• Docs @ v0.81.1
• Examples @ v0.81.1

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.1/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a830ae08bf3254c27e80b45a4284961c5f586310b61ce2ff1e5a27b6516d17c55

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a830ae08bf3254c27e80b45a4284961c5f586310b61ce2ff1e5a27b6516d17c55
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.1/release.yaml
REKOR_UUID=108e9186e8c5677a830ae08bf3254c27e80b45a4284961c5f586310b61ce2ff1e5a27b6516d17c55

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.81.1@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 [release-v0.81.x] bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#3934)

Docs

Thanks

Thanks to these contributors who contributed to v0.81.1!

• ❤️ @app/dependabot
• ❤️ @jkhelil
• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

A Helm chart to deploy the Tekton Operator and its CRDs

• Docs @ v0.81.0
• Examples @ v0.81.0

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.0/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.81.0/release.yaml
REKOR_UUID=108e9186e8c5677a00472a306f2eb6c7553ee43b383c3e96be02812532438ff4bc0e5ddb86bedfac

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.81.0@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

• ✨ feat(chains): expose storage.oci.encoding-format in CRD (#3871)

expose storage.oci.encoding-format config key in TektonChain and TektonConfig CRDs — allows configuring OCI 1.1 Referrers API storage via the operator

• ✨ feat(common): support rollout strategy in options (#3813)

options now applies deployments[].spec.strategy and
statefulSets[].spec.updateStrategy to the generated workloads instead of
ignoring them. This makes it possible to set, for example,
rollingUpdate.maxSurge: 0 on a component whose replicas are pinned
one-per-node by anti-affinity, where the default surge-based rollout cannot
schedule the extra pod.

• ✨ feat(pruner): add NetworkPolicy for controller and webhook (#3795)

TektonPruner gains a spec.networkPolicy field so its controller and webhook default-deny and allow policies can be reconciled, overridden, or disabled per component. The field is propagated from TektonConfig.

• ✨ feat(tektonpipeline): add NetworkPolicy for pipeline core components (#3758)

TektonPipeline now ships default NetworkPolicy resources for pipeline-controller, pipeline-webhook, pipeline-events-controller, and pipeline-resolvers pods, restricting network access to
only DNS, API server, Prometheus metrics, and webhook traffic. Resolvers additionally allow HTTP/HTTPS and SSH egress for git, bundle, hub, and http resolver types.

• ✨ feat: add NetworkPolicy support for operator and proxy-webhook (#3714)

Tekton Operator now ships default NetworkPolicy resources restricting network access for its own controller and proxy-webhook pods to only DNS, Kubernetes API server, Prometheus metrics, and webhook traffic. TektonPipeline also gains a spec.networkPolicy field (mirroring TektonTrigger) so its proxy-webhook's default-deny and allow policies can be reconciled, overridden, or disabled per component.

• ✨ feat(results): expose Tekton Results Watcher config via TektonConfig (#3709)

TektonConfig and TektonResult now support spec.result.watcher to configure Tekton Results Watcher behavior (for example completed_run_grace_period, check_owner, store_deadline, and disable_storing_incomplete_runs) without manually editing the tekton-results-watcher Deployment.

• ✨ Add networkpolicies RBAC to operator bundle CSVs (#3764)

Fixes

• 🐛 [cherry-pick: release-v0.81.x] fix(release): bump pinned ko/koparse images for go 1.26.5 (#3886)

Fix patch release pipeline failures caused by Go 1.26.5 requirement
mismatch in pinned ko/koparse images.

• 🐛 fix(rbac): add bind/escalate verbs for k8s install (#3739)

Fix missing RBAC permissions in the Kubernetes Helm chart and install
manifests that prevented the operator from installing Pipelines-as-Code
on Kubernetes.

• 🐛 fix(common): apply proxy settings to StatefulSets too (#3710)

Fix StatefulSet pods (used when statefulset-ordinals is enabled) not
inheriting cluster-wide proxy environment variables.

• 🐛 fix(release): resolve in-toto attestation UUID in wait-for-chains (#3859)
• 🐛 fix(common): propagate config to StatefulSets too (#3846)
• 🐛 fix(deps): bump sigstore-go with knative.dev/pkg semconv alignment (#3785)

Misc

• 🔨 add NetworkPolicy for MultiCluster Components (#3839)

Add NetworkPolicy support for TektonScheduler, TektonMulticlusterProxyAAE, and SyncerService components, giving each a default-deny policy plus targeted allow rules for required traffic.

• 🔨 feat(tektonresult): add NetworkPolicy support for Results (#3808)

Add NetworkPolicy support for Tekton Results. Default policies for Results API, watcher, retention-policy-agent, and postgres are reconciled from TektonConfig.spec.networkPolicy (enabled by default; set disabled: true to remove them).

• 🔨 feat(manualapprovalgate): add NetworkPolicy support (#3801)

ManualApprovalGate now creates default NetworkPolicies that restrict ingress/egress for its controller and webhook pods. These are enabled by default. To opt out, set spec.networkPolicy.disabled: true on the ManualApprovalGate CR.

• 🔨 feat(pruner): add NetworkPolicy for controller and webhook (#3795)

TektonPruner gains a spec.networkPolicy field so its controller and webhook default-deny and allow policies can be reconciled, overridden, or disabled per component. The field is propagated from TektonConfig.

• 🔨 feat(tektonconfig): add NetworkPolicy for console plugin (#3765)

The OpenShift Pipelines console plugin now ships default NetworkPolicy resources restricting ingress to only the OpenShift Console on port 8443. The plugin is a static file server with no
egress required.

• 🔨 chore(deps): bump the github-actions group with 5 updates (#3852)
• 🔨 chore(deps): bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 (#3844)
• 🔨 chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 (#3826)
• 🔨 chore(deps): bump the github-actions group with 5 updates (#3820)
• 🔨 chore(deps): bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (#3818)
• 🔨 chore(deps): bump k8s.io/api from 0.35.6 to 0.35.7 (#3816)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.14.0 to 1.14.1 (#3815)
• 🔨 chore(deps): bump k8s.io/apiextensions-apiserver from 0.35.6 to 0.35.7 (#3814)
• 🔨 chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#3804)
• 🔨 chore(deps): bump the github-actions group across 1 directory with 5 updates (#3794)
• 🔨 Ignore otel major/minor updates in dependabot (#3792)
• 🔨 chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 (#3767)
• 🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#3766)
• 🔨 chore(deps): bump github.com/openshift-pipelines/pipelines-as-code from 0.48.0 to 0.49.0 (#3712)
• 🔨 chore(deps): bump the github-actions group with 4 updates (#3708)
• 🔨 chore(deps): bump github.com/tektoncd/pruner from 0.4.0 to 0.4.1 (#3706)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.14.0 (#3705)
• 🔨 chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#3702)
• 🔨 chore(deps): bump the github-actions group with 3 updates (#3667)
• 🔨 chore(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 (#3645)
• 🔨 chore(deps): bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#3644)
• 🔨 chore(deps): bump the github-actions group with 6 updates (#3634)
• 🔨 chore(deps): bump github.com/cert-manager/cert-manager from 1.20.2 to 1.20.3 (#3593)
• 🔨 chore(deps): bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#3583)
• 🔨 ci(dependabot): remove unsupported cooldown fields from github-actions (#3530)
• 🔨 chore(deps): bump chainguard-dev/actions from 1.6.22 to 1.6.23 (#3527)
• 🔨 chore(deps): bump k8s.io/code-generator from 0.35.5 to 0.35.6 (#3525)
• 🔨 chore(deps): bump k8s.io/api from 0.35.5 to 0.35.6 (#3524)
• 🔨 chore(deps): bump k8s.io/apiextensions-apiserver from 0.35.5 to 0.35.6 (#3523)
• 🔨 Regenerate dependabot.yml configuration (#3517)

Docs

Thanks

Thanks to these contributors who contributed to v0.81.0!

• ❤️ @ab-ghosh
• ❤️ @adchauha
• ❤️ @anasalli
• ❤️ @app/dependabot
• ❤️ @aqeelat
• ❤️ @divyansh42
• ❤️ @enarha
• ❤️ @infernus01
• ❤️ @jkhelil
• ❤️ @khrm
• ❤️ @l-qing
• ❤️ @ngelman1
• ❤️ @pramodbindal
• ❤️ @pratap0007
• ❤️ @pujitha24
• ❤️ @sybernatus
• ❤️ @tekton-robot
• ❤️ @theakshaypant
• ❤️ @vdemeester
• ❤️ @zakisk

Extra shout-out for awesome release notes:

• 😍 @adchauha
• 😍 @anasalli
• 😍 @aqeelat
• 😍 @divya...

A Helm chart to deploy the Tekton Operator and its CRDs

• Docs @ v0.76.3
• Examples @ v0.76.3

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.76.3/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a0c039fb63c196c60609946b5d04fdeadcd09485b0066bb0a4d3f6c2d1a44878d

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a0c039fb63c196c60609946b5d04fdeadcd09485b0066bb0a4d3f6c2d1a44878d
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.76.3/release.yaml
REKOR_UUID=108e9186e8c5677a0c039fb63c196c60609946b5d04fdeadcd09485b0066bb0a4d3f6c2d1a44878d

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.76.3@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

Docs

Thanks

Thanks to these contributors who contributed to v0.76.3!

• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

• Docs @ v0.76.2
• Examples @ v0.76.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.76.2/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a96a2811fe2b271dd2eb032706397c69dc680694079b55678a18aa778286738ba

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a96a2811fe2b271dd2eb032706397c69dc680694079b55678a18aa778286738ba
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.76.2/release.yaml
REKOR_UUID=108e9186e8c5677a96a2811fe2b271dd2eb032706397c69dc680694079b55678a18aa778286738ba

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.76.2@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 [release-v0.76.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#3772)

Docs

Thanks

Thanks to these contributors who contributed to v0.76.2!

• ❤️ @app/dependabot
• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

Tekton Operator release v0.75.2 "Release v0.75.2"

-Docs @ v0.75.2
-Examples @ v0.75.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.75.2/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a625dbf777f9c6214feb8141733249f6dccee2ac5104168185f229a464c4c8d52

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a625dbf777f9c6214feb8141733249f6dccee2ac5104168185f229a464c4c8d52
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.75.2/release.yaml
REKOR_UUID=108e9186e8c5677a625dbf777f9c6214feb8141733249f6dccee2ac5104168185f229a464c4c8d52

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.75.2@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

Docs

Thanks

Thanks to these contributors who contributed to v0.75.2!

• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

Tekton Operator release v0.77.1 "Release v0.77.1"

-Docs @ v0.77.1
-Examples @ v0.77.1

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.77.1/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a47dea07c7b48970998c0421a867d751b6748b98ebd87b540c06c7e231b40e0c4

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a47dea07c7b48970998c0421a867d751b6748b98ebd87b540c06c7e231b40e0c4
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.77.1/release.yaml
REKOR_UUID=108e9186e8c5677a47dea07c7b48970998c0421a867d751b6748b98ebd87b540c06c7e231b40e0c4

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.77.1@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 ci(e2e): fix ko >=v0.19 SBOM push failure on plain-HTTP registry (#3654)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.3.5 to 1.3.6 (#3606)
• 🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.5.11 to 1.5.16 (#3602)
• 🔨 chore(deps): bump k8s.io/apiextensions-apiserver from 0.32.9 to 0.32.13 (#3574)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.3.4 to 1.3.5 (#3572)
• 🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 (#3571)
• 🔨 chore(deps): bump github/codeql-action from 4.31.6 to 4.31.11 (#3565)
• 🔨 chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#3562)
• 🔨 chore(deps): bump actions/checkout from 6.0.0 to 6.0.3 (#3560)
• 🔨 chore(deps): bump peter-evans/create-pull-request from 7.0.9 to 7.0.11 (#3559)
• 🔨 chore(deps): bump peter-evans/slash-command-dispatch from 5.0.0 to 5.0.2 (#3558)

Docs

Thanks

Thanks to these contributors who contributed to v0.77.1!

• ❤️ @app/dependabot
• ❤️ @jkhelil
• ❤️ @pratap0007
• ❤️ @tekton-robot
• ❤️ @vdemeester

Extra shout-out for awesome release notes:

• 😍 @jkhelil

Tekton Operator release v0.79.2 "Release v0.79.2"

-Docs @ v0.79.2
-Examples @ v0.79.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.79.2/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a8e16233d95b40c454dc247ce2ebfbb5fac46cab1e9be27961087fa0a28a52a87

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a8e16233d95b40c454dc247ce2ebfbb5fac46cab1e9be27961087fa0a28a52a87
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.79.2/release.yaml
REKOR_UUID=108e9186e8c5677a8e16233d95b40c454dc247ce2ebfbb5fac46cab1e9be27961087fa0a28a52a87

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.79.2@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 [release-v0.79.x] fix(tekton-results): use passthrough TLS termination for route (#3428)

Tekton Results API route now uses passthrough TLS termination by default, enabling end-to-end encryption between clients and the Results API service.

• 🔨 chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.25 to 1.6.26 in the github-actions group (#3665)
• 🔨 chore(deps): bump the github-actions group across 1 directory with 4 updates (#3632)
• 🔨 chore(deps): bump github.com/cert-manager/cert-manager from 1.19.5 to 1.19.6 (#3599)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.9.4 to 1.9.5 (#3598)
• 🔨 chore(deps): bump github.com/cert-manager/cert-manager from 1.19.4 to 1.19.5 (#3577)
• 🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 (#3576)
• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.9.3 to 1.9.4 (#3575)
• 🔨 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#3570)
• 🔨 chore(deps): bump actions/cache from 5.0.3 to 5.0.5 (#3569)
• 🔨 chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#3568)
• 🔨 chore(deps): bump chainguard-dev/actions from 1.6.5 to 1.6.23 (#3567)
• 🔨 chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (#3566)
• 🔨 chore(deps): bump pipelines-as-code to v0.42.1 (#3478)

Docs

Thanks

Thanks to these contributors who contributed to v0.79.2!

• ❤️ @aThorp96
• ❤️ @app/dependabot
• ❤️ @divyansh42
• ❤️ @enarha
• ❤️ @jkhelil
• ❤️ @openshift-pipelines-bot
• ❤️ @pratap0007
• ❤️ @tekton-robot
• ❤️ @theakshaypant

Extra shout-out for awesome release notes:

• 😍 @aThorp96
• 😍 @divyansh42
• 😍 @jkhelil

Tekton Operator release v0.78.2 "Release v0.78.2"

-Docs @ v0.78.2
-Examples @ v0.78.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/operator/previous/v0.78.2/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a941d80cffbb6afc06ec28aa339d7ef2f5d81e4a3f676c9e9d99a5d650f6ca9b1

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a941d80cffbb6afc06ec28aa339d7ef2f5d81e4a3f676c9e9d99a5d650f6ca9b1
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/operator/previous/v0.78.2/release.yaml
REKOR_UUID=108e9186e8c5677a941d80cffbb6afc06ec28aa339d7ef2f5d81e4a3f676c9e9d99a5d650f6ca9b1

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.78.2@sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

Fixes

Misc

• 🔨 chore(deps): bump github.com/tektoncd/pipeline from 1.6.3 to 1.6.4 (#3607)
• 🔨 chore(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#3604)
• 🔨 chore(deps): bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 (#3546)
• 🔨 chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#3545)
• 🔨 chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 (#3544)
• 🔨 chore(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 (#3543)
• 🔨 chore(deps): bump chainguard-dev/actions from 1.5.11 to 1.5.16 (#3542)
• 🔨 chore(deps): bump github/codeql-action from 4.31.2 to 4.31.11 (#3541)

Docs

Thanks

Thanks to these contributors who contributed to v0.78.2!

• ❤️ @aThorp96
• ❤️ @app/dependabot
• ❤️ @jkhelil
• ❤️ @mbpavan
• ❤️ @pratap0007
• ❤️ @tekton-robot

Extra shout-out for awesome release notes:

• 😍 @aThorp96
• 😍 @jkhelil