Merge branch 'main' into auto/issue-1957

Author: chmouel

.github/dependabot.yaml

@@ -11,6 +11,10 @@ updates:
       # (major go-github API changes), update them manually instead
       - dependency-name: "github.com/google/go-github/*"
       - dependency-name: "github.com/bradleyfalzon/ghinstallation/v2"
+      # otel is pinned to v1.44.0 until knative.dev/pkg supports semconv >= 1.43
+      # (its observability/semconv is hardcoded to 1.41.0; otel SDK >= 1.45
+      # defaults to 1.43.0 and resource.Merge panics at startup)
+      - dependency-name: "go.opentelemetry.io/otel*"
     groups:
       go-dependencies:
         patterns:

.github/skills/code-review/SKILL.md

@@ -0,0 +1 @@
+../../../.tekton/ai/REVIEW.md

.tekton/doc.yaml

@@ -7,10 +7,8 @@ metadata:
     pipelinesascode.tekton.dev/max-keep-runs: "2"
     pipelinesascode.tekton.dev/cancel-in-progress: "true"
     pipelinesascode.tekton.dev/on-cel-expression: |
-      event == "push" && (
-        (target_branch == "main" && "docs/***".pathChanged()) ||
-        target_branch.startsWith("refs/tags/")
-      ) ||
+      (event == "push" && ((target_branch == "main" && "docs/***".pathChanged()) || target_branch.startsWith("refs/tags/")))
+      ||
       (event == "pull_request" && "docs/***".pathChanged())
 spec:
   params:

config/302-pac-configmap.yaml

@@ -160,6 +160,27 @@ data:
   # Default: false
   require-ok-to-test-sha: "false"
 
+  # Enable retrying Git provider API requests when hitting rate limits (429,
+  # or 403 with rate limit headers on GitHub) or transient server errors.
+  # Retries use exponential backoff with jitter and honor the Retry-After and
+  # X-RateLimit-Reset headers, giving up when the reset is further away than
+  # api-retry-max-wait-seconds.
+  # When false, the GitLab client keeps the retry behaviour of the upstream
+  # GitLab Go client and the GitHub client does not retry.
+  # Default: false
+  enable-api-retry: "false"
+
+  # Maximum number of attempts (initial request included) when enable-api-retry
+  # is true. Values lower than 1 fall back to the default.
+  # Default: 4
+  api-retry-max-attempts: "4"
+
+  # Maximum time in seconds to wait between retries when enable-api-retry is
+  # true. If the provider rate limit reset is further away than this, the
+  # request fails instead of blocking.
+  # Default: 120
+  api-retry-max-wait-seconds: "120"
+
   # When enabled, this option prevents duplicate pipeline runs when a commit appears in
   # both a push event and a pull request. If a push event comes from a commit that is
   # part of an open pull request, the push event will be skipped as it would create

docs/content/docs/api/configmap.md

@@ -339,6 +339,72 @@ skip-push-event-for-pr-commits: "true"
 
