• Docs @ v0.37.0
• Examples @ v0.37.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.37.0/interceptors.yaml

REKOR_UUID=108e9186e8c5677a1a23009a1951f3bd03d8d05e083fa175f2559de39d752ad4f3e71db31cb030b4

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.37.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml
curl "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

• 🐛 fix: don't pre-parse url-encoded body for webhook-first interceptor chains (#2077)

Fix a bug where a webhook-type interceptor placed first in a trigger's
interceptor chain would receive a pre-parsed JSON body instead of the
original request body for application/x-www-form-urlencoded requests
(e.g. Slack slash commands), breaking custom interceptors that parse the
raw form-encoded payload themselves.

Misc

• 🔨 chore: switch base image to ghcr.io/tektoncd/plumbing/static-base (#2043)
• 🔨 Fix ko build failure due to kodata symlink escaping root (#2092)
• 🔨 Bump ko in publish task (#2091)
• 🔨 Bump the all group with 11 updates (#2087)
• 🔨 Update releases.md for v0.36.0 (#2085)
• 🔨 Bump github/codeql-action from 4.36.2 to 4.37.6 (#2082)
• 🔨 Bump golangci-lint from v2.8.0 to v2.12.2 (#2081)
• 🔨 Bump the all group across 1 directory with 15 updates (#2080)
• 🔨 Bump github.com/google/cel-go from 0.28.1 to 0.29.0 (#2079)
• 🔨 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#2076)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#2075)
• 🔨 Bump step-security/harden-runner from 2.19.4 to 2.20.0 (#2072)
• 🔨 Ignore otel major/minor updates in dependabot (#2070)
• 🔨 ci(.github/workflows): enable Codecov coverage reporting (#2069)
• 🔨 fix: pass --insecure-registry to ko for plain-HTTP KinD registry (#2067)
• 🔨 Bump golang.org/x/crypto from 0.50.0 to 0.52.0 (#2066)
• 🔨 Bump ko-build/setup-ko from 0.9 to 0.10 (#2065)
• 🔨 Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#2063)
• 🔨 Bump golang.org/x/net from 0.54.0 to 0.55.0 (#2060)
• 🔨 Bump actions/cache from 5.0.5 to 6.1.0 (#2059)
• 🔨 Bump actions/setup-go from 6.4.0 to 6.5.0 (#2058)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#2057)
• 🔨 fix: replace kodata LICENSE symlinks with actual files (#2056)
• 🔨 Bump actions/checkout from 6.0.3 to 7.0.0 (#2054)
• 🔨 Bump github/codeql-action from 4.36.1 to 4.36.2 (#2050)
• 🔨 Bump actions/checkout from 6.0.2 to 6.0.3 (#2046)
• 🔨 Bump github/codeql-action from 4.35.4 to 4.36.1 (#2045)
• 🔨 Add agentic workflows context files (#2042)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#2040)
• 🔨 Bump step-security/harden-runner from 2.19.3 to 2.19.4 (#2039)
• 🔨 Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#2038)
• 🔨 Update pod-template.yaml example in cheat sheet (#2036)
• 🔨 feat: add retest workflow using plumbing reusable workflow (#1929)
• 🔨 Add dependabot config generator for active release branches (#2048)

Docs

Thanks

Thanks to these contributors who contributed to v0.37.0!

• ❤️ @app/dependabot
• ❤️ @enarha
• ❤️ @jkhelil
• ❤️ @khrm
• ❤️ @pujitha24
• ❤️ @vdemeester

Extra shout-out for awesome release notes:

• 😍 @pujitha24

Tekton Triggers release v0.36.0 "Tekton Triggers"

-Docs @ v0.36.0
-Examples @ v0.36.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.36.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a6b2a69794ca92fea0d3bb45b80f923817fd184a39c84987cd53cee88dcf9dc5f

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a6b2a69794ca92fea0d3bb45b80f923817fd184a39c84987cd53cee88dcf9dc5f
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.36.0/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/${VERSION_TAG}/interceptors.yaml

REKOR_UUID=108e9186e8c5677a6b2a69794ca92fea0d3bb45b80f923817fd184a39c84987cd53cee88dcf9dc5f

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.36.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml
curl -L "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨Add TLS security profile support for core interceptors (#2019)

Core interceptors now honor the TLS security profile injected by the Tekton operator via TLS_MIN_VERSION, TLS_CIPHER_SUITES, and TLS_CURVE_PREFERENCES environment variables, allowing cluster-wide TLS policy enforcement on OpenShift.

• ✨ feat(metrics): Migration from OpenCensus to OpenTelemetry (#1934)

Migrated metrics from OpenCensus to OpenTelemetry.

ACTION REQUIRED:

1. Configuration key change
   Replace metrics.backend-destination with metrics-protocol in your config-observability-triggers ConfigMap.
   Prometheus export remains the default — no change needed if you were not customizing observability.

2. Infrastructure metric renaming
   Infrastructure metrics (workqueue, K8s client) have been renamed from the
   tekton_triggers_controller_ prefix to standard Knative/OpenTelemetry namespaces.

   ┌──────────────────────────────────────────────────────────┬───────────────────────────────────────────────────┐
   │ Old Metric Name (OpenCensus) │ New Metric Name (OpenTelemetry) │
   ├──────────────────────────────────────────────────────────┼───────────────────────────────────────────────────┤
   │ tekton_triggers_controller_workqueue_depth │ kn_workqueue_depth │
   │ tekton_triggers_controller_workqueue_adds_total │ kn_workqueue_adds_total │
   │ tekton_triggers_controller_workqueue_queue_latency_* │ kn_workqueue_queue_duration_seconds_* │
   │ tekton_triggers_controller_workqueue_work_duration_* │ kn_workqueue_process_duration_seconds_* │
   │ tekton_triggers_controller_workqueue_unfinished_work_* │ kn_workqueue_unfinished_work_seconds │
   │ tekton_triggers_controller_workqueue_retries_total │ kn_workqueue_retries_total │
   │ tekton_triggers_controller_client_latency │ http_client_request_duration_seconds_* │
   │ tekton_triggers_controller_client_results │ kn_k8s_client_http_response_status_code_total │
   └──────────────────────────────────────────────────────────┴───────────────────────────────────────────────────┘

3. Sink counter metrics renamed

   ┌──────────────────────────────────────────┬────────────────────────────────────────────┐
   │ Old Metric Name (OpenCensus) │ New Metric Name (OpenTelemetry) │
   ├──────────────────────────────────────────┼────────────────────────────────────────────┤
   │ eventlistener_event_received_count │ eventlistener_event_received_total │
   │ eventlistener_triggered_resources │ eventlistener_triggered_resources_total │
   └──────────────────────────────────────────┴────────────────────────────────────────────┘

4. All other metric names are unchanged
   controller_eventlistener_count, controller_triggerbinding_count,
   controller_triggertemplate_count, controller_clustertriggerbinding_count,
   controller_clusterinterceptor_count, eventlistener_http_duration_seconds

Fixes

• 🐛 Fix e2e failure due to owners file change (#1970)

Misc

• 🔨 cleanup: replace GCS release URLs with infra.tekton.dev (#1973)
• 🔨 Bump step-security/harden-runner from 2.19.0 to 2.19.3 (#2033)
• 🔨 Bump github/codeql-action from 4.35.2 to 4.35.4 (#2032)
• 🔨 Bump the all group across 1 directory with 7 updates (#2031)
• 🔨 Bump the pipelines dependency and other deps (#2020)
• 🔨 Change release pipeline to use 'release-draft-oci' (#2018)
• 🔨 Fix curl command to follow redirects for release file (#2017)
• 🔨 Bump go.uber.org/zap from 1.27.1 to 1.28.0 in the all group (#2016)
• 🔨 Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 (#2007)
• 🔨 Bump github.com/tektoncd/pipeline from 1.11.0 to 1.11.1 (#2005)
• 🔨 Bump actions/cache from 5.0.4 to 5.0.5 (#2004)
• 🔨 Bump step-security/harden-runner from 2.17.0 to 2.19.0 (#2003)
• 🔨 Bump github/codeql-action from 4.35.1 to 4.35.2 (#2002)
• 🔨 Bump the all group across 1 directory with 5 updates (#2001)
• 🔨 Fix intermittent panic in Test_UpdateCACertToClusterInterceptorCRD (#2000)
• 🔨 Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#1999)
• 🔨 ci: Fix zizmor security findings in GitHub Actions (#1998)
• 🔨 Update release ko image to go1.25 (#1997)
• 🔨 Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1996)
• 🔨 Bump step-security/harden-runner from 2.16.1 to 2.17.0 (#1995)
• 🔨 Bump github.com/google/cel-go from 0.27.0 to 0.28.0 in the all group (#1994)
• 🔨 Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 (#1993)
• 🔨 Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 (#1992)
• 🔨 Bump step-security/harden-runner from 2.16.0 to 2.16.1 (#1991)
• 🔨 Bump the all group with 4 updates (#1990)
• 🔨 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#1989)
• 🔨 Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#1988)
• 🔨 Bump tektoncd/pipeline to v1.11.0 and update vendor dependencies (#1986)
• 🔨 Bump the all group across 1 directory with 7 updates (#1985)
• 🔨 Bump actions/setup-go from 6.3.0 to 6.4.0 (#1984)
• 🔨 Bump github/codeql-action from 4.34.1 to 4.35.1 (#1983)
• 🔨 Bump github/codeql-action from 4.33.0 to 4.34.1 (#1980)
• 🔨 Bump actions/cache from 5.0.3 to 5.0.4 (#1979)
• 🔨 Bump github/codeql-action from 4.32.6 to 4.33.0 (#1976)
• 🔨 Bump fgrosse/go-coverage-report from 1.2.0 to 1.3.0 (#1975)
• 🔨 Bump step-security/harden-runner from 2.15.1 to 2.16.0 (#1974)
• 🔨 Bump github/codeql-action from 4.32.5 to 4.32.6 (#1969)
• 🔨 Bump step-security/harden-runner from 2.15.0 to 2.15.1 (#1968)
• 🔨 Bump go version to 1.25.6 (#1966)
• 🔨 Move inactive approvers to emeritus (#1965)
• 🔨 Bump step-security/harden-runner from 2.14.2 to 2.15.0 (#1963)
• 🔨 Bump github/codeql-action from 4.32.3 to 4.32.5 (#1962)
• 🔨 Bump actions/setup-go from 6.2.0 to 6.3.0 (#1961)
• 🔨 Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#1960)
• 🔨 Bump the all group across 1 directory with 5 updates (#1959)
• 🔨 Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#1958)
• 🔨 Consolidate CI workflows for build, lint, and e2e tests (#1957)
• 🔨 Update releases.md for v0.35.0 (#1952)
• 🔨 Bump github/codeql-action from 4.32.2 to 4.32.3 (#1951)
• 🔨 Bump the all group with 6 updates (#1950)
• 🔨 Update Release Cheat Sheet for release-draft-oci pipeline (#1948)
• 🔨 Change precheck in release pipeline to OCI infra (#1947)
• 🔨 fix: release cheat sheet doc typos (#1953)

Docs

Thanks

Thanks to these contributors who contributed to v0.36.0!

• ❤️ @ankrsinha
• ❤️ @app/dependabot
• ❤️ @infernus01
• ❤️ @jkhelil
• ❤️ @khrm
• ❤️ @ngelman1
• ❤️ @vdemeester

Extra shout-out for awesome release notes:

• 😍 @infernus01
• 😍 @jkhelil

-Docs @ v0.35.0
-Examples @ v0.35.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.0/release.yaml
kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.35.0/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a45203936a8966245d4ee1bb04114c3c9a7a8ed99eae1e452c4e75cd00bfe19eb

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a45203936a8966245d4ee1bb04114c3c9a7a8ed99eae1e452c4e75cd00bfe19eb
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/${VERSION_TAG}/release.yaml
INTERCEPTORS_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/${VERSION_TAG}/interceptors.yaml

REKOR_UUID=108e9186e8c5677a45203936a8966245d4ee1bb04114c3c9a7a8ed99eae1e452c4e75cd00bfe19eb

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.35.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml
curl -L "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 Remove GHCR migration notice from readme (#1935)
• 🔨 Bump step-security/harden-runner from 2.14.1 to 2.14.2 (#1946)
• 🔨 Bump github/codeql-action from 4.32.1 to 4.32.2 (#1945)
• 🔨 Bump the all group with 3 updates (#1944)
• 🔨 Bump step-security/harden-runner from 2.14.0 to 2.14.1 (#1943)
• 🔨 Bump actions/setup-go from 6.1.0 to 6.2.0 (#1942)
• 🔨 Bump actions/checkout from 6.0.1 to 6.0.2 (#1941)
• 🔨 Bump github/codeql-action from 4.31.8 to 4.32.0 (#1940)
• 🔨 Bump the all group with 4 updates (#1939)
• 🔨 Bump the all group across 1 directory with 14 updates (#1938)
• 🔨 Bump github/codeql-action from 4.31.5 to 4.31.8 (#1933)
• 🔨 Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#1932)
• 🔨 Bump step-security/harden-runner from 2.13.2 to 2.14.0 (#1931)
• 🔨 Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 (#1927)
• 🔨 Bump actions/checkout from 6.0.0 to 6.0.1 (#1926)
• 🔨 Bump actions/setup-go from 6.0.0 to 6.1.0 (#1921)
• 🔨 Bump actions/checkout from 5.0.0 to 6.0.0 (#1920)
• 🔨 Bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#1919)
• 🔨 Bump github/codeql-action from 4.31.2 to 4.31.5 (#1918)
• 🔨 Bump the all group across 1 directory with 9 updates (#1917)
• 🔨 Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#1916)
• 🔨 Bump step-security/harden-runner from 2.13.1 to 2.13.2 (#1913)
• 🔨 Update release-cheat-sheet to work on OCI and release file with 0.34 version (#1911)

Thanks

Thanks to these contributors who contributed to v0.35.0!

• ❤️ @AlanGreene
• ❤️ @dependabot[bot]
• ❤️ @savitaashture

-Docs @ v0.34.0
-Examples @ v0.34.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.34.0/release.yaml
kubectl apply -f https://infra.tekton.dev/tekton-releases/triggers/previous/v0.34.0/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677af5fc7b3c5466e79e0ce84af7fbea9da03d09fcf1f91c05e1d34c23b20af28f3f

Obtain the attestation:

REKOR_UUID=108e9186e8c5677af5fc7b3c5466e79e0ce84af7fbea9da03d09fcf1f91c05e1d34c23b20af28f3f
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/triggers/previous/v0.34.0/release.yaml
REKOR_UUID=108e9186e8c5677af5fc7b3c5466e79e0ce84af7fbea9da03d09fcf1f91c05e1d34c23b20af28f3f

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.34.0@sha256:" + .digest.sha256')

# Download the release file
curl -LO "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ feat: auto fill http request content length for binding and cel eval tools (#1887)

feat: auto fill http request content length for binding and cel eval tools

• ✨ Add tkn triggers bootstrap command for automated setup (#1890)

Fixes

• 🐛 Update github interceptor to only validate sha-256 signature (#1899)

The GitHub interceptor now only accepts SHA-256 signatures via the X-Hub-Signature-256 header and no longer supports SHA-1 signatures via X-Hub-Signature. Standard GitHub webhooks are unaffected as GitHub sends both headers by default, but custom webhook implementations must update their HMAC signature generation from SHA-1 to SHA-256 or they will receive "no X-Hub-Signature-256 header set" errors.

• 🐛 fix: escape Tekton variable syntax in trigger parameters (#1896)

Bugfix: escape Tekton variable syntax in trigger parameters (e.g. when $() are found in pr.body.description)

• 🐛 fix: test instability in UpdateCACertToClusterInterceptorCRD unit test (#1878)

Misc

• 🔨 Update release-cheat-sheet (#1910)
• 🔨 chore: update pipelines for oracle bucket target (#1909)
• 🔨 Change the Pipelines install location to oracle infra from gcs (#1908)
• 🔨 Update Go version in golangci-lint workflow (#1907)
• 🔨 Pin checkout to sha in presubmit ci tests (#1906)
• 🔨 Bump github/codeql-action from 4.31.0 to 4.31.2 (#1905)
• 🔨 Bump github.com/tektoncd/pipeline from 1.5.0 to 1.6.0 in the all group (#1904)
• 🔨 Bump github/codeql-action from 3.30.6 to 4.31.0 (#1902)
• 🔨 Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#1901)
• 🔨 Bump the all group with 7 updates (#1900)
• 🔨 Remove condition for dependabot in golangci-lint (#1894)
• 🔨 Pin actions by commit SHA (#1893)
• 🔨 Add GitHub Actions workflow for go coverage job (#1891)
• 🔨 Migrate to GH action for presubmit ci jobs (#1889)
• 🔨 Bump the all group across 1 directory with 15 updates (#1888)
• 🔨 Bump actions/setup-go from 5.5.0 to 6.0.0 (#1884)
• 🔨 Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 in /tools (#1881)
• 🔨 Bump actions/checkout from 4 to 5 (#1880)
• 🔨 Update release doc with v0.33.0 (#1877)
• 🔨 Remove linux/arm from platform we publish (#1875)

Thanks

Thanks to these contributors who contributed to v0.34.0!

• ❤️ @AlanGreene
• ❤️ @anithapriyanatarajan
• ❤️ @cmorinupgrade
• ❤️ @dependabot[bot]
• ❤️ @infernus01
• ❤️ @khrm
• ❤️ @l-qing
• ❤️ @savitaashture
• ❤️ @wuhuizuo

Extra shout-out for awesome release notes:

• 😍 @cmorinupgrade
• 😍 @infernus01
• 😍 @wuhuizuo

-Docs @ v0.33.0
-Examples @ v0.33.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.33.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a920a272eb27aa6fcc7d307787cce0478a57a43ac0c60867837b79d610ea3608e

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a920a272eb27aa6fcc7d307787cce0478a57a43ac0c60867837b79d610ea3608e
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/${VERSION_TAG}/release.yaml
INTERCEPTORS_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/${VERSION_TAG}/interceptors.yaml
REKOR_UUID=108e9186e8c5677a920a272eb27aa6fcc7d307787cce0478a57a43ac0c60867837b79d610ea3608e

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.33.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml
curl "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ Add anti-affinity rules to controller's replicas (#1861)
  As part of improving high availability (HA) for the Tekton Triggers controller, this update adds a preferredDuringSchedulingIgnoredDuringExecution pod anti-affinity rule. This ensures that multiple replicas of the controller are preferably scheduled on different nodes, reducing the risk of service disruption in case of a node failure.

Fixes

• 🐛 Fix panic on concurrent map writes (#1866)

fix data race that can occur when using a TriggerGroup that selects more than one Trigger with extensions

• 🐛 Implement deep-copy fix for data race (#1871)
• 🐛 Fix panic for e2e go tests (#1857)
• 🐛 Add Security Context to Getting Started Example (#1855)
• 🐛 fix: Issue in eventlisteners e2e when kubernetes host has a path (#1805)

Misc

• 🔨 Bump pipelines and other dependencies (#1868)

Uodate CEL Go to v0.26.0 and Pipelines to 1.3.1.

• 🔨 cleanup: fix golangci-lint setup in Makefile (#1849)
• 🔨 Update the ko to v0.18.0 with go1.24.5 (#1872)
• 🔨 Bump the all group across 1 directory with 2 updates (#1869)
• 🔨 Add skip security context flag in e2e script (#1853)
• 🔨 Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in /tools (#1852)
• 🔨 Bump step-security/harden-runner from 2.12.1 to 2.12.2 (#1851)
• 🔨 Run Integration tests on microshift (#1850)
• 🔨 Bump step-security/harden-runner from 2.12.0 to 2.12.1 (#1848)
• 🔨 Migrate golangci lint to version 2 (#1845)
• 🔨 Fix subpath capitalisation (#1843)
• 🔨 Bump the all group across 1 directory with 8 updates (#1842)
• 🔨 Bump actions/setup-go from 5.4.0 to 5.5.0 (#1839)
• 🔨 Update some dependancy from dependabot (#1870)
• 🔨 fix: remove duplicated 'the' in triggers-api docs (#1847)

Docs

• 📖 Update release doc with v0.32.0 (#1859)

Thanks

Thanks to these contributors who contributed to v0.33.0!

