ci: add Artifact Hub lint checks

.github/workflows/build.yaml

@@ -38,6 +38,41 @@ jobs:
             exit 1
           fi
 
+  ah-lint-tasks:
+    name: ArtifactHub Lint (tasks)
+    runs-on: ubuntu-latest
+    container:
+      image: artifacthub/ah:v1.23.0
+      options: --user root
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Lint tasks
+        run: |
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
+          # v1.0.1 and v1.2.0 contain Task manifests labelled 1.0.0 and 1.1.0.
+          # Exclude only those immutable historical mismatches from this CI clone.
+          git tag -d v1.0.1 v1.2.0
+          ah lint -k tekton-task -p task --tekton-versioning git
+
+  ah-lint-stepactions:
+    name: ArtifactHub Lint (stepactions)
+    runs-on: ubuntu-latest
+    container:
+      image: artifacthub/ah:v1.23.0
+      options: --user root
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Lint stepactions
+        run: |
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
+          ah lint -k tekton-stepaction -p stepaction --tekton-versioning git
+
   e2e:
     name: E2E (${{ matrix.pipeline-version }})
     needs: [build]
@@ -132,14 +167,16 @@ jobs:
 
   ci-summary:
     name: CI summary
-    needs: [build, e2e, e2e-bundle]
+    needs: [build, ah-lint-tasks, ah-lint-stepactions, e2e, e2e-bundle]
     runs-on: ubuntu-latest
     if: always()
     steps:
       - name: Check CI results
         run: |
           results=(
             "build=${NEEDS_BUILD_RESULT}"
+            "ah-lint-tasks=${NEEDS_AH_LINT_TASKS_RESULT}"
+            "ah-lint-stepactions=${NEEDS_AH_LINT_STEPACTIONS_RESULT}"
             "e2e=${NEEDS_E2E_RESULT}"
             "e2e-bundle=${NEEDS_E2E_BUNDLE_RESULT}"
           )
@@ -161,5 +198,7 @@ jobs:
           echo "All CI checks passed"
         env:
           NEEDS_BUILD_RESULT: ${{ needs.build.result }}
+          NEEDS_AH_LINT_TASKS_RESULT: ${{ needs.ah-lint-tasks.result }}
+          NEEDS_AH_LINT_STEPACTIONS_RESULT: ${{ needs.ah-lint-stepactions.result }}
           NEEDS_E2E_RESULT: ${{ needs.e2e.result }}
           NEEDS_E2E_BUNDLE_RESULT: ${{ needs.e2e-bundle.result }}

README.md

@@ -20,7 +20,7 @@ taskRef:
   resolver: bundles
   params:
     - name: bundle
-      value: ghcr.io/tektoncd-catalog/git-clone/bundle:v1.7.0
+      value: ghcr.io/tektoncd-catalog/git-clone/bundle:v1.7.1
     - name: name
       value: git-clone
     - name: kind

stepaction/git-clone/git-clone.yaml

@@ -5,12 +5,30 @@ kind: StepAction
 metadata:
   name: git-clone
   labels:
-    app.kubernetes.io/version: "1.7.0"
+    app.kubernetes.io/version: "1.7.1"
   annotations:
     artifacthub.io/category: integration-delivery
     artifacthub.io/changes: |
+      - kind: fixed
+        description: "Prevent credential leakage from URLs in logs, results, and shell traces"
+      - kind: fixed
+        description: "Prevent git option injection via revision/refspec in fetch, checkout, and show commit"
+      - kind: fixed
+        description: "Validate subdirectory and userHome params to prevent path traversal and credential copy to shared workspace; clean up credentials on step exit"
       - kind: changed
-        description: "CI now builds the git-clone base image for multiple architectures."
+        description: "Bump alpine/git base image to latest version"
+      - kind: changed
+        description: "Bump GitHub Actions dependencies (checkout, setup-go, setup-ko, setup-crane, goreleaser-action, setup-buildx-action, setup-qemu-action)"
+      - kind: changed
+        description: "Group dependabot updates and fix gomod path"
+      - kind: changed
+        description: "Drop Trusted Resources signature from release"
+      - kind: added
+        description: "Add Artifact Hub StepActions badge and browse links"
+      - kind: added
+        description: "Add DEVELOPMENT.md, CONTRIBUTING.md, and AGENTS.md documentation"
+      - kind: changed
+        description: "Make e2e tests more robust against flakes"
     artifacthub.io/license: Apache-2.0
     artifacthub.io/links: |
       - name: support
@@ -118,7 +136,7 @@ spec:
       Print user-friendly error messages with actionable hints and reproduction commands when git operations fail. Set to "false" to disable.
     name: userFriendlyErrors
     type: string
-  - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.0
+  - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.1
     description: The image providing the git-init binary that this StepAction runs.
     name: gitInitImage
     type: string

task/git-clone/git-clone.yaml

@@ -4,8 +4,26 @@ metadata:
   annotations:
     artifacthub.io/category: integration-delivery
     artifacthub.io/changes: |
+      - kind: fixed
+        description: "Prevent credential leakage from URLs in logs, results, and shell traces"
+      - kind: fixed
+        description: "Prevent git option injection via revision/refspec in fetch, checkout, and show commit"
+      - kind: fixed
+        description: "Validate subdirectory and userHome params to prevent path traversal and credential copy to shared workspace; clean up credentials on step exit"
       - kind: changed
-        description: "CI now builds the git-clone base image for multiple architectures."
+        description: "Bump alpine/git base image to latest version"
+      - kind: changed
+        description: "Bump GitHub Actions dependencies (checkout, setup-go, setup-ko, setup-crane, goreleaser-action, setup-buildx-action, setup-qemu-action)"
+      - kind: changed
+        description: "Group dependabot updates and fix gomod path"
+      - kind: changed
+        description: "Drop Trusted Resources signature from release"
+      - kind: added
+        description: "Add Artifact Hub StepActions badge and browse links"
+      - kind: added
+        description: "Add DEVELOPMENT.md, CONTRIBUTING.md, and AGENTS.md documentation"
+      - kind: changed
+        description: "Make e2e tests more robust against flakes"
     artifacthub.io/license: Apache-2.0
     artifacthub.io/links: |
       - name: support
@@ -25,7 +43,7 @@ metadata:
     tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64
     tekton.dev/tags: git
   labels:
-    app.kubernetes.io/version: 1.7.0
+    app.kubernetes.io/version: "1.7.1"
   name: git-clone
 spec:
   description: |-
@@ -101,7 +119,7 @@ spec:
       Print user-friendly error messages with actionable hints and reproduction commands when git operations fail. Set to "false" to disable.
     name: userFriendlyErrors
     type: string
-  - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.0
+  - default: ghcr.io/tektoncd-catalog/git-clone:v1.7.1
     description: The image providing the git-init binary that this Task runs.
     name: gitInitImage
     type: string