Skip to content

[DNM] Release v0.39.6#2730

Open
theakshaypant wants to merge 4 commits into
release-v0.39.xfrom
release-v0.39.6
Open

[DNM] Release v0.39.6#2730
theakshaypant wants to merge 4 commits into
release-v0.39.xfrom
release-v0.39.6

Conversation

@theakshaypant
Copy link
Copy Markdown
Member

📝 Description of the Change

Changes included:
54cb7bf chore(deps): bump tektoncd/pipeline to v1.6.2
636bae9 perf(informer): add TransformFuncs to reduce cache memory usage
501cbd0 fix(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
ff5b628 chore(deps): update grpc to v1.79.3

🔗 Linked GitHub Issue

Fixes #

🧪 Testing Strategy

  • Unit tests
  • Integration tests
  • End-to-end tests
  • Manual testing
  • Not Applicable

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

  • I have not used any AI assistance for this PR.
  • I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

  • 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
  • ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
  • ♽ I have run make test and make lint locally to check for and fix any
    issues. For an efficient workflow, I have considered installing
    pre-commit and running pre-commit install to
    automate these checks.
  • 📖 I have added or updated documentation for any user-facing changes.
  • 🧪 I have added sufficient unit tests for my code changes.
  • 🎁 I have added end-to-end tests where feasible. See README for more details.
  • 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
  • If adding a provider feature, I have filled in the following and updated the provider documentation:
    • GitHub App
    • GitHub Webhook
    • Gitea/Forgejo
    • GitLab
    • Bitbucket Cloud
    • Bitbucket Data Center

Upgrade google.golang.org/grpc to v1.79.3 to fix
CVE-2026-33186 (GHSA-p77j-4mvh-x3m3), a critical HTTP/2
:path validation flaw that allows bypassing authorization
rules in gRPC interceptors.

Signed-off-by: Akshay Pant <akpant@redhat.com>
Update go-jose v3 and v4 to patch security vulnerability in
JWE and JWS handling.

Signed-off-by: Akshay Pant <akpant@redhat.com>
Add cache transform functions for the Repository and PipelineRun
informers, stripping large unnecessary fields before objects enter
the informer cache. Inspired by tektoncd/pipeline#9316.

For Repository objects, ManagedFields, Annotations and Status are
stripped. The reconciler never reads Repository annotations or
Status from the lister; Status is always fetched fresh via direct
API call before updates.

For PipelineRun objects, ManagedFields and large Spec and Status
fields are stripped. The watcher only needs Annotations, Spec.Status
(pending check), Status.Conditions, and timing fields. All other
data is fetched directly from the API when needed.

Benchmark results with production-realistic objects show an 89% JSON
size reduction for Repository objects (5.6KB to 600B) and 94% for
PipelineRun objects (10.7KB to 677B), with corresponding 8-10x
reductions in heap allocation per cached object.

Signed-off-by: Akshay Pant <akpant@redhat.com>
Asisted-by: Claude <noreply@anthropic.com>
Addresses CVE-2026-40161 (GHSA-wjxp-xrpv-xpff), a high-severity
vulnerability where the git resolver API mode leaks
system-configured API tokens to user-controlled serverURL
endpoints. Also includes path traversal hardening for volume mount
validation using filepath.Clean.

Signed-off-by: Akshay Pant <akpant@redhat.com>
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces cache transform functions for Repository and PipelineRun objects to optimize memory usage in the PAC watcher informer caches by stripping unnecessary fields. It includes comprehensive benchmarks demonstrating significant memory savings and unit tests for correctness. Additionally, the Go toolchain and several dependencies, including Tekton Pipeline, were updated. A critical issue was identified in the PipelineRunForCache implementation where assigning a zero-value struct to the TaskRunTemplate pointer field would cause a compilation error; this should be changed to nil as suggested.

pr.Spec.Params = nil
pr.Spec.Workspaces = nil
pr.Spec.TaskRunSpecs = nil
pr.Spec.TaskRunTemplate = tektonv1.PipelineTaskRunTemplate{}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

In Tekton v1, PipelineRunSpec.TaskRunTemplate is a pointer (*PipelineTaskRunTemplate). Assigning a zero-value struct (tektonv1.PipelineTaskRunTemplate{}) will cause a compilation error as you cannot assign a struct to a pointer field. It should be set to nil to maintain consistency with the other stripped pointer fields in this function. This in-place modification is the accepted pattern for informer TransformFuncs in this repository.

Suggested change
pr.Spec.TaskRunTemplate = tektonv1.PipelineTaskRunTemplate{}
pr.Spec.TaskRunTemplate = nil
References
  1. When implementing a Kubernetes informer TransformFunc, it is an accepted pattern to modify the object in-place to strip fields for cache optimization. A DeepCopy is not required as the modification is the intended behavior before the object is cached.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant