Upgrade tekton-pipeline pack to 1.15.1

[jaimegomez-source]

Upgrade tekton-pipeline pack to 1.15.1

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 4
• Clean images: 0
• Images with CVEs: 4
• Total CVEs found: 136

🔴 Critical CVEs: 3
🟠 High CVEs: 13
🟡 Medium CVEs: 15
🟢 Low CVEs: 105

Images with CVEs:

• ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.1@sha256:89633d2774dab0497d30cb2ca73e7c2fff94687a38e2652c3c47075ac7890c40: 5 CVEs (Critical: 0, High: 0, Medium: 1, Low: 4)
• ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.1@sha256:a816daf2107b5c10dd17c14d125989d5d109f7d928aaf8c88b1c189c34846376: 3 CVEs (Critical: 0, High: 0, Medium: 1, Low: 2)
• ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.1@sha256:b525f8a04d7a299e5e68c9d774a98b25c50357e802303a6fe6810b52d7f4daca: 125 CVEs (Critical: 3, High: 13, Medium: 12, Low: 97)
  Critical CVEs: CVE-2025-58050, CVE-2026-31789
• ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.1@sha256:8eb820ac797ac7a2efe1bf99f2c548f3ef208d28ac5c97ee51d36ae3181b6040: 3 CVEs (Critical: 0, High: 0, Medium: 1, Low: 2)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[bulwark-sc-ent]

✅ CVE scan completed successfully.

Scan Summary:

• Total images scanned: 4
• Clean images: 0
• Images with CVEs: 4
• Total CVEs found: 136

🔴 Critical CVEs: 3
🟠 High CVEs: 13
🟡 Medium CVEs: 15
🟢 Low CVEs: 105

Images with CVEs:

• ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.1@sha256:89633d2774dab0497d30cb2ca73e7c2fff94687a38e2652c3c47075ac7890c40: 5 CVEs (Critical: 0, High: 0, Medium: 1, Low: 4)
• ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.1@sha256:a816daf2107b5c10dd17c14d125989d5d109f7d928aaf8c88b1c189c34846376: 3 CVEs (Critical: 0, High: 0, Medium: 1, Low: 2)
• ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.1@sha256:b525f8a04d7a299e5e68c9d774a98b25c50357e802303a6fe6810b52d7f4daca: 125 CVEs (Critical: 3, High: 13, Medium: 12, Low: 97)
  Critical CVEs: CVE-2025-58050, CVE-2026-31789
• ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.1@sha256:8eb820ac797ac7a2efe1bf99f2c548f3ef208d28ac5c97ee51d36ae3181b6040: 3 CVEs (Critical: 0, High: 0, Medium: 1, Low: 2)

⚠️ Please review the CVE findings above and address critical/high severity issues before merging.

[vishwanaths]

Pack review — tekton-pipelines-1.15.1

Packs Validation: ✅ passed (run https://github.com/spectrocloud/pack-central/actions/runs/31708967326/job/94476641828)
source annotation: ✅ community
Pack metadata: name=tekton-pipelines version=1.15.1 addonType=system app layer=addon displayName=Tekton Pipelines contributor=spectrocloud

Compared against packs/tekton-pipelines-1.14.0/

Version bump: patch/minor (1.14.0 → 1.15.1). This is the highest existing version on main.

Summary of differences

• pack.json: only .version changed (1.14.0 → 1.15.1). No changes to name, charts/kubeManifests, cloudTypes, addonType, layer, annotations, or constraints.
• values.yaml: image tags for the four Tekton components bumped v1.14.0 → v1.15.1 with new SHA digests (controller, events, resolvers, webhook). No new/removed top-level keys; namespace unchanged (tekton-pipelines).
• manifests/release.yaml: 1,593,005 B → 1,629,982 B (+36,977 B / +36.1 KiB / +2.3%). Standard upstream Tekton release.yaml refresh — 2,103 insertions / 1,036 deletions. pipeline.tekton.dev/release and version labels bumped from v1.14.0 to v1.15.1 throughout; no Kubernetes kind: additions or removals. Detailed CRD/RBAC/Deployment changes not manually inspected — content comes from the upstream Tekton release manifest.
• README.md: byte-identical to 1.14.0 (3,169 B). gh reports it as ADDED because it's a new path, not new content.
• logo.png: byte-identical to 1.14.0 (10,170 B). Same note as README.
• No files added or removed relative to 1.14.0.

pack.json diff

@@ -7,7 +7,7 @@
-    "version": "1.14.0",
+    "version": "1.15.1",
     "kubeManifests": [
     "manifests/release.yaml"    
     ],

values.yaml diff

@@ -1,8 +1,8 @@
 pack:
   content:
     images:
-      - image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.14.0@sha256:5209c1969c407d36d9c2c5217a8b0700a9fb52b3068b6fbdce0d88ead397ea75
-      - image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.14.0@sha256:7ccdab7772fc5aa74987b53a5246e5c6863a653d13484bf535a3a15d96e3cd21
-      - image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.14.0@sha256:7516b1750c7147fbe2e48e8d334acff74a02aad68696c9cf2f32a2790bc4dbf9
-      - image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.14.0@sha256:dab27b10a60e56cbeb444d84356835b145c3d8491a7afe77353b1b999eb3a867
+      - image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.1@sha256:89633d2774dab0497d30cb2ca73e7c2fff94687a38e2652c3c47075ac7890c40
+      - image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.1@sha256:a816daf2107b5c10dd17c14d125989d5d109f7d928aaf8c88b1c189c34846376
+      - image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.1@sha256:b525f8a04d7a299e5e68c9d774a98b25c50357e802303a6fe6810b52d7f4daca
+      - image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.1@sha256:8eb820ac797ac7a2efe1bf99f2c548f3ef208d28ac5c97ee51d36ae3181b6040
   namespace: "tekton-pipelines"

Blockers

• None.

Nits / observations

• Prior pack packs/tekton-pipelines-1.14.0/ was the immediate predecessor — a minor-version jump from 1.14.0 straight to 1.15.1 (skipping any 1.15.0 intermediate). Upstream Tekton Pipelines 1.15.0 did ship; if that's intentional (going directly to the latest patch of the new minor), no action needed — just flagging.
• pack.json uses inconsistent whitespace around JSON keys (e.g. "contributor" : "spectrocloud" has a space before the colon; other keys don't). Not a blocker; carried over from prior versions.
• The unrelated security-scans/syft-license check on the head SHA is FAILURE, but it's not the Packs Validation job and is out of scope for pack acceptance per this workflow.

Review generated by the pack-reviewer Claude Code subagent.