// Module included in the following assembly:
//
// * cicd/pipelines/op-release-notes.adoc
:_mod-docs-content-type: REFERENCE
[id="op-release-notes-1-9_{context}"]
= Release notes for {pipelines-title} General Availability 1.9

With this update, {pipelines-title} General Availability (GA) 1.9 is available on {product-title} 4.11, 4.12, and 4.13.

[id="new-features-1-9_{context}"]
== New features

In addition to the fixes and stability improvements, the following sections highlight what is new in {pipelines-title} 1.9.

[id="pipelines-new-features-1-9_{context}"]
=== Pipelines

* With this update, you can specify pipeline parameters and results in arrays and object dictionary forms.

* This update provides support for Container Storage Interface (CSI) and projected volumes for your workspace.

* With this update, you can specify the `stdoutConfig` and `stderrConfig` parameters when defining pipeline steps. Defining these parameters helps to capture standard output and standard error, associated with steps, to local files.

* With this update, you can add variables in the `steps[].onError` event handler, for example, `$(params.CONTINUE)`.

* With this update, you can use the output from the `finally` task in the `PipelineResults` definition. For example, `$(finally.<pipelinetask-name>.result.<result-name>)`, where `<pipelinetask-name>` denotes the pipeline task name and `<result-name>` denotes the result name.

* This update supports task-level resource requirements for a task run.

* With this update, you do not need to recreate parameters that are shared, based on their names, between a pipeline and the defined tasks. This update is part of a developer preview feature.

* This update adds support for remote resolution, such as built-in git, cluster, bundle, and hub resolvers.


[id="triggers-new-features-1-9_{context}"]
=== Triggers

* This update adds the `Interceptor` CRD to define `NamespacedInterceptor`. You can use `NamespacedInterceptor` in the `kind` section of interceptors reference in triggers or in the `EventListener` specification.

* This update enables `CloudEvents`.

* With this update, you can configure the webhook port number when defining a trigger.

* This update supports using trigger `eventID` as input to `TriggerBinding`.

* This update supports validation and rotation of certificates for the `ClusterInterceptor` server. 
** Triggers perform certificate validation for core interceptors and rotate a new certificate to `ClusterInterceptor` when its certificate expires.


[id="cli-new-features-1-9_{context}"]
=== CLI 

* This update supports showing annotations in the `describe` command.

* This update supports showing pipeline, tasks, and timeout in the `pr describe` command.

* This update adds flags to provide pipeline, tasks, and timeout in the `pipeline start` command.

* This update supports showing the presence of workspace, optional or mandatory, in the `describe` command of a task and pipeline.

* This update adds the `timestamps` flag to show logs with a timestamp.

* This update adds a new flag `--ignore-running-pipelinerun`, which ignores the deletion of `TaskRun` associated with `PipelineRun`.

* This update adds support for experimental commands. This update also adds experimental subcommands, `sign` and `verify` to the `tkn` CLI tool.

* This update makes the Z shell (Zsh) completion feature usable without generating any files.

* This update introduces a new CLI tool called `opc`. It is anticipated that an upcoming release will replace the `tkn` CLI tool with `opc`.
+
[IMPORTANT]
====
* The new CLI tool `opc` is a Technology Preview feature.
* `opc` will be a replacement for `tkn` with additional {pipelines-title} specific features, which do not necessarily fit in `tkn`.
====

[id="operator-new-features-1-9_{context}"]
=== Operator

* With this update, {pac} is installed by default. You can disable {pac} by using the `-p` flag:
+
[source,terminal]
----
$ oc patch tektonconfig config --type="merge" -p '{"spec": {"platforms": {"openshift":{"pipelinesAsCode": {"enable": false}}}}}'
----

* With this update, you can also modify {pac} configurations in the `TektonConfig` CRD.

* With this update, if you disable the developer perspective, the Operator does not install developer console related custom resources.

* This update includes `ClusterTriggerBinding` support for Bitbucket Server and Bitbucket Cloud and helps you to reuse a `TriggerBinding` across your entire cluster.

[id="resolver-new-features-1-9_{context}"]
=== Resolvers

:FeatureName: Resolvers
include::snippets/technology-preview.adoc[]

* With this update, you can configure pipeline resolvers in the `TektonConfig` CRD. You can enable or disable these pipeline resolvers:  `enable-bundles-resolver`, `enable-cluster-resolver`, `enable-git-resolver`, and `enable-hub-resolver`.
+
[source,yaml,subs="attributes+"]
----
apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    enable-bundles-resolver: true
    enable-cluster-resolver: true
    enable-git-resolver: true
    enable-hub-resolver: true
...
----
+
You can also provide resolver specific configurations in `TektonConfig`. For example, you can define the following fields in the `map[string]string` format to set configurations for individual resolvers:
+
[source,yaml,subs="attributes+"]
----
apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  pipeline:
    bundles-resolver-config:
      default-service-account: pipelines
    cluster-resolver-config:
      default-namespace: test
    git-resolver-config:
      server-url: localhost.com
    hub-resolver-config:
      default-tekton-hub-catalog: tekton
...
----


[id="chains-new-features-1-9_{context}"]
=== {tekton-chains}

:FeatureName: Tekton Chains
include::snippets/technology-preview.adoc[]

* Before this update, only Open Container Initiative (OCI) images were supported as outputs of `TaskRun` in the in-toto provenance agent. This update adds in-toto provenance metadata as outputs with these suffixes, `ARTIFACT_URI` and `ARTIFACT_DIGEST`.

* Before this update, only `TaskRun` attestations were supported. This update adds support for `PipelineRun` attestations as well.

* This update adds support for {tekton-chains} to get the `imgPullSecret` parameter from the pod template. This update helps you to configure repository authentication based on each pipeline run or task run without modifying the service account.

[id="tekton-hub-new-features-1-9_{context}"]
=== {tekton-hub}

:FeatureName: {tekton-hub}
include::snippets/technology-preview.adoc[]

* With this update, as an administrator, you can use an external database, such as Crunchy PostgreSQL with {tekton-hub}, instead of using the default {tekton-hub} database. This update helps you to perform the following actions:
** Specify the coordinates of an external database to be used with {tekton-hub}
** Disable the default {tekton-hub} database deployed by the Operator

* This update removes the dependency of `config.yaml` from external Git repositories and moves the complete configuration data into the API `ConfigMap`. This update helps an administrator to perform the following actions:
** Add the configuration data, such as categories, catalogs, scopes, and defaultScopes in the {tekton-hub} custom resource.
** Modify {tekton-hub} configuration data on the cluster. All modifications are preserved upon Operator upgrades.
** Update the list of catalogs for {tekton-hub}
** Change the categories for {tekton-hub}
+
[NOTE]
====
If you do not add any configuration data, you can use the default data in the API `ConfigMap` for {tekton-hub} configurations.
====

[id="pac-new-features-1-9_{context}"]
=== {pac}

* This update adds support for concurrency limit in the `Repository` CRD to define the maximum number of `PipelineRuns` running for a repository at a time. The `PipelineRuns` from a pull request or a push event are queued in alphabetical order.

* This update adds a new command `tkn pac logs` for showing the logs of the latest pipeline run for a repository.

* This update supports advanced event matching on file path for push and pull requests to GitHub and GitLab. For example, you can use the Common Expression Language (CEL) to run a pipeline only if a path has changed for any markdown file in the `docs` directory.
+
[source,yaml]
----
  ...
  annotations:
     pipelinesascode.tekton.dev/on-cel-expression: |
      event == "pull_request" && "docs/*.md".pathChanged()
----

* With this update, you can reference a remote pipeline in the `pipelineRef:` object using annotations.

* With this update, you can auto-configure new GitHub repositories with {pac}, which sets up a namespace and creates a `Repository` CRD for your GitHub repository.

* With this update, {pac} generates metrics for `PipelineRuns` with provider information.

* This update provides the following enhancements for the `tkn-pac` plugin:
** Detects running pipelines correctly
** Fixes showing duration when there is no failure completion time
** Shows an error snippet and highlights the error regular expression pattern in the `tkn-pac describe` command
** Adds the `use-real-time` switch to the `tkn-pac ls` and `tkn-pac describe` commands
** Imports the `tkn-pac` logs documentation
** Shows `pipelineruntimeout` as a failure in the `tkn-pac ls` and `tkn-pac describe` commands.
** Show a specific pipeline run failure with the `--target-pipelinerun` option.

* With this update, you can view the errors for your pipeline run in the form of a version control system (VCS) comment or a small snippet in the GitHub checks.

* With this update, {pac} optionally can detect errors inside the tasks if they are of a simple format and add those tasks as annotations in GitHub. This update is part of a developer preview feature.

* This update adds the following new commands:
** `tkn-pac webhook add`: Adds a webhook to project repository settings and updates the `webhook.secret` key in the existing `k8s Secret` object without updating the repository.
** `tkn-pac webhook update-token`: Updates provider token for an existing `k8s Secret` object without updating the repository.

* This update enhances functionality of the `tkn-pac create repo` command, which creates and configures webhooks for GitHub, GitLab, and BitbucketCloud along with creating repositories.

* With this update, the `tkn-pac describe` command shows the latest fifty events in a sorted order.

* This update adds the `--last` option to the `tkn-pac logs` command.

* With this update, the `tkn-pac resolve` command prompts for a token on detecting a `git_auth_secret` in the file template.

* With this update, {pac} hides secrets from log snippets to avoid exposing secrets in the GitHub interface.

* With this update, the secrets automatically generated for `git_auth_secret` are an owner reference with `PipelineRun`. The secrets get cleaned with the `PipelineRun`, not after the pipeline run execution.

* This update adds support to cancel a pipeline run with the `/cancel` comment.

* Before this update, the GitHub apps token scoping was not defined and tokens would be used on every repository installation. With this update, you can scope the GitHub apps token to the target repository using the following parameters:
** `secret-github-app-token-scoped`: Scopes the app token to the target repository, not to every repository the app installation has access to.
** `secret-github-app-scope-extra-repos`: Customizes the scoping of the  app token with an additional owner or repository.

* With this update, you can use {pac} with your own Git repositories that are hosted on GitLab.

* With this update, you can access pipeline execution details in the form of kubernetes events in your namespace. These details help you to troubleshoot pipeline errors without needing access to admin namespaces.

* This update supports authentication of URLs in the {pac} resolver with the Git provider.

* With this update, you can set the name of the hub catalog by using a setting in the `pipelines-as-code` config map.

* With this update, you can set the maximum and default limits for the `max-keep-run` parameter.

* This update adds documents on how to inject custom Secure Sockets Layer (SSL) certificates in {pac} to let you connect to provider instance with custom certificates.

* With this update, the `PipelineRun` resource definition has the log URL included as an annotation. For example, the `tkn-pac describe` command shows the log link when describing a `PipelineRun`.

* With this update, `tkn-pac` logs show repository name, instead of `PipelineRun` name.

[id="breaking-changes-1-9_{context}"]
== Breaking changes

// .Pipelines

* With this update, the `Conditions` custom resource definition (CRD) type has been removed. As an alternative, use the `WhenExpressions` instead.

* With this update, support for `tekton.dev/v1alpha1` API pipeline resources, such as Pipeline, PipelineRun, Task, Clustertask, and TaskRun has been removed.

* With this update, the `tkn-pac setup` command has been removed. Instead, use the `tkn-pac webhook add` command to re-add a webhook to an existing Git repository. And use the `tkn-pac webhook update-token` command to update the personal provider access token for an existing Secret object in the Git repository.

* With this update, a namespace that runs a pipeline with default settings does not apply the `pod-security.kubernetes.io/enforce:privileged` label to a workload.


[id="deprecated-features-1-9_{context}"]
== Deprecated and removed features

* In the {pipelines-title} 1.9.0 release, `ClusterTasks` are deprecated and planned to be removed in a future release. As an alternative, you can use `Cluster Resolver`.

* In the {pipelines-title} 1.9.0 release, the use of the `triggers` and the `namespaceSelector` fields in a single `EventListener` specification is deprecated and planned to be removed in a future release. You can use these fields in different `EventListener` specifications successfully.

* In the {pipelines-title} 1.9.0 release, the `tkn pipelinerun describe` command does not display timeouts for the `PipelineRun` resource.

* In the {pipelines-title} 1.9.0 release, the PipelineResource` custom resource (CR) is deprecated. The `PipelineResource` CR was a Tech Preview feature and part of the `tekton.dev/v1alpha1` API.

* In the {pipelines-title} 1.9.0 release, custom image parameters from cluster tasks are deprecated. As an alternative, you can copy a cluster task and use your custom image in it.

[id="known-issues-1-9_{context}"]
== Known issues

// .Operator

* The `chains-secret` and `chains-config` config maps are removed after you uninstall the {pipelines-title} Operator. As they contain user data, they should be preserved and not deleted.
// https://issues.redhat.com/browse/SRVKP-2396

// .PAC

* When running the `tkn pac` set of commands on Windows, you may receive the following error message: `Command finished with error: not supported by Windows.`
+

Workaround: Set the `NO_COLOR` environment variable to `true`.
// https://issues.redhat.com/browse/SRVKP-2197

* Running the `tkn pac resolve -f <filename> | oc create -f` command may not provide expected results, if the `tkn pac resolve` command uses a templated parameter value to function.
+
Workaround: To mitigate this issue, save the output of `tkn pac resolve` in a temporary file by running the `tkn pac resolve -f <filename> -o tempfile.yaml` command and then run the `oc create -f tempfile.yaml` command. For example, `tkn pac resolve -f <filename> -o /tmp/pull-request-resolved.yaml && oc create -f /tmp/pull-request-resolved.yaml`.

[id="fixed-issues-1-9_{context}"]
== Fixed issues

// .Pipelines

* Before this update, after replacing an empty array, the original array returned an empty string rendering the paramaters inside it invalid. With this update, this issue is resolved and the original array returns as empty.
// Vincent Demeester

* Before this update, if duplicate secrets were present in a service account for a pipelines run, it resulted in failure in task pod creation. With this update, this issue is resolved and the task pod is created successfully even if duplicate secrets are present in a service account.
// Vincent Demeester

* Before this update, by looking at the TaskRun's `spec.StatusMessage` field, users could not distinguish whether the `TaskRun` had been cancelled by the user or by a `PipelineRun` that was part of it. With this update, this issue is resolved and users can distinguish the status of the `TaskRun` by looking at the TaskRun's `spec.StatusMessage` field.
// Vincent Demeester

* Before this update, webhook validation was removed on deletion of old versions of invalid objects. With this update, this issue is resolved.
// Vincent Demeester @vdeemester

* Before this update, if you set the `timeouts.pipeline` parameter to `0`, you could not set the `timeouts.tasks` parameter or the `timeouts.finally` parameters. This update resolves the issue. Now, when you set the `timeouts.pipeline` parameter value, you can set the value of either the`timeouts.tasks` parameter or the `timeouts.finally` parameter. For example:
+
[source,yaml]
----
yaml
kind: PipelineRun
spec:
  timeouts:
    pipeline: "0"  # No timeout
    tasks: "0h3m0s"
----
// Vincent Demeester @vdeemester

* Before this update, a race condition could occur if another tool updated labels or annotations on a PipelineRun or TaskRun. With this update, this issue is resolved and you can merge labels or annotations.
// Vincent Demeester @vdeemester

// .Triggers

* Before this update, log keys did not have the same keys as in pipelines controllers. With this update, this issue has been resolved and the log keys have been updated to match the log stream of pipeline controllers. The keys in logs have been changed from "ts" to "timestamp", from "level" to "severity", and from "message" to "msg".
// https://issues.redhat.com/browse/SRVKP-1959
// @KhurramBaig

// .CLI

* Before this update, if a PipelineRun was deleted with an unknown status, an error message was not generated. With this update, this issue is resolved and an error message is generated.
// https://github.com/tektoncd/cli/pull/1684
// Piyush Garg @piyush-garg

* Before this update, to access bundle commands like `list` and `push`, it was required to use the `kubeconfig` file . With this update, this issue has been resolved and the `kubeconfig` file is not required to access bundle commands.
// https://github.com/tektoncd/cli/pull/1557
// Piyush Garg @piyush-garg

* Before this update, if the parent PipelineRun was running while deleting TaskRuns, then TaskRuns would be deleted. With this update, this issue is resolved and TaskRuns are not getting deleted if the parent PipelineRun is running.
// https://github.com/tektoncd/cli/pull/1736
// Piyush Garg @piyush-garg

* Before this update, if the user attempted to build a bundle with more objects than the pipeline controller permitted, the Tekton CLI did not display an error message. With this update, this issue is resolved and the Tekton CLI displays an error message if the user attempts to build a bundle with more objects than the limit permitted in the pipeline controller.
// https://github.com/tektoncd/cli/pull/1572
// Piyush Garg @piyush-garg

// .Operator

* Before this update, if namespaces were removed from the cluster, then the operator did not remove namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects. With this update, this issue has been resolved, and the operator removes the namespaces from the `ClusterInterceptor ClusterRoleBinding` subjects.
// Shubham Minglani

* Before this update, the default installation of the {pipelines-title} Operator resulted in the `pipelines-scc-rolebinding security context constraint` (SCC) role binding resource remaining in the cluster. With this update, the default installation of the {pipelines-title} Operator results in the `pipelines-scc-rolebinding security context constraint` (SCC) role binding resource resource being removed from the cluster.
// https://github.com/tektoncd/operator/pull/1156
// https://issues.redhat.com/browse/SRVKP-2520
// Shubham Minglani

// .PAC

* Before this update, {pac} did not get updated values from the {pac} `ConfigMap` object. With this update, this issue is fixed and the {pac} `ConfigMap` object looks for any new changes.
// Savita Ashture

* Before this update, {pac} controller did not wait for the `tekton.dev/pipeline` label to be updated and added the `checkrun id` label, which would cause race conditions. With this update, the {pac} controller waits for the `tekton.dev/pipeline` label to be updated and then adds the `checkrun id` label, which helps to avoid race conditions.
// Savita Ashture

* Before this update, the `tkn-pac create repo` command did not override a `PipelineRun` if it already existed in the git repository. With this update, `tkn-pac create` command is fixed to override a `PipelineRun` if it exists in the git repository and this resolves the issue successfully.
// Savita Ashture

* Before this update, the `tkn pac describe` command did not display reasons for every message. With this update, this issue is fixed and the `tkn pac describe` command displays reasons for every message.
// Savita Ashture

* Before this update, a pull request failed if the user in the annotation provided values by using a regex form, for example, `refs/head/rel-*`. The pull request failed because it was missing `refs/heads` in its base branch. With this update, the prefix is added and checked that it matches. This resolves the issue and the pull request is successful.
// Savita Ashture

[id="release-notes-1-9-1_{context}"]
== Release notes for {pipelines-title} General Availability 1.9.1

With this update, {pipelines-title} General Availability (GA) 1.9.1 is available on {product-title} 4.11, 4.12, and 4.13.

[id="fixed-issues-1-9-1_{context}"]
== Fixed issues

* Before this update, the `tkn pac repo list` command did not run on Microsoft Windows. This update fixes the issue, and now you can run the `tkn pac repo list` command on Microsoft Windows.

* Before this update, {pac} watcher did not receive all the configuration change events. With this update, the {pac} watcher is updated, and now the {pac} watcher does not miss the configuration change events.

* Before this update, the pods created by {pac}, such as `TaskRuns` or `PipelineRuns` could not access custom certificates exposed by the user in the cluster. This update fixes the issue, and you can now access custom certificates from the `TaskRuns` or `PipelineRuns` pods in the cluster.

* Before this update, on a cluster enabled with FIPS, the `tekton-triggers-core-interceptors` core interceptor used in the `Trigger` resource did not function after the Pipelines Operator was upgraded to version 1.9. This update resolves the issue. Now, OpenShift uses MInTLS 1.2 for all its components. As a result, the `tekton-triggers-core-interceptors` core interceptor updates to TLS version 1.2and its functionality runs accurately.

* Before this update, when using a pipeline run with an internal OpenShift image registry, the URL to the image had to be hardcoded in the pipeline run definition. For example:
+
[source,yaml]
----
...
  - name: IMAGE_NAME
    value: 'image-registry.openshift-image-registry.svc:5000/<test_namespace>/<test_pipelinerun>'
...
----
+
When using a pipeline run in the context of {pac}, such hardcoded values prevented the pipeline run definitions from being used in different clusters and namespaces.
+
With this update, you can use the dynamic template variables instead of hardcoding the values for namespaces and pipeline run names to generalize pipeline run definitions. For example:
+
[source,yaml]
----
...
  - name: IMAGE_NAME
    value: 'image-registry.openshift-image-registry.svc:5000/{{ target_namespace }}/$(context.pipelineRun.name)'
...
----

* Before this update, {pac} used the same GitHub token to fetch a remote task available in the same host only on the default GitHub branch. This update resolves the issue. Now {pac} uses the same GitHub token to fetch a remote task from any GitHub branch.

[id="known-issues-1-9-1_{context}"]
== Known issues

* The value for `CATALOG_REFRESH_INTERVAL`, a field in the Hub API `ConfigMap` object used in the Tekton Hub CR, is not getting updated with a custom value provided by the user.
+
Workaround: None. You can track the issue link:https://issues.redhat.com/browse/SRVKP-2854[SRVKP-2854].

[id="breaking-changes-1-9-1_{context}"]
== Breaking changes

* With this update, an OLM misconfiguration issue has been introduced, which prevents the upgrade of the {product-title}. This issue will be fixed in a future release.

[id="release-notes-1-9-2_{context}"]
== Release notes for {pipelines-title} General Availability 1.9.2

With this update, {pipelines-title} General Availability (GA) 1.9.2 is available on {product-title} 4.11, 4.12, and 4.13.

[id="fixed-issues-1-9-2_{context}"]
== Fixed issues

* Before this update, an OLM misconfiguration issue had been introduced in the previous version of the release, which prevented the upgrade of {product-title}. With this update, this misconfiguration issue has been fixed.

[id="release-notes-1-9-3_{context}"]
== Release notes for {pipelines-title} General Availability 1.9.3

With this update, {pipelines-title} General Availability (GA) 1.9.3 is available on {product-title} 4.10 in addition to 4.11, 4.12, and 4.13.

[id="fixed-issues-1-9-3_{context}"]
== Fixed issues

* This update fixes the performance issues for huge pipelines. Now, the CPU usage is reduced by 61% and the memory usage is reduced by 44%.

* Before this update, a pipeline run would fail if a task did not run because of its `when` expression. This update fixes the issue by preventing the validation of a skipped task result in pipeline results. Now, the pipeline result is not emitted and the pipeline run does not fail because of a missing result.

* This update fixes the `pipelineref.bundle` conversion to the bundle resolver for the `v1beta1` API. Now, the conversion feature sets the value of the `kind` field to `Pipeline` after conversion.

* Before this update, an issue in the {pipelines-shortname} Operator prevented the user from setting the value of the `spec.pipeline.enable-api-fields` field to `beta`. This update fixes the issue. Now, you can set the value to `beta` along with `alpha` and `stable` in the `TektonConfig` custom resource.

* Before this update, when {pac} could not create a secret due to a cluster error, it would show the temporary token on the GitHub check run, which is public. This update fixes the issue. Now, the token is no longer displayed on the GitHub checks interface when the creation of the secret fails.

[id="known-issues-1-9-3_{context}"]
== Known issues

* There is currently a known issue with the *stop* option for pipeline runs in the {product-title} web console. The *stop* option in the *Actions* drop-down list is not working as expected and does not cancel the pipeline run.

* There is currently a known issue with upgrading to {pipelines-shortname} version 1.9.x due to a failing custom resource definition conversion.
+
Workaround: Before upgrading to {pipelines-shortname} version 1.9.x, perform the step mentioned in the link:https://access.redhat.com/solutions/6999996[solution] on the Red Hat Customer Portal.
