Upgrade tekton-chains pack to 0.29.0

[jaimegomez-source]

Upgrade tekton-chains pack to 0.29.0

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 1
• Clean images: 0
• Images with CVEs: 1
• Total CVEs found: 6

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 1
🟢 Low CVEs: 5

Images with CVEs:

• ghcr.io/tektoncd/chains/github.com/tektoncd/chains/cmd/controller:v0.29.0@sha256:b1f1e5790243d13e2026e5a1af88ad3e7b798a9cddd2dcbef23289261f385421: 6 CVEs (Critical: 0, High: 0, Medium: 1, Low: 5)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 1
• Clean images: 0
• Images with CVEs: 1
• Total CVEs found: 6

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 1
🟢 Low CVEs: 5

Images with CVEs:

• ghcr.io/tektoncd/chains/github.com/tektoncd/chains/cmd/controller:v0.29.0@sha256:b1f1e5790243d13e2026e5a1af88ad3e7b798a9cddd2dcbef23289261f385421: 6 CVEs (Critical: 0, High: 0, Medium: 1, Low: 5)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[vishwanaths]

Pack review — tekton-chains-0.29.0

Packs Validation: passed (run)
source annotation: community
Pack metadata: name=tekton-chains version=0.29.0 addonType=system app layer=addon displayName=Tekton Chains contributor=spectrocloud

Compared against packs/tekton-chains-0.12.0/

Version bump 0.12.0 → 0.29.0 (minor bump — tracks upstream tekton-chains v0.29.0).

Summary of differences

• pack.json: version bumped 0.12.0 → 0.29.0. Dependency swapped from tekton-operator (minVersion 0.61.0) to tekton-pipelines (minVersion 1.14.0). No changes to name, layer, addonType, cloudTypes, kubeManifests, or annotations.
• values.yaml: added pack.content.images pinning the controller image by digest — ghcr.io/tektoncd/chains/github.com/tektoncd/chains/cmd/controller:v0.29.0@sha256:b1f1e5790243d13e2026e5a1af88ad3e7b798a9cddd2dcbef23289261f385421. Existing pack.namespace: tekton-chains preserved.
• manifests/release.yaml: rebased on upstream v0.29.0 release manifest — net +213 lines. Adds new ConfigMaps (tekton-chains-config-leader-election, tekton-chains-config-observability), a new tekton-chains-metrics Service, additional RBAC rules, and an expanded controller Deployment spec. Contents not inspected line-by-line.
• schema.yaml: unchanged (pack.namespace: '{{ readonly }}').
• logo.png: unchanged (same SHA, 8972 bytes).
• Files added: README.md (+78 lines).
• Files removed: NOTES.txt (previously referenced the v0.12.0 upstream release tag).

pack.json diff

@@ -7,7 +7,7 @@
         "source": "community",
         "contributor" : "spectrocloud"
     },
-    "version": "0.12.0",
+    "version": "0.29.0",
     "kubeManifests": [
         "manifests/release.yaml"
     ],
@@ -19,8 +19,8 @@
     "constraints": {
         "dependencies": [
             {
-                "packName": "tekton-operator",
-                "minVersion": "0.61.0",
+                "packName": "tekton-pipelines",
+                "minVersion": "1.14.0",
                 "maxVersion": "",
                 "layer": "addon",
                 "type": "required"

values.yaml diff

@@ -1,2 +1,5 @@
 pack:
+  content:
+    images:
+      - image: ghcr.io/tektoncd/chains/github.com/tektoncd/chains/cmd/controller:v0.29.0@sha256:b1f1e5790243d13e2026e5a1af88ad3e7b798a9cddd2dcbef23289261f385421
   namespace: "tekton-chains"

Blockers

• (none)

Nits / observations

• Dependency change (tekton-operator → tekton-pipelines) is a meaningful contract change for consumers upgrading from 0.12.0; worth calling out in release notes so cluster profiles using the old dep constraint know to adjust.
• NOTES.txt was removed and replaced by README.md; other packs in the repo often keep both, but this appears to be a deliberate consolidation.
• Non-blocking: the security-scans/syft-license check on this PR is FAILURE — that is outside Packs Validation and outside this reviewer's scope, but maintainers may want to verify before merge.

Review generated by the pack-reviewer Claude Code subagent.