#Release Notes

#Compatibility and support matrix

The following table shows the compatibility and support matrix between the Alauda DevOps Pipelines operator and ACP versions.

The following table shows the recommended version mapping between Alauda DevOps Pipelines and Alauda DevOps Connectors.

#Channel mapping

For details about channel behavior and upgrade targeting, see Upgrade Path and Lifecycle Policy.

#v4.12.0

#New and Optimized Features

Operator

• With this update, Tekton catalog artifacts are delivered by the platform's standalone ArtifactHub component. ArtifactHub has its own lifecycle, so catalog updates — new tools, Task fixes, version upgrades — can be delivered quickly, independently of the operator release cadence.
• With this update, the Kubernetes API client QPS and Burst settings of the operator are overridable, and the CPU limits of the operator lifecycle controller are raised to improve reconcile stability in large clusters.

Pipelines

• With this update, the pipeline set-security-context feature flag defaults to true for newly created TektonConfig and TektonPipeline instances, so Tekton-injected containers run with a hardened non-root security context and work in namespaces enforcing the restricted Pod Security Admission level. Existing instances are not changed. For details, see Comply with Pod Security Restricted Standard.
• With this update, a new enable-validating-admission-policy parameter is added under TektonConfig spec.pipeline.params to control the deployment of ValidatingAdmissionPolicy guardrail resources. The parameter is disabled by default. For details, see Comply with Pod Security Restricted Standard.

Pipelines as Code

• With this update, PAC Repository resources can be created and managed from the web console, including onboarding repositories through a GitLab App or GitHub App. Enable the feature through the enable-pac-repository flag in the tektoncd-enhancement-feature-flags ConfigMap. For details, see Enable Repository UI Feature.
• With this update, PAC can automatically retrieve and register the webhook URL when onboarding a repository, removing the manual webhook configuration step.
• With this update, custom console links support namespace-derived template variables through the custom-console-url-namespace-vars setting, resolving values such as {{ project }} and {{ cluster }} from namespace labels or annotations. For details, see Manage PAC Component.

Results

• With this update, the Tekton Results API and agent components no longer expose database credentials as container environment variables; credentials are read from mounted Secret files instead.

Web Console

• With this update, after a TaskRun is retried, the logs of each previous execution can be viewed by switching between retries.
• With this update, the Task list and the Hub Task list show the catalog source of each Task and support filtering by source in the pipeline editor.
• With this update, multiple UI details are refined, including the graphical Pipeline editor, the PipelineRun loading state, advanced-parameter visibility control, Integration selection, workspace binding, and label filtering.

#Breaking Changes

• Starting from this release, the built-in Tekton Hub is no longer deployed by default, and future releases (including LTS versions) will not deploy it by default either. A new operator-level switch AUTOINSTALL_TEKTONHUB (default "false") controls the behavior; the TektonConfig CRD/API is not changed.

  • On upgrade, an environment that previously ran the built-in Tekton Hub will have it removed: with the switch off, the operator actively deletes the TektonHub CR. If you still rely on the built-in Tekton Hub, record the catalog image before the upgrade, then re-enable it afterwards. For details, see Enabling the Built-in Tekton Hub.
  • The operator bundle no longer ships the catalog tool images (buildah, golang, maven, and so on). The tool image versions referenced by the new catalog may therefore not exist in your environment, which is why pinning the catalog to the pre-upgrade catalog image is the recommended way to keep the built-in Tekton Hub working after an upgrade. For details, see Pinning the Catalog to the Pre-Upgrade Image.

#Fixed Issues

• Before this update, when a Task contained multiple steps referencing StepActions together with an object-type parameter that had a default value, the tekton-pipelines-controller could intermittently hit a "concurrent map writes" data race while resolving those StepAction references concurrently, causing the whole controller process to crash and restart; in-flight PipelineRuns and TaskRuns on the crashing replica were interrupted at that moment, and in multi-replica deployments this appeared as repeated replica restarts and unstable pipeline scheduling. With this update, concurrent resolution no longer shares and writes to the same underlying data, eliminating the data race so the controller no longer crashes and the affected PipelineRuns and TaskRuns are processed reliably.
• Before this update, if a stale .git/index.lock file was left behind in the local git clone used for Tekton Hub catalog synchronization, the catalog sync kept failing every refresh cycle when running git reset --hard because the lock file already existed, so the Hub could not refresh its resource index; pipelines that referenced catalog resources (such as clone-image-build-test-scan) then repeatedly failed with "fail to fetch Tekton Hub resource ... not found on hub" and could not retrieve those resources. With this update, Tekton Hub automatically detects and removes stale .git lock files before reusing the catalog clone, so synchronization self-heals on the following cycles, the affected catalog resources can be fetched again, and pipelines no longer fail with this error.
• Before this update, when creating a TaskRun and manually binding a parameter to an integration attribute that was not pre-associated with the Task parameter, the system did not correctly write the integration runtime refPath back and could persist the internal __NAME__ placeholder into TaskRun parameters, causing an invalid reference binding; with this update, the TaskRun creation form correctly updates the binding after an integration attribute is selected manually, ensuring the runtime refPath is written back and the __NAME__ placeholder is not persisted in parameters.

#Known Issues

No issues in this release.