• ❤️ @AlanGreene
• ❤️ @csullivanupgrade
• ❤️ @danielfbm
• ❤️ @dependabot[bot]
• ❤️ @infernus01
• ❤️ @jkhelil
• ❤️ @khrm
• ❤️ @savitaashture
• ❤️ @tylerauerbeck

Extra shout-out for awesome release notes:

• 😍 @csullivanupgrade
• 😍 @jkhelil
• 😍 @khrm

-Docs @ v0.32.0
-Examples @ v0.32.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.32.0/release.yaml
kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.32.0/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677ab3a0005892bb67e811a79dfb38afdde7453855993480ace29e0146b4bbbc6662

Obtain the attestation:

REKOR_UUID=108e9186e8c5677ab3a0005892bb67e811a79dfb38afdde7453855993480ace29e0146b4bbbc6662
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.32.0/release.yaml
REKOR_UUID=108e9186e8c5677ab3a0005892bb67e811a79dfb38afdde7453855993480ace29e0146b4bbbc6662

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":
v0.32.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ Add KUBERNETES_MIN_VERSION env to override k8s variable (#1818)

Add KUBERNETES_MIN_VERSION env to override k8s variable. Currently, it is set 1.28 by default.

• ✨ Allow users to set custom securityContext in EventListener spec (#1832)

1. Users can now define their own securityContext under the EventListener YAML.
   ex:

spec:
  serviceAccountName: tekton-triggers-example-sa
  resources:
    kubernetesResource:
      spec:
        template:
          spec:
            securityContext:
              runAsNonRoot: true
            containers:
              - resources:
                  requests:
                    memory: "64Mi"
                    cpu: "250m"
                  limits:
                    memory: "128Mi"
                    cpu: "500m"
                securityContext:
                  readOnlyRootFilesystem: true

1. When el-security-context is true

• If user sets a custom securityContext, it has given the priority and used same.
• If not, a default securityContext is applied.

Fixes

Misc

• 🔨 Bump the all group across 1 directory with 8 updates (#1838)
• 🔨 Bump golangci/golangci-lint-action from 6.2.0 to 8.0.0 (#1837)
• 🔨 Bump step-security/harden-runner from 2.11.1 to 2.12.0 (#1835)
• 🔨 Move Integration tests to GH action and Kind Cluster (#1829)
• 🔨 Consume release pipeline images and task bundles from GHCR (#1821)
• 🔨 Bump actions/setup-go from 5.3.0 to 5.4.0 (#1820)
• 🔨 Bump golangci/golangci-lint-action from 6.2.0 to 6.5.2 (#1819)
• 🔨 Enable GolangCI Linter used in Pipeline repo (#1647)
• 🔨 Update to latest pipeline and knative/pkg (#1825)

Docs

• 📖 Add ghcr.io migration banner to README.md. (#1828)

Thanks

Thanks to these contributors who contributed to v0.32.0!

• ❤️ @AlanGreene
• ❤️ @dependabot[bot]
• ❤️ @khrm
• ❤️ @savitaashture
• ❤️ @twoGiants

Extra shout-out for awesome release notes:

• 😍 @khrm
• 😍 @savitaashture

-Docs @ v0.31.0
-Examples @ v0.31.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.31.0/release.yaml
kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.31.0/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a07cc569190ef56db5be79598a0427d17fbb556b35148f100226157292f46d460

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a07cc569190ef56db5be79598a0427d17fbb556b35148f100226157292f46d460
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.31.0/release.yaml
REKOR_UUID=108e9186e8c5677a07cc569190ef56db5be79598a0427d17fbb556b35148f100226157292f46d460

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.31.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ Triggers now support adding ImagePullSecrets field as part of EventListener object (#1787)

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: fission-ci-listener-test
spec:
  serviceAccountName: tekton-triggers-example-sa
  resources:
    kubernetesResource:
      spec:
        template:
          spec:
            imagePullSecrets:
              - name: docker-login

Misc

• 🔨 Bump the all group across 1 directory with 15 updates (#1804)
• 🔨 Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 (#1803)
• 🔨 Bump actions/setup-go from 5.2.0 to 5.3.0 (#1802)
• 🔨 Migrate to GitHubAction for GolangCI Lint (#1795)
• 🔨 Bump actions/checkout from 2 to 4 (#1794)
• 🔨 Bump github/codeql-action from 2 to 3 (#1793)
• 🔨 Update release doc with v0.30.0 (#1781)

Docs

• 📖 Point Gitlab Interceptors docs to more direct Webhook event types link (#1786)
• 📖 Update DEVELOPMENT.md (#1783)

Thanks

Thanks to these contributors who contributed to v0.31.0!

• ❤️ @AndrewTasso
• ❤️ @clintonsteiner
• ❤️ @dependabot[bot]
• ❤️ @khrm
• ❤️ @lx1036

Extra shout-out for awesome release notes:

• 😍 @lx1036

-Docs @ v0.30.1
-Examples @ v0.30.1

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.1/release.yaml
kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.1/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a6acf7d6fb9d83f562974223e03ced6fa0dc9fda20c2b47ff279c4b1a238f3185

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a6acf7d6fb9d83f562974223e03ced6fa0dc9fda20c2b47ff279c4b1a238f3185
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.1/release.yaml
REKOR_UUID=108e9186e8c5677a6acf7d6fb9d83f562974223e03ced6fa0dc9fda20c2b47ff279c4b1a238f3185

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.30.1@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Fixes

• 🐛 [release-v0.30.x] Upgrade golang.org/x/crypto to 0.31.0 (#1785)

Misc

• 🔨 [release-v0.30.x] Fix the release cheat sheet - Rekor ID Fetch (#1790)

Thanks

Thanks to these contributors who contributed to v0.30.1!

• ❤️ @savitaashture
• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

-Docs @ v0.30.0
-Examples @ v0.30.0

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a05ca2593a924c2abaf6290c29d6d5192c8d918d7d74b054734c58b63ec6c8562

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a05ca2593a924c2abaf6290c29d6d5192c8d918d7d74b054734c58b63ec6c8562
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/${VERSION_TAG}/release.yaml
INTERCEPTORS_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/${VERSION_TAG}/interceptors.yaml
REKOR_UUID=108e9186e8c5677a05ca2593a924c2abaf6290c29d6d5192c8d918d7d74b054734c58b63ec6c8562

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.30.0@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml
curl "$INTERCEPTORS_FILE" >> release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Fixes

Misc

• 🔨 Bump pipeline 0.65.0 LTS (#1775)
• 🔨 Bump the CEl-GO to v0.21.0 (#1776)
• 🔨 Rename Decade to Century (#1773)
• 🔨 Migrate nightly builds and releases to ghcr.io (#1767)
• 🔨 Add dependabot to update go mod and github action dependencies (#1770)

Docs

• 📖 Update the release cheat-sheet (#1769)
• 📖 Update release doc with v0.29.0 LTS (#1759)

Thanks

Thanks to these contributors who contributed to v0.30.0!

• ❤️ @afrittoli
• ❤️ @khrm
• ❤️ @omertuc
• ❤️ @savitaashture

-Docs @ v0.29.2
-Examples @ v0.29.2

Installation one-liner

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.29.2/release.yaml
kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.29.2/interceptors.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a2dae70ab726277f2c4c5ba39bcc1ac1bfd845967f596e06890934f5e86820376

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a2dae70ab726277f2c4c5ba39bcc1ac1bfd845967f596e06890934f5e86820376
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.29.2/release.yaml
REKOR_UUID=108e9186e8c5677a2dae70ab726277f2c4c5ba39bcc1ac1bfd845967f596e06890934f5e86820376

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.29.2@sha256:" + .digest.sha256')

# Download the release file
curl "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Security Fixes

• 🐛 [release-v0.29.x] Upgrade golang.org/x/crypto to 0.31.0 (#1784)

Misc

• 🔨 [release-v0.29.x] Update the relese cheat-sheet (#1791)
• 🔨 [release-v0.29.x] Fix the release cheat sheet - Rekor ID Fetch (#1789)
• 🔨 [release-v0.29.x] Migrate nightly builds and releases to ghcr.io (#1788)

Thanks

Thanks to these contributors who contributed to v0.29.2!

• ❤️ @savitaashture
• ❤️ @tekton-robot

Extra shout-out for awesome release notes: