From b12502b20a672614dbbe0123c072fecc067ccb82 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Fri, 18 Sep 2026 11:15:23 +0200 Subject: [PATCH 1/2] chore: bump version to v1.7.1 Signed-off-by: Vincent Demeester --- README.md | 2 +- stepaction/git-clone/git-clone.yaml | 24 +++++++++++++++++++++--- task/git-clone/git-clone.yaml | 24 +++++++++++++++++++++--- 3 files changed, 43 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index f154df4e..c8e20027 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ taskRef: resolver: bundles params: - name: bundle - value: ghcr.io/tektoncd-catalog/git-clone/bundle:v1.7.0 + value: ghcr.io/tektoncd-catalog/git-clone/bundle:v1.7.1 - name: name value: git-clone - name: kind diff --git a/stepaction/git-clone/git-clone.yaml b/stepaction/git-clone/git-clone.yaml index c2e1f119..41aadc6a 100644 --- a/stepaction/git-clone/git-clone.yaml +++ b/stepaction/git-clone/git-clone.yaml @@ -5,12 +5,30 @@ kind: StepAction metadata: name: git-clone labels: - app.kubernetes.io/version: "1.7.0" + app.kubernetes.io/version: "1.7.1" annotations: artifacthub.io/category: integration-delivery artifacthub.io/changes: | + - kind: fixed + description: "Prevent credential leakage from URLs in logs, results, and shell traces" + - kind: fixed + description: "Prevent git option injection via revision/refspec in fetch, checkout, and show commit" + - kind: fixed + description: "Validate subdirectory and userHome params to prevent path traversal and credential copy to shared workspace; clean up credentials on step exit" - kind: changed - description: "CI now builds the git-clone base image for multiple architectures." + description: "Bump alpine/git base image to latest version" + - kind: changed + description: "Bump GitHub Actions dependencies (checkout, setup-go, setup-ko, setup-crane, goreleaser-action, setup-buildx-action, setup-qemu-action)" + - kind: changed + description: "Group dependabot updates and fix gomod path" + - kind: changed + description: "Drop Trusted Resources signature from release" + - kind: added + description: "Add Artifact Hub StepActions badge and browse links" + - kind: added + description: "Add DEVELOPMENT.md, CONTRIBUTING.md, and AGENTS.md documentation" + - kind: changed + description: "Make e2e tests more robust against flakes" artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: support @@ -118,7 +136,7 @@ spec: Print user-friendly error messages with actionable hints and reproduction commands when git operations fail. Set to "false" to disable. name: userFriendlyErrors type: string - - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.0 + - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.1 description: The image providing the git-init binary that this StepAction runs. name: gitInitImage type: string diff --git a/task/git-clone/git-clone.yaml b/task/git-clone/git-clone.yaml index 70432f61..bf0406bb 100644 --- a/task/git-clone/git-clone.yaml +++ b/task/git-clone/git-clone.yaml @@ -4,8 +4,26 @@ metadata: annotations: artifacthub.io/category: integration-delivery artifacthub.io/changes: | + - kind: fixed + description: "Prevent credential leakage from URLs in logs, results, and shell traces" + - kind: fixed + description: "Prevent git option injection via revision/refspec in fetch, checkout, and show commit" + - kind: fixed + description: "Validate subdirectory and userHome params to prevent path traversal and credential copy to shared workspace; clean up credentials on step exit" - kind: changed - description: "CI now builds the git-clone base image for multiple architectures." + description: "Bump alpine/git base image to latest version" + - kind: changed + description: "Bump GitHub Actions dependencies (checkout, setup-go, setup-ko, setup-crane, goreleaser-action, setup-buildx-action, setup-qemu-action)" + - kind: changed + description: "Group dependabot updates and fix gomod path" + - kind: changed + description: "Drop Trusted Resources signature from release" + - kind: added + description: "Add Artifact Hub StepActions badge and browse links" + - kind: added + description: "Add DEVELOPMENT.md, CONTRIBUTING.md, and AGENTS.md documentation" + - kind: changed + description: "Make e2e tests more robust against flakes" artifacthub.io/license: Apache-2.0 artifacthub.io/links: | - name: support @@ -25,7 +43,7 @@ metadata: tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64 tekton.dev/tags: git labels: - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: "1.7.1" name: git-clone spec: description: |- @@ -101,7 +119,7 @@ spec: Print user-friendly error messages with actionable hints and reproduction commands when git operations fail. Set to "false" to disable. name: userFriendlyErrors type: string - - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.0 + - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.1 description: The image providing the git-init binary that this Task runs. name: gitInitImage type: string From 55a8db3528620f9b86f7b581b6591a10cb970819 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Wed, 7 Oct 2026 15:57:24 +0200 Subject: [PATCH 2/2] ci: add Artifact Hub lint checks Signed-off-by: Vincent Demeester --- .github/workflows/build.yaml | 41 +++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 475b829e..6f25c06b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -38,6 +38,41 @@ jobs: exit 1 fi + ah-lint-tasks: + name: ArtifactHub Lint (tasks) + runs-on: ubuntu-latest + container: + image: artifacthub/ah:v1.23.0 + options: --user root + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Lint tasks + run: | + git config --global --add safe.directory "${GITHUB_WORKSPACE}" + # v1.0.1 and v1.2.0 contain Task manifests labelled 1.0.0 and 1.1.0. + # Exclude only those immutable historical mismatches from this CI clone. + git tag -d v1.0.1 v1.2.0 + ah lint -k tekton-task -p task --tekton-versioning git + + ah-lint-stepactions: + name: ArtifactHub Lint (stepactions) + runs-on: ubuntu-latest + container: + image: artifacthub/ah:v1.23.0 + options: --user root + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Lint stepactions + run: | + git config --global --add safe.directory "${GITHUB_WORKSPACE}" + ah lint -k tekton-stepaction -p stepaction --tekton-versioning git + e2e: name: E2E (${{ matrix.pipeline-version }}) needs: [build] @@ -132,7 +167,7 @@ jobs: ci-summary: name: CI summary - needs: [build, e2e, e2e-bundle] + needs: [build, ah-lint-tasks, ah-lint-stepactions, e2e, e2e-bundle] runs-on: ubuntu-latest if: always() steps: @@ -140,6 +175,8 @@ jobs: run: | results=( "build=${NEEDS_BUILD_RESULT}" + "ah-lint-tasks=${NEEDS_AH_LINT_TASKS_RESULT}" + "ah-lint-stepactions=${NEEDS_AH_LINT_STEPACTIONS_RESULT}" "e2e=${NEEDS_E2E_RESULT}" "e2e-bundle=${NEEDS_E2E_BUNDLE_RESULT}" ) @@ -161,5 +198,7 @@ jobs: echo "All CI checks passed" env: NEEDS_BUILD_RESULT: ${{ needs.build.result }} + NEEDS_AH_LINT_TASKS_RESULT: ${{ needs.ah-lint-tasks.result }} + NEEDS_AH_LINT_STEPACTIONS_RESULT: ${{ needs.ah-lint-stepactions.result }} NEEDS_E2E_RESULT: ${{ needs.e2e.result }} NEEDS_E2E_BUNDLE_RESULT: ${{ needs.e2e-bundle.result }}