fix: CVE-2025-61726 - upgrade go version to >1.25.5

.github/workflows/ci.yaml

@@ -45,7 +45,7 @@ jobs:
     - name: golangci-lint
       uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
       with:
-        version: v2.1.6
+        version: v2.9.0
         only-new-issues: true
         args: --timeout=10m
     - name: yamllint

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,14 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - release-*
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [main]
+    branches:
+      - main
+      - release-*
   schedule:
     - cron: '30 20 * * 2'
 
@@ -38,11 +42,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@45580472a5bb82c4681c4ac726cfdb60060c2ee1  # v3.32.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,7 +55,7 @@ jobs:
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
     # setup cache to speed up the action
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
       with:
         path: |
           ~/.cache/go-build
@@ -81,4 +85,4 @@ jobs:
         make bin/tkn
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@45580472a5bb82c4681c4ac726cfdb60060c2ee1  # v3.32.4

.github/workflows/e2e-matrix.yml

@@ -0,0 +1,91 @@
+name: Tekton Integration
+# Adapted from https://github.com/mattmoor/mink/blob/master/.github/workflows/minkind.yaml
+
+on: [workflow_call]
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  e2e-tests:
+    concurrency:
+      group: ${{ github.workflow }}-${{ matrix.k8s-name }}-${{ matrix.feature-flags }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: true
+    name: e2e tests
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false # Keep running if one leg fails.
+      matrix:
+        k8s-name:
+        - k8s-oldest
+        - k8s-plus-one
+
+        include:
+        - k8s-name: k8s-oldest
+          k8s-version: v1.28.x
+        - k8s-name: k8s-plus-one
+          k8s-version: v1.29.x
+    env:
+      KO_DOCKER_REPO: registry.local:5000/tekton
+      CLUSTER_DOMAIN: c${{ github.run_id }}.local
+      ARTIFACTS: ${{ github.workspace }}/artifacts
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5  # v6.2.0
+      with:
+        go-version-file: "go.mod"
+    - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
+
+    - name: Install Dependencies
+      working-directory: ./
+      run: |
+        echo '::group:: install go-junit-report'
+        go install github.com/jstemmer/go-junit-report@v0.9.1
+        echo '::endgroup::'
+
+        echo '::group:: created required folders'
+        mkdir -p "${ARTIFACTS}"
+        echo '::endgroup::'
+
+        echo '::group:: fetch setup-kind.sh from plumbing'
+        curl -sL https://raw.githubusercontent.com/tektoncd/plumbing/main/tekton/images/kind-e2e/setup-kind.sh \
+          -o ./hack/setup-kind.sh
+        chmod +x ./hack/setup-kind.sh
+        echo '::endgroup::'
+
+        echo "${GOPATH}/bin" >> "$GITHUB_PATH"
+
+    - name: Run tests
+      run: |
+        ./hack/setup-kind.sh \
+          --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
+          --cluster-suffix c${{ github.run_id }}.local \
+          --nodes 3 \
+          --k8s-version ${{ matrix.k8s-version }} \
+          --e2e-script ./test/e2e-tests.sh \
+          --e2e-env ./test/e2e-tests-kind-prow.env
+
+    - name: Upload test results
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+      with:
+        name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}
+        path: ${{ env.ARTIFACTS }}
+
+    - uses: chainguard-dev/actions/kind-diag@4ed96e952ef2982fe89a50f3c40e9643bb9fe803 # v1.6.3
+      if: ${{ failure() }}
+      with:
+        artifact-name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}-logs
+
+    - name: Dump Artifacts
+      if: ${{ failure() }}
+      run: |
+        if [[ -d ${{ env.ARTIFACTS }} ]]; then
+          cd ${{ env.ARTIFACTS }}
+          for x in $(find . -type f); do
+            echo "::group:: artifact $x"
+            cat $x
+            echo '::endgroup::'
+          done
+        fi

Makefile

@@ -118,9 +118,10 @@ lint-yaml: ${YAML_FILES}  ; $(info $(M) running yamllint…) ## runs yamllint on
 	@yamllint -c .yamllint $(YAML_FILES)
 
 ## Tests
-TEST_UNIT_TARGETS := test-unit-verbose test-unit-race
+TEST_UNIT_TARGETS := test-unit-verbose test-unit-race test-unit-verbose-and-race
 test-unit-verbose: ARGS=-v
 test-unit-race:    ARGS=-race
+test-unit-verbose-and-race: ARGS=-v -race
 $(TEST_UNIT_TARGETS): test-unit
 .PHONY: $(TEST_UNIT_TARGETS) test-unit
 test-unit: ; $(info $(M) running unit tests…) ## Run unit tests

go.mod

@@ -1,6 +1,6 @@
 module github.com/tektoncd/cli
 
-go 1.25.0
+go 1.25.6
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7

hack/update-deps.sh

@@ -56,4 +56,15 @@ fi
 go mod tidy
 go mod vendor
 
+# github.com/alibabacloud-go/cr-20160607@v1.0.1 ships without a LICENSE file
+# at the tagged release, but the source repo is Apache-2.0 licensed.
+# Copy from the sibling module which shares the same license.
+if [[ -f vendor/github.com/alibabacloud-go/cr-20181201/LICENSE ]] && \
+   [[ -d vendor/github.com/alibabacloud-go/cr-20160607/client ]]; then
+  cp vendor/github.com/alibabacloud-go/cr-20181201/LICENSE \
+     vendor/github.com/alibabacloud-go/cr-20160607/LICENSE
+  cp vendor/github.com/alibabacloud-go/cr-20181201/LICENSE \
+     vendor/github.com/alibabacloud-go/cr-20160607/client/LICENSE
+fi
+
 update_licenses third_party/VENDOR-LICENSE "./cmd/*"

test/e2e-tests-kind-prow.env

@@ -1,3 +1,10 @@
 E2E_SKIP_CLUSTER_CREATION=true
 KO_DOCKER_REPO=registry.local:5000
 ARTIFACTS=/workspace/source/artifacts
+
+# Pin Tekton component versions to ones that:
+# 1. Use ghcr.io (gcr.io is deprecated and returns 403)
+# 2. Still include ClusterTask CRD (removed in v0.71.0+)
+RELEASE_YAML_PIPELINE=https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.70.0/release.yaml
+RELEASE_YAML_TRIGGERS=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.0/release.yaml
+RELEASE_YAML_TRIGGERS_INTERCEPTORS=https://storage.googleapis.com/tekton-releases/triggers/previous/v0.30.0/interceptors.yaml

test/e2e-tests.sh

@@ -174,7 +174,7 @@ else
     export TEST_CLIENT_BINARY="${PWD}/tkn"
 fi
 
-go_test_e2e ./test/e2e/... || failed=1
+go_test_e2e -timeout=20m ./test/e2e/... || failed=1
 (( failed )) && fail_test
 
 success

test/e2e/pipeline/pipeline_test.go

@@ -20,6 +20,7 @@ package pipeline
 import (
 	"context"
 	"encoding/json"
+	"regexp"
 	"strconv"
 	"strings"
 	"testing"
@@ -46,6 +47,22 @@ const (
 	tePipelineName = "output-pipeline"
 )
 
+// normalizeAge replaces timing-dependent age strings (e.g. "1 second ago",
+// "40 seconds ago") with a fixed placeholder so that assertions don't flake
+// due to clock skew between generating expected output and running the command.
+var ageRegexp = regexp.MustCompile(`\d+ (?:second|minute|hour|day)s? ago`)
+
+func normalizeAge(s string) string {
+	return ageRegexp.ReplaceAllString(s, "--- ago")
+}
+
+func assertContainsNormalized(t *testing.T, actual, expected string) {
+	t.Helper()
+	if !strings.Contains(normalizeAge(actual), normalizeAge(expected)) {
+		t.Fatalf("expected stdout to contain (age-normalized):\n%s\ngot:\n%s", expected, actual)
+	}
+}
+
 func TestPipelinesE2E(t *testing.T) {
 	t.Parallel()
 	c, namespace := framework.Setup(t)
@@ -200,8 +217,8 @@ Waiting for logs to be available...
 		res.Assert(t, icmd.Expected{
 			ExitCode: 0,
 			Err:      icmd.None,
-			Out:      expected,
 		})
+		assertContainsNormalized(t, res.Stdout(), expected)
 	})
 
 	t.Run("Validate interactive pipeline logs, with  follow mode (-f) ", func(t *testing.T) {
@@ -472,8 +489,8 @@ Waiting for logs to be available...
 		res.Assert(t, icmd.Expected{
 			ExitCode: 0,
 			Err:      icmd.None,
-			Out:      expected,
 		})
+		assertContainsNormalized(t, res.Stdout(), expected)
 	})
 }
 

test/e2e/pipeline/start_test.go

@@ -19,12 +19,15 @@ package pipeline
 
 import (
 	"testing"
+	"time"
 
 	"github.com/AlecAivazis/survey/v2/terminal"
 	"github.com/Netflix/go-expect"
+	"github.com/tektoncd/cli/test/builder"
 	"github.com/tektoncd/cli/test/cli"
 	"github.com/tektoncd/cli/test/framework"
 	"github.com/tektoncd/cli/test/helper"
+	"github.com/tektoncd/cli/test/wait"
 	"gotest.tools/v3/assert"
 	knativetest "knative.dev/pkg/test"
 )
@@ -75,6 +78,18 @@ func TestPipelineInteractiveStartE2E(t *testing.T) {
 				return nil
 			},
 		})
+
+		// Wait for the PipelineRun started above to complete before checking logs. Sleep is due to race condition with creation
+		time.Sleep(5 * time.Second)
+		pipelineRunList := builder.GetPipelineRunListWithName(c, "output-pipeline", true)
+		if len(pipelineRunList.Items) > 0 {
+			pipelineRunGeneratedName := pipelineRunList.Items[0].Name
+			if err := wait.ForPipelineRunState(c, pipelineRunGeneratedName, 5*time.Minute, wait.PipelineRunSucceed(pipelineRunGeneratedName), "PipelineRunSucceeded"); err != nil {
+				t.Fatalf("Error waiting for PipelineRun to Succeed: %s", err)
+			}
+		} else {
+			t.Error("no \"output-pipeline\" pipelinerun found")
+		}
 	})
 
 	t.Run("Validate pipeline logs, with  follow mode (-f) and --last ", func(t *testing.T) {