chore(deps): bump github.com/openshift-pipelines/pipelines-as-code from 0.45.0 to 0.46.0

[dependabot]

Bumps github.com/openshift-pipelines/pipelines-as-code from 0.45.0 to 0.46.0.

Release notes

Sourced from github.com/openshift-pipelines/pipelines-as-code's releases.

v0.46.0

Pipelines as Code version v0.46.0

OpenShift Pipelines as Code v0.46.0 has been released 🥳

✨ Major changes and Features

• Distributed tracing for webhook handling and PipelineRun timing: When tracing is enabled via the pipelines-as-code-config-observability ConfigMap, PaC emits OpenTelemetry trace spans for webhook event processing and PipelineRun lifecycle timing, with W3C trace context propagation.
  • Link: tektoncd/pipelines-as-code#2605
• Implement GetCommitStatuses on Forgejo: The Forgejo/Gitea provider now returns real commit statuses instead of nil, enabling the annotation matcher to correctly detect pruned-but-successful pipeline runs so /retest only re-runs failed pipelines.
  • Link: tektoncd/pipelines-as-code#2659
• Enable recursive .tekton dir retrieval for Forgejo: PipelineRuns nested in subdirectories under .tekton/ are now discovered and executed on Forgejo, instead of only top-level entries.
  • Link: tektoncd/pipelines-as-code#2694
• Handle Forgejo headers in CLI provider auto-detection: The tkn pac cel command now recognizes X-Forgejo-Event-Type headers for automatic Forgejo webhook provider detection.
  • Link: tektoncd/pipelines-as-code#2700
• Reduce informer cache memory usage: Added TransformFuncs to Repository and PipelineRun informers that strip large unnecessary fields (ManagedFields, Annotations, Status, Spec) before objects enter the cache.
  • Link: tektoncd/pipelines-as-code#2667
• Cache check-run lookups with retry: GitHub check-run API responses are now cached to avoid repeated paginated API calls during status updates, with concurrent goroutines sharing a single in-flight fetch.
  • Link: tektoncd/pipelines-as-code#2669

🐛 Bug Fixes

• Fix /ok-to-test not triggering CI on GitHub webhook PRs: The GitHub client was never initialized for webhook-based issue comment events, causing /ok-to-test from an admin to silently fail on unauthorized PRs.
  • Link: tektoncd/pipelines-as-code#2682
• Clear pending check on ok-to-test for GitHub webhook: The pending check run created for unauthorized PRs was never resolved after an admin commented /ok-to-test, leaving it stuck indefinitely.
  • Link: tektoncd/pipelines-as-code#2706
• Update /ok-to-test status to success for GitLab: Similar to Forgejo, GitLab now updates the "pending approval" commit status to success after /ok-to-test is posted on an unauthorized user's MR.
  • Link: tektoncd/pipelines-as-code#2642
• Pin GitLab commit statuses to the same pipeline: Caches the pipeline_id from the first SetCommitStatus response so all subsequent status updates for the same SHA stay on the same GitLab pipeline, preventing split statuses.
  • Link: tektoncd/pipelines-as-code#2671
• Map GitLab skipped status correctly: Use gitlab.Skipped state instead of gitlab.Canceled when the conclusion is skipped, so GitLab pipelines show the correct skipped status.
  • Link: tektoncd/pipelines-as-code#2676
• Restrict same-repo ACL permission to trusted context: Issue comment senders are no longer granted trust based solely on same-repo PR shape; they must pass collaborator, org-membership, or OWNERS checks.
  • Link: tektoncd/pipelines-as-code#2665
• Guard nil response and cap comment pagination in ACL checks: Prevents a panic when wrapAPI returns a nil response on transport-level failures, and caps comment pagination to avoid unbounded API calls.
  • Link: tektoncd/pipelines-as-code#2663
• Prevent duplicate Repository CR on trailing slash: The webhook admission controller now normalizes URLs before comparison, preventing bypass of uniqueness validation by appending a trailing slash.
  • Link: tektoncd/pipelines-as-code#2683
• Use provided target ref in GetFileInsideRepo: Fixed GetFileInsideRepo ignoring the caller-supplied target ref and substituting runevent.BaseBranch, which caused OWNERS ACL and remote task fetches to resolve against the wrong branch.
  • Link: tektoncd/pipelines-as-code#2696
• Resolve CEL expression failure on Bitbucket Cloud push events: Push events incorrectly set Event to a string instead of a JSON object, causing all CEL expressions to fail with an unmarshal error.
  • Link: tektoncd/pipelines-as-code#2704
• Truncate Bitbucket Cloud commit status key to 40-char limit: Bitbucket Cloud limits commit status keys to 40 characters; status keys are now properly truncated.
  • Link: tektoncd/pipelines-as-code#2702
• Use pull request number from issue comment payload: Use the PR number directly from the issue comment payload instead of parsing it from the pull request URL.
  • Link: tektoncd/pipelines-as-code#2711
• Fix skip-install option in bootstrap command: The bootstrap process now correctly allows users to bypass the installation check, preventing failures when Pipelines as Code is already installed.
  • Link: tektoncd/pipelines-as-code#2709

📚 Documentation Updates

... (truncated)

Commits

• 74b0d28 fix(github-webhook): clear pending check on ok-to-test
• eda5331 fix(bitbucket-cloud): fix status key handling for build statuses
• c37a213 fix: Use pull request number from issue comment payload
• baf49e3 dep: update go-github dependency
• b0bcbac fix(gitlab): pin commit statuses to same pipeline
• e951778 fix: fix skip-install option to bootstrap command
• 0948d88 docs: note about e2e permission in bb cloud docs
• 357d970 Revert "chore: Use GHE fro github enterprise instead of second"
• 88e8d39 chore: Use GHE fro github enterprise instead of second
• 7c46558 perf(github): cache check-run lookups with retry
• Additional commits viewable in compare view

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/tektoncd/operator/pkg/apis/operator/v1alpha1	36.29% (ø)

---

Coverage by file

Changed unit test files

• github.com/tektoncd/operator/pkg/apis/operator/v1alpha1/openshiftpipelinesascode_defaults_test.go

[anithapriyanatarajan]

/lgtm

[anithapriyanatarajan]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anithapriyanatarajan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anithapriyanatarajan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment