From e4856f7c0cefd1f9fb8d5b37d71b0754b4c0e220 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Jul 2026 17:12:46 +0000 Subject: [PATCH] chore(deps): bump github.com/tektoncd/pipeline from 1.9.3 to 1.9.6 Bumps [github.com/tektoncd/pipeline](https://github.com/tektoncd/pipeline) from 1.9.3 to 1.9.6. - [Release notes](https://github.com/tektoncd/pipeline/releases) - [Changelog](https://github.com/tektoncd/pipeline/blob/main/releases.md) - [Commits](https://github.com/tektoncd/pipeline/compare/v1.9.3...v1.9.6) --- updated-dependencies: - dependency-name: github.com/tektoncd/pipeline dependency-version: 1.9.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 4 +-- go.sum | 16 ++++++------ .../apis/pipeline/v1beta1/stepaction_types.go | 4 ++- .../resolver/framework/interface.go | 25 +++++++++++++++++++ .../resolver/framework/reconciler.go | 25 +++++++++++++++++-- vendor/modules.txt | 6 ++--- 6 files changed, 64 insertions(+), 16 deletions(-) diff --git a/go.mod b/go.mod index ddfa5e570e..31c2f93022 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/spf13/pflag v1.0.10 github.com/tektoncd/chains v0.26.5 github.com/tektoncd/hub v1.23.6 - github.com/tektoncd/pipeline v1.9.3 + github.com/tektoncd/pipeline v1.9.6 github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 github.com/tektoncd/triggers v0.35.0 github.com/theupdateframework/go-tuf v0.7.0 @@ -353,7 +353,7 @@ require ( gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - k8s.io/apiextensions-apiserver v0.32.11 // indirect + k8s.io/apiextensions-apiserver v0.32.13 // indirect k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect diff --git a/go.sum b/go.sum index 81080aec90..ffd982c285 100644 --- a/go.sum +++ b/go.sum @@ -990,8 +990,8 @@ github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c= -github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU= -github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= +github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= +github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A= github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= @@ -1234,8 +1234,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo= github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs= -github.com/spiffe/spire-api-sdk v1.14.0 h1:72Ywh9Mq/Zd2irveBEFIh0LFLG8/KYTltkVkBluPd0A= -github.com/spiffe/spire-api-sdk v1.14.0/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y= +github.com/spiffe/spire-api-sdk v1.14.7 h1:dIloXcIxSGhGy5LnOCJUVjUj3QsRvuSb5L9goJZTloc= +github.com/spiffe/spire-api-sdk v1.14.7/go.mod h1:9hXJcMzatM1KwAtBDO3s6HccDCic++/5c2yOc5Iln8Y= github.com/sqs/goreturns v0.0.0-20181028201513-538ac6014518/go.mod h1:CKI4AZ4XmGV240rTHfO0hfE83S6/a3/Q1siZJ/vXf7A= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw= @@ -1269,8 +1269,8 @@ github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDd github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48= github.com/tektoncd/chains v0.26.5 h1:X5W0oBsqK3wRz89IgY1kPIokhI6N1a1E1oreZgwJNwI= github.com/tektoncd/chains v0.26.5/go.mod h1:qUe7YfRPTJuEAwFFq3R7VPaOYCVNQRh5HCLqiIqO40I= -github.com/tektoncd/pipeline v1.9.3 h1:7Z+V2VX5wjz9LoNa16E1RbgH9mpYy5B1KnAMm3H0czc= -github.com/tektoncd/pipeline v1.9.3/go.mod h1:pEruzPp4JM8JK8Nnnih46IPgdtxRPot/i9pUZo8lA9I= +github.com/tektoncd/pipeline v1.9.6 h1:j/yUWklZwuhF6HaM6jyjlf+pmLMcW8+WLksqhb2/j9I= +github.com/tektoncd/pipeline v1.9.6/go.mod h1:4MjJtAih3kPpeV3a+LZyWk+Mz1XvM4os+9wOI4ksU3o= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1 h1:nv7BsOAZ1ifQX9Lw1hYFo1f7e62dTDyyVPJBuljgZKw= github.com/tektoncd/plumbing v0.0.0-20250430145243-3b7cd59879c1/go.mod h1:eDs4O8vTNkyKZ/+AEuo4nYDfpyn1AzbgIcQ1QMQaKJk= github.com/tektoncd/triggers v0.35.0 h1:9Z5Cqn7RZTgyspWgWYFHz6AtWUUhd/awJeaisjZdF98= @@ -2054,8 +2054,8 @@ k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs= k8s.io/api v0.34.4 h1:Z5hsoQcZ2yBjelb9j5JKzCVo9qv9XLkVm5llnqS4h+0= k8s.io/api v0.34.4/go.mod h1:6SaGYuGPkMqqCgg8rPG/OQoCrhgSEV+wWn9v21fDP3o= k8s.io/apiextensions-apiserver v0.22.5/go.mod h1:tIXeZ0BrDxUb1PoAz+tgOz43Zi1Bp4BEEqVtUccMJbE= -k8s.io/apiextensions-apiserver v0.32.11 h1:pNTdmMJpD2vicRi91mt7W2t+zZLVDV+pBUk8+rOY7u4= -k8s.io/apiextensions-apiserver v0.32.11/go.mod h1:aHN7wS1DgYv75fGOx7OoZlH91rjFXtPygb7qYLyLo5E= +k8s.io/apiextensions-apiserver v0.32.13 h1:3M8y1UNKgAp/I+T4TDEeqXiR1wj8nrqzTqgMHRKsO8A= +k8s.io/apiextensions-apiserver v0.32.13/go.mod h1:IMU3eme+2CoGzlmiHVcl6v08u3dRzebcBTnop09cwpY= k8s.io/apimachinery v0.19.7/go.mod h1:6sRbGRAVY5DOCuZwB5XkqguBqpqLU6q/kOaOdk29z6Q= k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U= k8s.io/apimachinery v0.34.4 h1:C5SiSzLEMyWIk53sSbnk0WlOOyqv/MFnWvuc/d6M+xc= diff --git a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go index d6276bdef0..ed792c2011 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/stepaction_types.go @@ -23,6 +23,8 @@ import ( "knative.dev/pkg/kmeta" ) +const StepActionKind = "StepAction" + // +genclient // +genclient:noStatus // +genreconciler:krshapedlogic=false @@ -62,7 +64,7 @@ func (s *StepAction) Copy() StepActionObject { // GetGroupVersionKind implements kmeta.OwnerRefable. func (*StepAction) GetGroupVersionKind() schema.GroupVersionKind { - return SchemeGroupVersion.WithKind("StepAction") + return SchemeGroupVersion.WithKind(StepActionKind) } // Checksum computes the sha256 checksum of the stepaction object. diff --git a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go index 89c1e897a7..ca8154dea9 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/interface.go @@ -18,9 +18,14 @@ package framework import ( "context" + "fmt" + "slices" "time" + pipelineapi "github.com/tektoncd/pipeline/pkg/apis/pipeline" pipelinev1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + "sigs.k8s.io/yaml" ) // Resolver is the interface to implement for type-specific resource @@ -100,3 +105,23 @@ type ResolvedResource interface { Annotations() map[string]string RefSource() *pipelinev1.RefSource } + +// ValidateResolvedResource validates that the ResolvedResource's data is a +// kubernetes object and a Tekton kind. This ensures non-k8s data (e.g. tokens) or non-tekton +// k8s objects (e.g. Secrets) are not written into the unprivileged ResolutionRequest objects. +func ValidateResolvedResource(resource ResolvedResource) error { + var metadata struct { + APIVersion string + Kind string + } + if err := yaml.Unmarshal(resource.Data(), &metadata); err != nil { + return fmt.Errorf("decoding error: %w", err) + } + // gv is not nil when there is an error + gv, _ := schema.ParseGroupVersion(metadata.APIVersion) + + if gv.Group != pipelineapi.GroupName || !slices.Contains(allowedResourceKinds, metadata.Kind) { + return fmt.Errorf("resolved data is not of a supported type, must be of Group: %s, Kinds: %v", pipelineapi.GroupName, allowedResourceKinds) + } + return nil +} diff --git a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go index 314d801c2b..6ae027aeb5 100644 --- a/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go +++ b/vendor/github.com/tektoncd/pipeline/pkg/resolution/resolver/framework/reconciler.go @@ -24,6 +24,7 @@ import ( "fmt" "time" + pipelineapi "github.com/tektoncd/pipeline/pkg/apis/pipeline" pipelinev1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" pipelinev1beta1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1" "github.com/tektoncd/pipeline/pkg/apis/resolution/v1beta1" @@ -71,6 +72,18 @@ var _ reconciler.LeaderAware = &Reconciler{} // the framework.TimedResolution interface. const defaultMaximumResolutionDuration = time.Minute +// allowedResourceKinds lists the kinds of resources which +// are allowed to be resolved by resolvers +var allowedResourceKinds = []string{ + pipelineapi.PipelineRunControllerName, + pipelineapi.PipelineControllerName, + pipelineapi.TaskRunControllerName, + pipelineapi.TaskControllerName, + pipelineapi.RunControllerName, + pipelineapi.CustomRunControllerName, + pipelinev1beta1.StepActionKind, +} + // Reconcile receives the string key of a ResolutionRequest object, looks // it up, checks it for common errors, and then delegates // resolver-specific functionality to the reconciler's embedded @@ -106,8 +119,8 @@ func (r *Reconciler) Reconcile(ctx context.Context, key string) error { } func (r *Reconciler) resolve(ctx context.Context, key string, rr *v1beta1.ResolutionRequest) error { - errChan := make(chan error) - resourceChan := make(chan ResolvedResource) + errChan := make(chan error, 1) + resourceChan := make(chan ResolvedResource, 1) paramsMap := make(map[string]string) for _, p := range rr.Spec.Params { @@ -147,6 +160,14 @@ func (r *Reconciler) resolve(ctx context.Context, key string, rr *v1beta1.Resolu } return } + if err := ValidateResolvedResource(resource); err != nil { + errChan <- &resolutioncommon.GetResourceError{ + ResolverName: r.resolver.GetName(resolutionCtx), + Key: key, + Original: fmt.Errorf("resolved resource validation error: %w", err), + } + return + } resourceChan <- resource }() diff --git a/vendor/modules.txt b/vendor/modules.txt index d22d3f80b2..88c5100471 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1542,8 +1542,8 @@ github.com/tektoncd/hub/api/v1/gen/http/catalog/client github.com/tektoncd/hub/api/v1/gen/http/resource/client github.com/tektoncd/hub/api/v1/gen/resource github.com/tektoncd/hub/api/v1/gen/resource/views -# github.com/tektoncd/pipeline v1.9.3 -## explicit; go 1.24.13 +# github.com/tektoncd/pipeline v1.9.6 +## explicit; go 1.25.10 github.com/tektoncd/pipeline/internal/artifactref github.com/tektoncd/pipeline/pkg/apis/config github.com/tektoncd/pipeline/pkg/apis/config/resolver @@ -2417,7 +2417,7 @@ k8s.io/api/storage/v1 k8s.io/api/storage/v1alpha1 k8s.io/api/storage/v1beta1 k8s.io/api/storagemigration/v1alpha1 -# k8s.io/apiextensions-apiserver v0.32.11 +# k8s.io/apiextensions-apiserver v0.32.13 ## explicit; go 1.23.0 k8s.io/apiextensions-apiserver/pkg/apis/apiextensions k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1