Bump github.com/buildkite/go-pipeline from 0.4.1 to 0.11.0

[dependabot]

Bumps github.com/buildkite/go-pipeline from 0.4.1 to 0.11.0.

Release notes

Sourced from github.com/buildkite/go-pipeline's releases.

v0.11.0

Fixed

• Canonicalise empty env/plugins/matrix to nil for sign/verify by @​DrJosh9000 in buildkite/go-pipeline#45

Internal

• Bump github.com/lestrrat-go/jwx/v2 from 2.1.0 to 2.1.1 by @​dependabot in buildkite/go-pipeline#44
• Bump github.com/buildkite/interpolate from 0.1.2 to 0.1.3 by @​dependabot in buildkite/go-pipeline#43

Full Changelog: buildkite/go-pipeline@v0.10.0...v0.11.0

v0.10.0

v0.10.0 (2024-06-25)

Full Changelog

⚠️ This release has some breaking changes to the signature subpackage.

All the following functions now take as their first param a context.Context, as well as the following changes.

The signature of signature.Sign function has changed to no longer take env map[string]string but instead use signature.WithEnv(env) as an option.

-func Sign(key jwk.Key, env map[string]string, sf SignedFielder) (*pipeline.Signature, error)
+func Sign(_ context.Context, key jwk.Key, sf SignedFielder, opts ...Option) (*pipeline.Signature, error)

The signature of signature.Verify function has also changed to take signature.WithEnv(env) as an option instead of env map[string]string.

-func Verify(s *pipeline.Signature, keySet jwk.Set, env map[string]string, sf SignedFielder)
+func Verify(ctx context.Context, s *pipeline.Signature, keySet jwk.Set, sf SignedFielder, opts ...Option) error

The signature of signature.SignSteps function has also changed to take signature.WithEnv(env) as an option instead of env map[string]string.

-func SignSteps(s pipeline.Steps, key jwk.Key, env map[string]string, repoURL string)
+func SignSteps(ctx context.Context, s pipeline.Steps, key jwk.Key, repoURL string, opts ...Option) error

Added

The following were added to the signature subpackage.

func WithEnv(env map[string]string) Option
func WithLogger(logger Logger) Option
func WithDebugSigning(debugSigning bool) Option

• WithLogger enables logging public key thumbprints when signing and verifying steps
• WithDebugSigning will enable debugging for signing steps. When this is enabled, along with WithLogger, will log step payloads before they are signed to assist in debugging verification failures
  • This is intended for development purposes

... (truncated)

Commits

• 3d59172 Merge pull request #43 from buildkite/dependabot/go_modules/github.com/buildk...
• bc8d0e2 Merge pull request #44 from buildkite/dependabot/go_modules/github.com/lestrr...
• c1c7160 Merge pull request #45 from buildkite/canonicalise-empty-to-nil
• efe47dd Canonicalise empty env/plugins/matrix to nil for sign/verify
• a02b84a Bump github.com/lestrrat-go/jwx/v2 from 2.1.0 to 2.1.1
• f1551aa Bump github.com/buildkite/interpolate from 0.1.2 to 0.1.3
• 5e62e6c Merge pull request #42 from buildkite/josh-cleanups
• 81faeec Delete SignPipeline
• 3b5a1f4 Merge pull request #41 from buildkite/josh-cleanups
• 2e6f3cb Replace mock logger with fake logger
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

A newer version of github.com/buildkite/go-pipeline exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[mcncl]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.