 {{< /param >}}
 
+### API Retry
+
+{{< tech_preview "Provider API Retry for GitHub and GitLab" >}}
+
+{{< param name="enable-api-retry" type="boolean" default="false" id="param-enable-api-retry" >}}
+Enables retrying GitHub and GitLab API requests when Pipelines-as-Code
+encounters a temporary provider failure. This includes rate limits, temporary
+server errors, and selected network failures.
+
+Retries use backoff with jitter so multiple requests do not all retry at the
+same time. When the provider supplies a retry or reset time, Pipelines-as-Code
+uses that information as long as it does not exceed
+`api-retry-max-wait-seconds`.
+
+The setting is disabled by default. Enabling it affects API operations made
+while processing an event, including temporary clients and GitHub App setup.
+
+When disabled, the GitLab client keeps the retry behaviour built into the
+upstream GitLab Go client, and the GitHub client performs no retries.
+
+Pipelines-as-Code only repeats an operation when it can do so safely. It does
+not repeat provider changes after an uncertain network or server failure when
+doing so could create duplicate comments, statuses, or other mutations.
+
+```yaml
+enable-api-retry: "false"
+```
+
+{{< /param >}}
+
+{{< param name="api-retry-max-attempts" type="integer" default="4" id="param-api-retry-max-attempts" >}}
+Sets the maximum number of attempts when `enable-api-retry` is `true`. The
+initial request counts as the first attempt. For example, a value of `4`
+allows the initial request followed by up to three retries.
+
+```yaml
+api-retry-max-attempts: "4"
+```
+
+{{< /param >}}
+
+{{< param name="api-retry-max-wait-seconds" type="integer" default="120" id="param-api-retry-max-wait-seconds" >}}
+Sets the maximum time in seconds that Pipelines-as-Code waits between
+attempts. If a provider asks the client to wait longer than this value,
+Pipelines-as-Code stops retrying rather than holding the event for a long
+cooling period.
+
+```yaml
+api-retry-max-wait-seconds: "120"
+```
+
+{{< /param >}}
+
+#### Failure reporting and limitations
+
+If all attempts fail, Pipelines-as-Code reports the original provider error
+through its normal logs, events, and provider status handling. Reporting a
+failure status to GitHub or GitLab is best effort because a fully exhausted or
+unavailable provider API might also reject the status update.
+
+These settings are intended for short, temporary provider failures. They do
+not provide persistent queueing for long rate-limit windows and do not control
+how quickly a large backlog of PipelineRuns is admitted to the cluster.
+Long-duration queueing and workload admission should be handled separately at
+the pipeline or platform level.
+
 ## Complete Example
 
 ```yaml

docs/content/docs/guides/statuses.md

@@ -3,7 +3,7 @@ title: PipelineRun status
 weight: 7
 ---
 
-This page describes how Pipelines-as-Code reports PipelineRun status across different Git providers, including log snippets, error annotations, and notification options.
+This page describes how Pipelines-as-Code reports PipelineRun statuses across different Git providers, including log snippets, error annotations, and notification options.
 
 ## GitHub Apps
 

go.mod

@@ -5,18 +5,17 @@ go 1.26.5
 require (
 	codeberg.org/mvdkleijn/forgejo-sdk/forgejo/v3 v3.0.0
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/bradleyfalzon/ghinstallation/v2 v2.18.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.19.0
 	github.com/chzyer/readline v1.5.1
 	github.com/cloudevents/sdk-go/v2 v2.16.2
 	github.com/fvbommel/sortorder v1.1.0
 	github.com/gobwas/glob v0.2.3
-	github.com/google/cel-go v0.30.0
+	github.com/google/cel-go v0.31.0
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-github/scrape v0.0.0-20260420200030-5f0d5d00f436
-	github.com/google/go-github/v84 v84.0.0
-	github.com/google/go-github/v85 v85.0.0
+	github.com/google/go-github/scrape v0.0.0-20260808022349-848675fe0454
 	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b
-	github.com/jenkins-x/go-scm v1.15.32
+	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/jenkins-x/go-scm v1.15.36
 	github.com/jonboulle/clockwork v0.5.0
 	github.com/juju/ansiterm v1.0.0
 	github.com/ktrysmt/go-bitbucket v0.10.0
@@ -28,18 +27,19 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/tektoncd/pipeline v1.15.0
 	gitlab.com/gitlab-org/api/client-go v1.46.0
-	go.opentelemetry.io/otel v1.44.0
+	// otel is pinned via the replace block below, see the comment there.
+	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0
-	go.opentelemetry.io/otel/metric v1.44.0
-	go.opentelemetry.io/otel/sdk v1.44.0
+	go.opentelemetry.io/otel/metric v1.45.0
+	go.opentelemetry.io/otel/sdk v1.45.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
-	go.opentelemetry.io/otel/trace v1.44.0
+	go.opentelemetry.io/otel/trace v1.45.0
 	go.uber.org/zap v1.28.0
-	golang.org/x/exp v0.0.0-20260727155853-b88d891fe743
+	golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
-	golang.org/x/text v0.40.0
+	golang.org/x/text v0.41.0
 	gopkg.in/yaml.v2 v2.4.0
 	gotest.tools/v3 v3.5.2
 	k8s.io/api v0.36.3
@@ -51,6 +51,11 @@ require (
 	sigs.k8s.io/yaml v1.6.0
 )
 
+require (
+	github.com/google/go-github/v88 v88.0.0
+	github.com/google/go-github/v90 v90.0.0
+)
+
 require (
 	cel.dev/expr v0.25.2 // indirect
 	github.com/42wim/httpsig v1.2.4 // indirect
@@ -86,13 +91,13 @@ require (
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
 	go.opentelemetry.io/otel/exporters/prometheus v0.66.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
@@ -125,9 +130,8 @@ require (
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -148,18 +152,41 @@ require (
 	github.com/xlzd/gotp v0.1.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260729162451-8efbd57d26e0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260729162451-8efbd57d26e0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260810153831-ec0a7760b754
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260810153831-ec0a7760b754 // indirect
 	google.golang.org/grpc v1.83.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
+	google.golang.org/protobuf v1.36.12
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/apiextensions-apiserver v0.36.3 // indirect
 	k8s.io/klog/v2 v2.140.0
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 )
+
+// otel modules are pinned to v1.44.0 (and contrib to v0.69.0, the prometheus
+// exporter to v0.66.0): knative.dev/pkg observability/semconv is hardcoded to
+// semconv 1.41.0 while otel SDK >= 1.45.0 defaults to 1.43.0, making
+// resource.Merge fail and knative panic at startup with "conflicting Schema
+// URL". Using replace (not just require) so a manual `go get -u` can't
+// silently re-bump these. Remove once knative.dev/pkg catches up.
+replace (
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
+	go.opentelemetry.io/contrib/instrumentation/runtime => go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0
+	go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp => go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0
+	go.opentelemetry.io/otel/exporters/prometheus => go.opentelemetry.io/otel/exporters/prometheus v0.66.0
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace => go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0
+	go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v1.44.0
+	go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.44.0
+	go.opentelemetry.io/otel/sdk/metric => go.opentelemetry.io/otel/sdk/metric v1.44.0
+	go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v1.44.0
+)