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch 5 times, most recently from 0fab2b6 to 4cd93f1 Compare July 4, 2026 02:14
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:18 AM UTC · Completed 2:23 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Jul 4, 2026
@red-hat-konflux red-hat-konflux Bot changed the title Update tektoncd pipelines to v1.12.2 (main) Update tektoncd pipelines to v1.12.2 (main) - autoclosed Jul 5, 2026
@red-hat-konflux red-hat-konflux Bot closed this Jul 5, 2026
@fullsend-ai-retro

fullsend-ai-retro Bot commented Jul 5, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 5:41 AM UTC · Completed 5:48 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-retro

fullsend-ai-retro Bot commented Jul 5, 2026

Copy link
Copy Markdown

Retro: PR #3373 — Update tektoncd pipelines to v1.12.2 (5th retro run)

This is the 5th retro dispatch on this autoclosed bot dependency-bump PR. The PR was opened by red-hat-konflux[bot] on June 29 to bump tektoncd/pipeline v1.12.0 to v1.12.2. Over 7 days, it accumulated 8 review agent runs (all approved with "Looks good to me") and 5 retro runs (including this one) — all on a PR that was never mergeable due to CI failures from breaking API changes in transitive dependencies.

Timeline

  1. June 29, 01:22 UTC — Bot opened PR Update tektoncd pipelines to v1.12.2 (main) #3373 (6 files: go.mod/go.sum across 3 modules).
  2. June 29, 01:32 UTC — Review agent approved and labeled ready-for-merge before CI completed.
  3. June 29 — CI failed with breaking errors (undefined symbols, type mismatches from sigstore/cosign API changes). PR autoclosed.
  4. June 29–July 4 — Bot reopened/force-pushed daily. Each cycle triggered 1-2 review runs and a retro run. All reviews approved; all retros identified the same set of existing issues.
  5. July 5, 05:37 UTC — PR finally closed for good.

Waste accounting

  • 8 review runs x ~5 min = ~40 min agent compute
  • 5 retro runs x ~5 min = ~25 min agent compute
  • 0 human interactions — no human ever engaged with this PR
  • Total: ~65 min agent compute, zero value delivered

All findings covered by existing open issues

Four prior retro runs already mapped every improvement opportunity to existing open issues in fullsend-ai/fullsend. All referenced issues were verified as still open:

  • Review approving before CI: #369, #1424, #2667
  • Review missing breaking API changes in dep bumps: #1778
  • Skip review/retro dispatch on closed PRs: #1439, #1870, #3010
  • Deduplicate retro runs on same PR: #2401
  • Skip retro for autoclosed bot PRs: #2461
  • Per-PR review budget cap: #2599
  • Lightweight/cheaper review for bot dep bumps: #1358, #2842
  • Filter bot review events from dispatch: #2994

Highest-impact fixes (prioritized)

  1. #2401 — Retro dedup would have prevented 4 of 5 retro runs.
  2. #2599 — Per-PR review budget would have capped reviews at 2-3 instead of 8.
  3. #2461 — Skip retro on autoclosed bot PRs would have prevented all 5 retro runs.
  4. #369 / #2667 — CI-aware review would have prevented premature ready-for-merge labeling.

No new proposals warranted — all actionable improvements are already tracked.

@red-hat-konflux red-hat-konflux Bot changed the title Update tektoncd pipelines to v1.12.2 (main) - autoclosed Update tektoncd pipelines to v1.12.2 (main) Jul 6, 2026
@red-hat-konflux red-hat-konflux Bot reopened this Jul 6, 2026
@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch 2 times, most recently from 4cd93f1 to 5b7504e Compare July 6, 2026 02:01
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 2:04 AM UTC · Ended 2:06 AM UTC
Commit: 47d3320 · View workflow run →

@red-hat-konflux red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-tektoncd-pipelines branch from 5b7504e to 660c17f Compare July 6, 2026 02:06
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:10 AM UTC · Completed 2:14 AM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-retro

fullsend-ai-retro Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 5:37 AM UTC · Completed 5:41 AM UTC
Commit: 47d3320 · View workflow run →

@fullsend-ai-retro

fullsend-ai-retro Bot commented Jul 6, 2026

Copy link
Copy Markdown

Retro: PR #3373 — Update tektoncd pipelines to v1.12.2

This was a bot-authored dependency bump PR (red-hat-konflux[bot]) that was never merged and accumulated 10 review agent runs and 6 retro agent runs over 8 days — 16 total dispatches with ~80 minutes of agent compute and zero value delivered. No human ever engaged with the PR.

Timeline

  • Jun 29: PR opened, review agent approved in 7 minutes (before CI). CI failed due to breaking API changes in transitive deps. PR autoclosed.
  • Jun 29 – Jul 6: Bot reopened and force-pushed daily (~02:00 UTC), triggering 2 review runs per cycle. Each autoclose triggered a retro. The retro agent correctly identified the waste each time but could not prevent subsequent dispatches.
  • Jul 6: PR finally closed for good. 6th retro dispatched (this run).

Key problems (all already tracked)

  1. Review agent approves before CI — Covered by #369, #2667
  2. No dispatch gating on closed PRs — Covered by #1439, #1870, #3010
  3. Retro deduplication — Covered by #2401
  4. Per-PR review budget / hard cap — Covered by #2587
  5. Skip retro on autoclosed bot PRs — Covered by #2461
  6. Force-push duplicate dispatch — Covered by #1418, #1452, #766
  7. Skip re-review on bot rebases with no semantic change — Covered by #1355
  8. Auto-close stale bot PRs with prolonged CI failure — Covered by #2863

No new proposals

All improvement opportunities are already tracked across 15+ open issues in fullsend-ai/fullsend. This PR is the 6th retro on the same workflow — itself an instance of the problem described in #2401. The highest-impact fixes remain #3010/#1870 (skip dispatch on closed PRs), #2587 (per-PR dispatch cap), and #2461 (skip retro on autoclosed bot PRs). Resolving any one of these would have prevented most of the waste observed here.

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 2:16 AM UTC · Ended 2:17 AM UTC
Commit: 7c8ccca · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:21 AM UTC
Commit: 7c8ccca · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:23 AM UTC · Completed 2:28 AM UTC
Commit: 7c8ccca · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 2:07 AM UTC · Ended 2:09 AM UTC
Commit: 8f05d87 · View workflow run →

@red-hat-konflux
Update tektoncd pipelines to v1.12.2
2c614f0 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code main ready-for-merge All reviewers approved — ready to merge renovate size: XL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants