chore(deps): update module github.com/openshift-pipelines/pipelines-as-code to v0.48.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/openshift-pipelines/pipelines-as-code	v0.46.0 → v0.48.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

openshift-pipelines/pipelines-as-code (github.com/openshift-pipelines/pipelines-as-code)

v0.48.0

Compare Source

Pipelines as Code version v0.48.0

OpenShift Pipelines as Code v0.48.0 has been released 🥳

[!IMPORTANT]
This is a security release. It includes fixes for GitHub Enterprise header hijacking, webhook secret leakage in logs, and GitHub App token over-scoping. All users are encouraged to upgrade as soon as possible.

✨ Major changes and Features

• TLS configuration support: Add configurable TLS settings (min version, cipher suites, curve preferences) for the PAC controller via deployment environment variables, allowing the Tekton Operator to propagate TLS configuration without code changes.
  • Link: tektoncd#2738
  • Jira: SRVKP-9681
• Deprecation warnings for Tekton Hub integration: Deprecated the Tekton Hub catalog integration across documentation, configuration, and resource resolution. The public Tekton Hub has been shut down, and support for self-hosted Tekton Hub instances is now formally deprecated ahead of full removal in a future release.
  • Link: tektoncd#2746
  • Jira: SRVKP-12187
• Gitea remote task resolution: Enable Gitea/Forgejo provider to resolve remote taskRef URLs using the provider's authenticated API instead of returning "not supported". Supports branch, tag, and commit SHA URL formats.
  • Link: tektoncd#2732

🐛 Bug Fixes

• Prevent GitHub Enterprise header hijacking: Validate webhook signature before minting App tokens and restrict the GitHub Enterprise host header to prevent an attacker from redirecting token requests to an arbitrary host.
  • Link: tektoncd#2759
• Redact query string from incoming webhook log: Fix secret leakage in the incoming-webhook handler where the full URL including ?secret=<value> was logged verbatim. Now logs only the URL path.
  • Link: tektoncd#2754
• Scope GitHub App token and deep-copy cached remote resources: Scope GitHub App token to the triggering repository when no extra scope config is present, preventing remote task annotations from accessing private repos. Also deep-copy cached remote Pipeline and Task objects before inlining to prevent mutation from contaminating subsequent PipelineRuns.
  • Link: tektoncd#2705
• Remove unused secrets/delete permission from controller: Remove the unused cluster-wide secrets/delete permission from the controller ServiceAccount, following the principle of least privilege.
  • Link: tektoncd#2744
• Enable controller profiling: Bump knative/eventing to v0.49.0 which includes the pprof server fix so controller profiling actually works, and update the profiling guide for the OpenCensus to OpenTelemetry migration.
  • Link: tektoncd#2720

⚙️ Chores

• Preserve dots in image tags for version tag pushes: Fix container workflow tag sanitization to keep dots in version tags, ensuring release manifests reference the correct image tags.
  • Link: tektoncd#2742
• Update incoming webhook legacy params deprecation message: Update the deprecation message for secret passing in URL query parameters.
  • Link: tektoncd#2757
• Parse JSON test output for Slack notifications: Switch CI notify-slack script to parse JSON test output instead of the nonexistent log file.
  • Link: tektoncd#2753
• Bump mxschmitt/action-tmate from 3.23 to 3.24: Updated CI dependency to latest version.
  • Link: tektoncd#2750

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.0/release.yaml

Kubernetes

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.48.0/release.k8s.yaml

Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.48.0

Changelog

• 3811249: chore(deps): bump knative/eventing to v0.49.0 (@​theakshaypant)
• 4d0454b: chore(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 (@​dependabot[bot])
• bd262aa: chore: update incoming webhook legacy params deprecation message (@​zakisk)
• 67cfa52: docs(profiling): update guide for OTel migration (@​theakshaypant)
• 32820cb: feat(gitea): implement GetTaskURI for remote task resolution (@​theakshaypant)
• 4dac4d6: feat: Add deprecation warnings for Tekton Hub integration (@​chmouel)
• 0bb2f82: feat: add TLS configuration support (@​zakisk)
• 223e39c: fix(ci): parse JSON test output for Slack notifications (@​theakshaypant)
• 0017828: fix(github): scope App token to triggering repo (@​theakshaypant)
• 69fa323: fix(release): preserve dots in image tags for version tag pushes (@​chmouel)
• ee5d9b0: fix(resolve): deep-copy cached resources before inlining (@​theakshaypant)
• 2c03760: fix(security): redact query string from incoming webhook log (@​infernus01)
• 402d5c7: fix: prevent GitHub Enterprise header hijacking in app token requests (@​chmouel)
• 8854274: fix: remove unused secrets/delete permission from controller (@​chmouel)

v0.47.0

Compare Source

Pipelines as Code version v0.47.0

OpenShift Pipelines as Code v0.47.0 has been released 🥳

✨ Major changes and Features

• CEL string and list extension functions: Unlocks join(), replace(), substring(), split(), trim(), upperAscii(), lowerAscii() and other standard CEL string/list operations in on-cel-expression annotations and {{ cel: }} template expressions.
  • Link: tektoncd#2725
  • Jira: SRVKP-11940
• GitHub API rate limit Kubernetes event: Emits a Kubernetes Repository event when the GitHub API rate limit is exhausted, surfacing the issue to operators via kubectl describe.
  • Link: tektoncd#2715

🐛 Bug Fixes

• Bitbucket Data Center: detect file changes on merged PR push: Fixes on-path-change and on-cel-expression filters silently skipping PipelineRuns when the push event is a merge commit with no listed file changes; the Bitbucket /changes API is now used to diff the actual modified files.
  • Link: tektoncd#2719
  • Jira: SRVKP-9638
• Skip key=value arguments as PipelineRun names in /test: When a user posts /test custom1=value, the key=value argument was incorrectly treated as a PipelineRun name and bypassed on-comment annotation matching; it is now correctly passed through as a parameter.
  • Link: tektoncd#2712
• Label value sanitization and normalization: Ensures Kubernetes label values (e.g. branch names) are sanitized to comply with the 63-character limit and valid character set rules, preventing label validation errors.
  • Link: tektoncd#2724
• Reconciler: skip watcher status updates: Fixes a regression introduced in #​2667 that caused forbidden errors on clusters where the watcher service account lacks pipelineruns/status update permissions; the generated status sync is now disabled for the watcher.
  • Link: tektoncd#2735
• GitLab: post informative comment on inaccessible fork MR: When a merge request originates from a fork the bot cannot access, PAC now posts a comment on the MR explaining the situation rather than silently failing.
  • Link: tektoncd#2739

⚙️ Chores

• Fix documentation reference in formatting package: Corrected the godoc comment in CleanValueKubernetes to point to the right Kubernetes label specification.
  • Link: tektoncd#2731
• Update golangci-lint configuration: Replaced deprecated gomodguard linter with gomodguard_v2 and disabled the inline govet check to reduce false positives.
  • Link: tektoncd#2736
• Update golangci-lint to v2.12.2: Bumped the CI golangci-lint image to match the updated linter configuration.
  • Link: tektoncd#2737

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.47.0/release.yaml

Kubernetes

kubectl apply -f https://github.com/tektoncd/pipelines-as-code/releases/download/v0.47.0/release.k8s.yaml

Documentation

The documentation for this release is available here :

https://docs.pipelinesascode.com/v0.47.0

What's Changed

• chore(github): emit event when API rate limit exceeded by @​theakshaypant in tektoncd#2715
• fix(opscomments): skip key=value args as PR names by @​theakshaypant in tektoncd#2712
• fix: label values sanitization and normalization by @​filariow in tektoncd#2724
• fix: point to the right doc in formatting by @​filariow in tektoncd#2731
• fix(bitbucket-datacenter): detect changes on merged PR push by @​zakisk in tektoncd#2719
• feat(cel): enable string and list extension functions in CEL expressions by @​zakisk in tektoncd#2725
• chore: update golangci linter configuration by @​chmouel in tektoncd#2736
• ci: update golangci-lint to v2.12.2 by @​theakshaypant in tektoncd#2737
• fix(reconciler): skip watcher status updates by @​chmouel in tektoncd#2735
• fix(gitlab): post MR comment on inaccessible fork by @​theakshaypant in tektoncd#2739

New Contributors

• @​filariow made their first contribution in tektoncd#2724

Full Changelog: tektoncd/pipelines-as-code@v0.46.0...v0.47.0

Changelog

• 25b9307: add sanification of the input and improve logic (@​filariow)
• c615efb: chore(github): emit event when API rate limit exceeded (@​theakshaypant)
• 9db1fec: chore: update golangci linter configuration (@​chmouel)
• 2b9a6f1: ci: update golangci-lint to v2.12.2 (@​theakshaypant)
• 861a507: docs(on-comment): warn against built-in commands (@​theakshaypant)
• 445941b: feat(cel): enable string and list extension functions in CEL expressions (@​zakisk)
• f841d2d: fix(bitbucket-datacenter): detect changes on merged PR push (@​zakisk)
• 529a725: fix(gitlab): post MR comment on inaccessible fork (@​theakshaypant)
• 4b1d7f7: fix(opscomments): skip key=value args as PR names (@​theakshaypant)
• 4c7b0e0: fix(reconciler): skip watcher status updates (@​chmouel)
• 6522de8: fix: label values when dot are present (@​filariow)
• 5226968: fix: linter complaints (@​filariow)
• e75942f: fix: move from RFC1123 to LabelValue (@​filariow)
• f05bcd0: fix: point to the right doc in formatting (@​filariow)
• a43ae55: fix: remove unneeded check (@​filariow)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.49%. Comparing base (13a2f01) to head (389d4ab).

❗ There is a different number of reports uploaded between BASE (13a2f01) and HEAD (389d4ab). Click for more details.

HEAD has 2 uploads less than BASE

Flag	BASE (13a2f01)	HEAD (389d4ab)
unit-tests	2	1
e2e-tests	1	0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1636      +/-   ##
==========================================
- Coverage   87.43%   81.49%   -5.95%     
==========================================
  Files          34       34              
  Lines        3566     3566              
==========================================
- Hits         3118     2906     -212     
- Misses        285      512     +227     
+ Partials      163      148      -15     

Flag	Coverage Δ
e2e-tests	?
unit-tests	81.49% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 12 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 13a2f01...389d4ab. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:19 PM UTC · Completed 8:22 PM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:07 PM UTC · Completed 8:11 PM UTC
Commit: 0d0162a · View workflow run →

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 1:17 PM UTC · Ended 1:23 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:57 PM UTC · Completed 9:01 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:30 PM UTC · Completed 8:36 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:59 PM UTC · Completed 2:05 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:46 PM UTC · Completed 5:51 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:24 AM UTC · Completed 11:30 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:34 PM UTC · Completed 3:40 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:44 AM UTC · Completed 10:48 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 4:37 PM UTC · Completed 4:43 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:28 PM UTC · Completed 2:32 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:34 AM UTC · Completed 1:40 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:39 PM UTC · Completed 2:43 PM UTC
Commit: ec21706 · View workflow run →