Buildkite Agent: baixar versions anteriors

What's Changed

🐛 Fixed
- Report the terminating signal instead of exit status -1 in hook and command status records by @wolfeidau in #4563
- Allow Kubernetes jobs with only the Kubernetes plugin to run when plugins are disabled by @pujitha24 in #4528
- Remove outdated availability notices from buildkite-agent cache save and cache restore help by @buildkate in #4564

New Contributors
- @pujitha24 made their first contribution in #4528

What's Changed

✨ Added
- Add the program-status experiment to show program status in job logs and report job and upload progress by @wolfeidau in #4534

🔧 Changed
- Upgrade to Go 1.27.3: macOS binaries now require macOS 13 or later; big-endian Linux ppc64 binaries require ELFv2 support (kernel 3.13 or a compatible backport). ppc64le is unaffected by @isaacsu in #4559

🏠 Internal
- Check cancellation results in integration tests by @isaacsu in #4558
- Dependency updates by @dependabot[bot] in #4557

Important security update
Upgrade to v4.7.0 promptly. This release addresses compromised eMudhra certificate chains (CVE-2026-111943) by building the agent with Go 1.26.10, which rejects the affected chains, including alternate cross-signed paths.
Installing the updated agent is required to receive this protection. It doesn't update OS, container or custom trust stores, or protect external tools run by jobs; remediate those separately.

What's Changed

🔒 Security
- Reject compromised eMudhra certificate chains (CVE-2026-111943) by building with Go 1.26.10 by @duckalini in #4550
- Prevent artifact downloads escaping their destination through directory symlinks by @isaacsu in #4541
- Add opt-in --git-commit-verification=fail-closed to reject checkouts when commit verification can't succeed by @dahtey-bk in #4530
- Protect GIT_ALLOW_PROTOCOL when --protect-dangerous-git-environment-variables is enabled and list the protected variables in help by @moskyb in #4527

🐛 Fixed
- Redact secrets containing apostrophes in buildkite-agent secret get --format env output in build logs by @isaacsu in #4531
- Honour the agent's BUILDKITE_CAPTURE_AGENT_ERRORS setting when it's protected from job overrides by @123sarahj123 in #4524

🔧 Changed
- Show the cache command in buildkite-agent --help by @ss1909 in #4482

🏠 Internal
- Replace deprecated HTTP/2 transport configuration by @isaacsu in #4542
- Add a pipeline to close stale issues and PRs by @moskyb in #4544
- Run stale issue and PR cleanup on elastic runners by @moskyb in #4546
- Dependency updates by @dependabot[bot] in #4536, #4535, #4419, #4537, #4447, #4545, #4504, #4505, #4540 and #4416

New Contributors
- @dahtey-bk made their first contribution in #4530

What's Changed

🔒 Security
- Stop running Git hooks from shared mirrors when git-mirrors-path is set, so anyone who can write to a mirror can't run code in the next job that updates it. Hooks put in a mirror on purpose no longer run by @isaacsu in #4501

✨ Added
Job errors are an experimental feature that's only enabled for Buildkite's own pipelines. It isn't available to other organizations, and it may change or be removed.
- Report failed local Git commands in the default checkout as job errors when a step sets BUILDKITE_CAPTURE_GIT_ERRORS: "true" by @pinzonjulian in #4486
- Report failed Git fetches and clones as job errors, with codes for missing refs, rejected credentials and network failures by @pinzonjulian in #4487
- Report checkout failures outside Git commands as job errors, such as checkout and lock timeouts, invalid refs and a missing git-lfs by @pinzonjulian in #4488
- Add the experimental BUILDKITE_CAPTURE_AGENT_ERRORS opt-in for reporting failures the agent observes as job errors, and warn when the experimental buildkite-agent job capture-error is given a code starting with the reserved buildkite. prefix by @pinzonjulian in #4464
- Report failed hooks as job errors, with the end of their output by @pinzonjulian in #4469
- Report failed commands as job errors, with the end of their output by @pinzonjulian in #4470
- Report secret and plugin failures as job errors by @pinzonjulian in #4471
- Report failed pipeline uploads, secret and OIDC token requests, and Git credential lookups as job errors by @pinzonjulian in #4472
- Report failed artifact uploads and downloads, and cache saves and restores, as job errors by @pinzonjulian in #4473
- Report why the agent refused a job as a job error, such as a signature that doesn't verify or a value an allowlist refuses, and report Kubernetes containers that never connect or are lost by @pinzonjulian in #4474

🐛 Fixed
- Correct the --cancel-cleanup-timeout help text: it gives a stopping agent time to upload the job log, not artifacts by @scadu in #4514

🔧 Changed
- Stop sending experimental buildkite-agent job capture-error reports for a job once Buildkite refuses one because the job's error quota is full or error capture isn't available by @123sarahj123 in #4497

🏠 Internal
- Treat breaking experimental surface as a minor release change by @moskyb in #4517

What's Changed

🔒 Security
- Add --protected-environment-variables and --protect-dangerous-git-environment-variables to stop jobs from setting chosen environment variables, such as GIT_SSH_COMMAND by @moskyb in #4503
- Check out plugins pinned to a full commit SHA at that commit, even when a branch has the same name by @jasonwbarnett in #4458
- Apply plugin and repository allowlists to job environment variables regardless of case on Windows, and refuse jobs with names that only differ by case by @moskyb in #4498
- Mask URL credentials and query strings in errors captured with buildkite-agent job capture-error by @pinzonjulian in #4485

🐛 Fixed
- Always download buildkite-agent cache restore archives inside the restore's temporary directory by @jamiemonserrate in #4440
- Check the repository against --allowed-repositories before checkout starts by @jamiemonserrate in #4439
- Fix fetching branches with quotes in their names when BUILDKITE_COMMIT is HEAD by @isaacsu in #4512
- Build the branch rather than a tag with the same name when BUILDKITE_COMMIT is HEAD by @isaacsu in #4513

🔧 Changed
- Remove --context from buildkite-agent job capture-error; put all important details in --message instead by @pinzonjulian in #4478
- Truncate messages captured with buildkite-agent job capture-error to 1,000 characters by @123sarahj123 in #4465

🏠 Internal
- Tell robot reviewers how to check release PRs by @moskyb in #4461
- Tell agents how to label PRs by @moskyb in #4499
- Dependency updates by @dependabot[bot] in #4506 and #4510

New Contributors
- @pinzonjulian made their first contribution in #4478

What's Changed

🐛 Fixed
- Stop leaking BUILDKITE_JOB_LOG_TMPFILE between jobs when enable-job-log-tmpfile is set and the agent runs with --spawn by @isaacsu in #4484
- Treat Windows paths such as C:\tools\runner.exe as absolute when resolving commands by @tomowatt in #4382

🔧 Changed
- Redact Buildkite tokens by prefix in errors reported by the experimental buildkite-agent job capture-error by @123sarahj123 in #4468
- Show the buildkite-agent cache exec restore report inside the replay or run group, instead of in a separate group by @ss1909 in #4483
- Explain how to fix buildkite-agent cache save and cache restore on hosted agents when they run inside a Docker plugin container by @buildkate in #4492

🏠 Internal
- Remove repository docs that duplicate the public docs site by @zhming0 in #4467
- Move Git LFS fetch and checkout helpers into git_lfs.go by @zhming0 in #4493
- Move finishMirrorUpdate into checkout_mirror.go by @zhming0 in #4494

What's Changed

✨ Added
- Add --git-mirrors-lfs-cache (off by default) to cache Git LFS objects in Git mirrors, so checkouts on the same host don't download them again by @zhming0 in #4408

🐛 Fixed
- Stop cache invalidation from deleting a cache entry that another job has just saved again by @ss1909 in #4442

🔧 Changed
- Title replayed output "Cache exec saved" instead of "Cache hit saved" when buildkite-agent cache exec skips a command by @ss1909 in #4462
- Skip the upload in buildkite-agent cache save when the cache store already has an identical archive by @buildkate in #4463

🏠 Internal
- Speed up release jobs by building the release tools image once per build by @moskyb in #4457

What's Changed

✨ Added
- Show warnings sent by Buildkite, such as agent version support notices, at startup and in job logs by @moskyb in #4452
- Add buildkite-agent cache exec to skip a command when its result is already cached by @ss1909 in #4436

🐛 Fixed
- Run repository hooks from the job's working directory, so monorepos can keep hooks in subdirectories by @jamiemonserrate in #4441

🏠 Internal
- Stop publishing releases from the 2022 deploytools image by @moskyb in #4454
- Fix copying release binaries to /latest after the move to aws-cli v2 by @moskyb in #4456

What's Changed

✨ Added
- Add --git-fetch-base-branch (BUILDKITE_GIT_FETCH_BASE_BRANCH) to fetch the base branch during checkout, so commands in the job diff against its current tip by @jasonwbarnett in #4285

🏠 Internal
- Dependency updates by @dependabot[bot] in #4444 and #4450
- Trigger agent overlay images from stable releases by @buildkate in #4443

New Contributors
- @jasonwbarnett made their first contribution in #4285

What's Changed

🐛 Fixed
- Fix intermittent Windows crashes caused by process handles being closed twice by @moskyb in #4432

🔧 Changed
- Report cache save and restore timings and sizes to Buildkite when buildkite-agent cache save and buildkite-agent cache restore complete by @buildkate in #4434
- Add buildkite.commit, buildkite.pull_request and buildkite.build_author tracing attributes to job spans and OpenTelemetry resource attributes by @silesky in #4435

🏠 Internal
- Source release notes from release PR description by @moskyb in #4429
- Check backports against the v3 backport policy by @moskyb in #4433

New Contributors
- @silesky made their first contribution in #4435

What's Changed

🔒 Security
- A-1975: Redact Buildkite tokens by prefix in job logs by @zhming0 in #4425

🐛 Fixed
- A-1915: Close the job log tmpfile once the job is done, not when the process exits by @zhming0 in #4422

🏠 Internal
- Make the release skill use semver more effectively by @moskyb in #4428

What's Changed

🔒 Security
- Bump go-pipeline to v0.18.1 by @blaknite in #4413

🐛 Fixed
- Redact captured job errors using the job’s registered secrets by @123sarahj123 in #4409
- Fix agent API leader ping leak with runaway file descriptors by @valkum in #4411

🔧 Changed
- Enable capture-error without an experiment flag by @hannahcancode in #4423

🏠 Internal
- build(deps): bump github.com/urfave/cli/v3 from 3.12.0 to 3.13.0 by @dependabot[bot] in #4414
- build(deps): bump cloud.google.com/go/compute/metadata from 0.9.1 to 0.10.0 by @dependabot[bot] in #4418
- build(deps): bump cloud.google.com/go/kms from 1.34.0 to 1.35.0 by @dependabot[bot] in #4417

New Contributors
- @valkum made their first contribution in #4411

What's Changed

✨ Added
- Show cache restore keys, scopes, and policy outcomes in build logs by @ss1909 in #4401
- Support provider-specific Git usernames for repository credentials by @sj26 in #4376

🐛 Fixed
- Preserve Linux mount points during cache restore by @ss1909 in #4404
- Explain cache cleanup failures on shared targets by @ss1909 in #4405

🏠 Internal
- A-1899: add regression tests for annotation body whitespace preservation by @zhming0 in #4407

What's Changed

🐛 Fixed
- A-1869: Mask username-only Git tokens in logs and spans by @zhming0 in #4400

🏠 Internal
- Add experimental job error capture by @hannahcancode in #4399

What's Changed

🐛 Fixed
- SUP-8144: Fix Windows SSH key path corruption in GIT_SSH_COMMAND by @tomowatt in #4381
- fix(cache): regenerate ZIP64 metadata when copying entries by @blaknite in #4377

🏠 Internal
- Show promise-failure in job help by @123sarahj123 in #4387
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #4388
- build(deps): bump github.com/urfave/cli/v3 from 3.11.0 to 3.12.0 by @dependabot[bot] in #4398
- build(deps): bump cloud.google.com/go/kms from 1.33.0 to 1.34.0 by @dependabot[bot] in #4396
- build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 by @dependabot[bot] in #4397
- build(deps): bump connectrpc.com/connect from 1.20.0 to 1.21.0 by @dependabot[bot] in #4369
- build(deps): bump cloud.google.com/go/compute/metadata from 0.9.0 to 0.9.1 by @dependabot[bot] in #4395
- Fix hidden subcommands appearing in help by @hannahcancode in #4386
- Guide AI agents to use private repository for staff docs PRs by @karensawrey in #4353

New Contributors
- @hannahcancode made their first contribution in #4386

What's Changed

🐛 Fixed
- Resolve relative submodule URLs for mirrors by @davido in #4287
- Avoid blob filtering sparse reference-mirror checkouts by @maschwenk in #4358
- Avoid SSH version warnings when SSH is not installed by @buildkate in #4379
- Set last hook exit status for unwrapped hooks by @francoiscampbell in #4286

🏠 Internal
- Remove the agent xgboost metadata experiment by @pda in #4357
- build(deps): bump the container-images group across 2 directories with 1 update by @dependabot[bot] in #4361
- build(deps): bump github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0 by @dependabot[bot] in #4368
- build(deps): bump the cloud-providers group with 10 updates by @dependabot[bot] in #4367

New Contributors
- @davido made their first contribution in #4287
- @maschwenk made their first contribution in #4358

What's Changed

🐛 Fixed
- Exit 27 when registration rejects an unacquirable job by @swebb in #4355

🔧 Changed
- Make cache save/restore fail-open by default by @ss1909 in #4340

What's Changed

✨ Added
- feat: add force option to cache save by @blaknite in #4346
- Add experimental Origin CloneKit mirror seeding by @lox in #4327

🐛 Fixed
- Skip blob retention refresh on a fallback restore by @ss1909 in #4321
- Confirm a restore with the server once its blob is verified by @ss1909 in #4323
- Avoid partial clones for Kubernetes sparse checkouts by @buildkate in #4348

🔧 Changed
- Update job log size warning by @JuanitoFatas in #4312
- Replace support contact by @ellsclytn in #4319
- Honor the server's configured cache retention for backing blobs by @ss1909 in #4339

🏠 Internal
- docs: fix 7 typos in comments and documentation by @Avicennasis in #4318
- Run windows tests on hosted compute + macOS tests in CI by @moskyb in #4322
- Add docs section to PR template for docs bot to consume by @omehegan in #4324
- Condense docs bot PR template addition by @omehegan in #4326
- Prepare fresh Amp orbs for development by @lox in #4332
- build(deps): bump the cloud-providers group across 1 directory with 12 updates by @dependabot[bot] in #4302
- Automatically merge approved Dependabot updates by @buildkate in #4338
- build(deps): bump the container-images group across 2 directories with 1 update by @dependabot[bot] in #4342
- build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 by @dependabot[bot] in #4341
- PR template should not include needless check boxes by @omehegan in #4349

New Contributors
- @ellsclytn made their first contribution in #4319
- @Avicennasis made their first contribution in #4318
- @blaknite made their first contribution in #4346

What's Changed

🐛 Fixed
- Allow multipart artifact uploads above 5 GiB by @buildkate in #4292
- Avoid retaining hook file handles during type detection by @scadu in #4294

🏠 Internal
- build(deps): bump github.com/urfave/cli/v3 from 3.10.1 to 3.11.0 by @dependabot[bot] in #4262
- build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 by @dependabot[bot] in #4263
- build(deps): bump the container-images group across 4 directories with 2 updates by @dependabot[bot] in #4296
- build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 in the golang-x group across 1 directory by @dependabot[bot] in #4245
- Retry flaky Windows test jobs automatically by @buildkate in #4310
- build(deps): bump the container-images group across 1 directory with 3 updates by @dependabot[bot] in #4264
- build(deps): bump the otel group across 1 directory with 17 updates by @dependabot[bot] in #4295
- Fix lint after golangci-lint upgrade by @buildkate in #4314
- build(deps): bump github.com/gofrs/flock from 0.13.0 to 0.13.1 by @dependabot[bot] in #4297

Buildkite Agent v4.0.0
Buildkite Agent v4 is now stable. Most features and fixes developed since v3 and v4 diverged were backported to v3, so this changelog focuses on behaviour that differs from v3.
Review the v3 to v4 upgrade guide before upgrading.

Breaking changes

Job handling
- Removed the deprecated built-in Docker integration. The docker and docker-compose plugins remain supported.
- Cancelled Windows jobs now return exit status 1 instead of 0.
- Replaced cancel-grace-period and signal-grace-period-seconds with cancel-signal-timeout and cancel-cleanup-timeout, defaulting to 10 and 5 seconds respectively.

Job logs
The agent now always emits ANSI timestamp codes. Plaintext timestamps and the option to disable ANSI timestamps have been removed.

Checkout
- BUILDKITE_COMMIT is resolved to a commit hash after checkout.
- Replaced built-in SSH key scanning and known-hosts management with OpenSSH host-key-checking options.
- Git commit verification now defaults to strict and accepts only strict or off. Replace previous empty or warn values before upgrading.

Agent parallelism
spawn-with-priority now accepts static, ascending, or descending. Boolean values are no longer accepted.

Observability
- Removed OpenTracing, direct DogStatsD support, and Datadog-specific tracing workarounds. Use OpenTelemetry instead.
- Renamed tracing-service-name to telemetry-service-name.
- Trace-parent propagation is now always enabled.
- Replaced jobs.success and jobs.failed with jobs.finished.
- Replaced jobs.duration.success and jobs.duration.error with jobs.duration.
- Use the exit_code attribute to distinguish successful and failed jobs.
- The standard Prometheus job metrics now include priority and queue labels, replacing the separate _with_labels_total metrics.

Pipeline uploads
- Pipeline uploads now reject interpolated secrets by default. Use allow-secrets to permit them.
- Secret detection now includes trigger-step build.env values.

Artifacts
- Windows artifact paths are now stored with / separators.
- Removed artifact upload --follow-symlinks; use -glob-resolve-follow-symlinks.
- Artifact downloads now unconditionally prevent path traversal.

Plugins and hooks
- Removed deprecated plugin configuration environment-variable aliases that collapsed consecutive underscores.
- post-checkout, post-command, and pre-exit hooks now run in reverse setup order: plugins last-to-first, repository, then agent.
- Enable the legacy-post-hook-order experiment to temporarily restore v3 ordering.

Command behaviour
- oidc request-token now exits with status 77 for definitive API refusals using HTTP status 400, 401, 403, 404, 410, or 422. Other failures continue to exit with status 1.
Several deprecated flags, environment variables, configuration aliases, and experiments have also been removed. Consult the upgrade guide for their replacements.

Other changes
- Added Linux systemd watchdog support based on successful Buildkite heartbeat activity.
- Added an Ubuntu 26.04 agent Docker image.

New Contributors
- @JoeColeman95 made their first contribution in #4232
- @Temikus made their first contribution in #4239

What's Changed

🐛 Fixed
- [Backport] [A-1755] Die cleanly when heartbeats fail by @moskyb in #4274
- [Backport] [A-1756] Apply request headers from streaming pings by @moskyb in #4275

🏠 Internal
- [Backport] Replace bk-cli-backed pipeline test with agent e2e tests by @ss1909 in #4277

What's Changed

🐛 Fixed
- [Backport] Describe and retry undecodable API responses by @DrJosh9000 in #4242
- [Backport] PS-2073: Validate GitHub pull request merge heads by @SorchaAbel in #4253
- fix (Backport): Clarify error when GitHub PR merge refspec fetch fails by @ss1909 in #4255

🏠 Internal
- build(deps): bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go from 1.36.11-20260709200747-435963d16310.1 to 1.36.12-20260709200747-435963d16310.1 by @dependabot[bot] in #4236
- build(deps): bump the cloud-providers group with 2 updates by @dependabot[bot] in #4235

What's Changed

✨ Added
- PB-2693: Use remote Git mirrors for pull request head builds (v3 backport) by @zhming0 in #4229

🏠 Internal
- build(deps): bump the cloud-providers group with 10 updates by @dependabot[bot] in #4225
- build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in #4226
- build(deps): bump ruby from d9a5d26 to c400c1e in /.buildkite in the container-images group across 1 directory by @dependabot[bot] in #4221
- build(deps): bump the otel group across 1 directory with 13 updates by @dependabot[bot] in #4222

What's Changed

🔧 Changed
- feat(cache): namespace archive entries by anchor via a manifest (backport to v3) by @ss1909 in #4200
- A-1494: Verify cache checksum on restore (backport to v3) by @ss1909 in #4195

What's Changed

✨ Added
- A-1641: Consume control-plane OTLP exporter configuration from registration by @lox in #4165

🐛 Fixed
- fix: Skip post-fetch mirror scan without URL by @pda in #4172
- fix: Backport #4179 warm mirror hit fix to v3 and release v3.136.2 by @pda in #4186

🏠 Internal
- fix: Restore local mirror warm-hit performance by @pda in #4171
- [Backport] e2e tests: Include job logs in agent logs by @DrJosh9000 in #4177
- build(deps): bump the cloud-providers group with 10 updates by @dependabot[bot] in #4184
- Allow releases from diverged v3 history by @pda in #4188

What's Changed

✨ Added
- A-1641: Consume control-plane OTLP exporter configuration from registration by @lox in #4165

🏠 Internal
- fix: Restore local mirror warm-hit performance by @pda in #4171

What's Changed

✨ Added
- feat: add non-cone mode support for sparse checkout by @lox in #4127
- Document step parallelism updates by @catkins in #3941
- A-1547: Add --job-context-dir to configure job coordination file locations by @zhming0 in #4142
- Add provider-neutral repository access credentials by @pda in #4152
- feat: Populate on-host mirrors from remote mirrors by @pda in #4161
- feat: Refresh reused checkouts from remote mirrors by @pda in #4162
- feat: Clone fresh checkouts from remote mirrors by @pda in #4163

🐛 Fixed
- Fix commit verification with non-default branches by @petetomasik in #4094
- A-1553: Restore OTel job attributes as resource attributes by @zhming0 in #4137

🔧 Changed
- SUP-6153: Warn instead of comment when submodule init is skipped for sparse checkout by @lizrabuya in #4143
- Honour cone mode on git older than 2.35 by @lox in #4130

🏠 Internal
- Add development environment setup instructions by @lox in #4129
- Upgrade to Go 1.26.5 by @DrJosh9000 in #4134
- build(deps): bump github.com/DataDog/dd-trace-go/v2 from 2.7.1 to 2.8.1 by @dependabot[bot] in #4136
- build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #4135
- Upgrade go-pipeline to v0.18.0, jwx to v3.2.0 by @DrJosh9000 in #4139
- Fix flaky TestIsStdinIsReadableWithAPipe by draining stdin in the test helper by @claude[bot] in #4140
- docs: Requirements and delivery plan for remote Git mirrors by @pda in #4158
- Bound Cmd.Wait so a leaked stdout/stderr pipe can't hang hooks by @claude[bot] in #4141
- feat: Add remote Git mirror foundations by @pda in #4160
- build(deps): bump the cloud-providers group with 11 updates by @dependabot[bot] in #4167
- ci: Update Test Engine client to v3 by @meghan-kradolfer in #4168

New Contributors
- @claude[bot] made their first contribution in #4140
- @meghan-kradolfer made their first contribution in #4168

What's Changed

✨ Added
- [A-1511] Add OTel spans for repo-checkout git operations by @isaacsu in #4098
- A-1591: Add OTLP job log export by @zhming0 in #4121

🔧 Changed
- fix(cache): support array and glob syntax for checksum by @ss1909 in #4101

🏠 Internal
- [A-1511] Refactor refspec classification in fetchSource by @isaacsu in #4117
- build(deps): bump google.golang.org/api from 0.289.0 to 0.290.0 in the cloud-providers group by @dependabot[bot] in #4122
- build(deps): bump ruby from 32f8add to d9a5d26 in /.buildkite in the container-images group across 1 directory by @dependabot[bot] in #4126
- build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 by @dependabot[bot] in #4123
- build(deps): bump the container-images group across 3 directories with 1 update by @dependabot[bot] in #4125
- build(deps): bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 by @dependabot[bot] in #4124

What's Changed

✨ Added
- Add checkout-override-mode option by @petetomasik in #4010

🐛 Fixed
- Fix unknown Kubernetes container exit statuses by @jamiemonserrate in #4115

🔧 Changed
- Nice the command subprocess so k8s boostrap can't be starved of CPU by @omehegan in #4100

🏠 Internal
- Add no-checkout-override flag by @scadu in #3859
- Add skip checkout tests for no-checkout-override by @petetomasik in #3906
- Dedupe needles in replacer using map by @DrJosh9000 in #4113
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #4103
- build(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 by @dependabot[bot] in #4106
- build(deps): bump cloud.google.com/go/kms from 1.31.0 to 1.32.0 by @dependabot[bot] in #4108
- build(deps): bump the container-images group across 1 directory with 2 updates by @dependabot[bot] in #4104
- build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bot] in #4107
- build(deps): bump the cloud-providers group across 1 directory with 11 updates by @dependabot[bot] in #4114
- [A-1511] Extract updateGitSubmodules into its own method by @isaacsu in #4111

What's Changed

🐛 Fixed
- fix(api): classify http2 client connection lost as retriable by @zhming0 in #4110

🔧 Changed
- [A-1511] Redact repo URL credentials in repo-checkout OTel span by @isaacsu in #4099

🏠 Internal
- A-1542: Rename cache_key fallbackLimit to fallback_limit by @zhming0 in #4096
- [A-1511] Split internal/job/checkout.go into multiple files by @isaacsu in #4109

What's Changed

🔒 Security
- [A-1469] Re-exec agent start to hide the registration token from proc inspection by @moskyb in #4046
- Redact Go-escaped needles by @DrJosh9000 in #4091

✨ Added
- Set Partial Clone flags on sparse-checkout by @lizrabuya in #4044

🐛 Fixed
- [A-1515] Improve job log URL and deduplicate url computation by @isaacsu in #4083

🏠 Internal
- fix: check for --ensure_minimum when refreshExpiry by @ss1909 in #4085
- fix: remove archiveInfo.ArchivePath after upload by @ss1909 in #4086
- fix: Map expired artifact to ErrBlobNotFound by @ss1909 in #4087
- Suggestions for #4044 by @isaacsu in #4067
- Bump gh cli in release script to 2.96.0 by @DrJosh9000 in #4077
- Improve log URL to point to specific job by @mitchhentgesspotify in #4076
- build(deps): dependency bumps by @dependabot[bot] in #4078, #4079, #4080, #4081, #4082
- Constant-time token comparison by @DrJosh9000 in #4084
- Add TestSecretsIntegration_ConfigVarSecretNotLoggedByEnvChange by @DrJosh9000 in #4092
- Reduce Windows flakes in TestSetMetaDataBatch? by @DrJosh9000 in #4093

New Contributors
- @mitchhentgesspotify made their first contribution in #4076

What's Changed

✨ Added
- Add BUILDKITE_GCS_PATH_SUFFIX to append a suffix to GCS artifact URLs by @tomowatt in #4039

🏠 Internal
- A-1474: Remove --organization, --pipeline, --branch flags from cache subcommand by @zhming0 in #4051
- build(deps): bump the cloud-providers group across 1 directory with 11 updates by @dependabot[bot] in #4059
- build(deps): bump the container-images group across 1 directory with 2 updates by @dependabot[bot] in #4058
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #4057
- build(deps): bump github.com/lestrrat-go/jwx/v2 from 2.1.6 to 2.1.7 by @dependabot[bot] in #4055
- build(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 by @dependabot[bot] in #4054
- build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot[bot] in #4053
- build(deps): bump the container-images group across 3 directories with 1 update by @dependabot[bot] in #4062
- build(deps): bump github.com/DataDog/datadog-go/v5 from 5.8.3 to 5.9.0 by @dependabot[bot] in #4033
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #4063
- A-1437: TTL refresh on hosted cache object by @zhming0 in #4073
- feat: implement cache busting mechanism (part 2/2) by @ss1909 in #4061

What's Changed

🐛 Fixed
- PS-2124: GCS artifact upload to bucket root no longer uses a leading-slash key by @tomowatt in #4032
- Gate GIT_LFS_SKIP_SMUDGE on git-lfs-enabled flag by @petetomasik in #4042
- fix: let k8s command containers override BUILDKITE_SHELL/HOOKS_SHELL via podSpec env, falling back to the agent's value when unset by @ss1909 in #4047

🔧 Changed
- [SUP-6632]: Clarify --include-retried-jobs flag help text by @stephanieatte in #4049

🏠 Internal
- fix(cache-restore): retry s3 Download on 412 by @buildkate in #4045
- Suggestion for #4050 by @isaacsu in #4052
- Conditionally refresh cache TTL on restore (A-1454) by @zhming0 in #4050

New Contributors
- @stephanieatte made their first contribution in #4049

What's Changed

✨ Added
- feat: add support for GIT LFS checkout by @lizrabuya in #3909
- Debounce buildkite-agent job promise-failure via the Job API by @jordandcarter in #3996
- Expose spawned agent identity to lifecycle hooks by @catkins in #4023

🐛 Fixed
- Avoid overriding BUILDKITE_GIT_SPARSE_CHECKOUT_PATHS when agent has no sparse config by @lizrabuya in #4029

🔧 Changed
- feat: Add --reject-parse-warnings flag to fail pipeline upload on p… by @ss1909 in #4031

🏠 Internal
- Stacked review changes for #3996 by @moskyb in #4027
- A-1414: support hosted cache by @zhming0 in #4028
- A-1453: tune cache restore s3 backend concurrency and part size by @zhming0 in #4037

What's Changed

✨ Added
- Concurrently register spawn by @DrJosh9000 in #4014
- redactor add: Add optional filtering like env vars by @DrJosh9000 in #3605
- Add meta-data set-batch command by @pda in #3791

🔧 Changed
- Skip tracking unchanged slices in ReadFromEnvironment (suppress BUILDKITE_GIT_SUBMODULE_CLONE_CONFIG log noise) by @lizrabuya in #4015

🏠 Internal
- perf: speed up job integration tests by @lox in #3842
- chore: put cache logs in collapsed group by @buildkate in #4017
- chore: resolve default cache configuration file by @buildkate in #4018
- fix(cache): set flag as name singular by @buildkate in #4024

What's Changed

✨ Added
- Add SSH config and env var by @mcncl in #3938
- Add support for git commit verification by @omehegan in #3905
- feat: add sparse checkout support by @mcncl in #3903
- feat: migrate agent cache CLI to cache v2 protocol by @ss1909 in #3993
- Add buildkite-agent job promise-failure command by @123sarahj123 in #3992
- feature: Add Job API + CLI support for setting the working directory from polyglot hooks by @francoiscampbell in #3968

🐛 Fixed
- Fix env set/unset panic on Job API errors by @petetomasik in #3987
- Workaround for ETXTBSY flake by @DrJosh9000 in #3999
- Clarify redaction failures without Job API by @jamiemonserrate in #3997
- Fix delayed disconnect-after-job in streaming ping mode by @maleadt in #3994

🔧 Changed
- chore: Add artifact upload timing summary by @lox in #3981
- chore: Add artifact upload span attributes by @lox in #3982
- feat: Change ID to Name in the agent to match v2 (follow up on #3993) by @ss1909 in #3998
- feat: Support fallbackLimit for agent keyPart by @ss1909 in #4007
- feat: Add branch, step, and pipeline as agent cache-key facts, resolv… by @ss1909 in #4008

🏠 Internal
- build(deps): bump the golang-x group with 2 updates by @dependabot[bot] in #3983
- build(deps): bump the cloud-providers group across 1 directory with 11 updates by @dependabot[bot] in #3972
- build(deps): bump the container-images group across 1 directory with 2 updates by @dependabot[bot] in #3928
- build(deps): bump the container-images group across 5 directories with 2 updates by @dependabot[bot] in #3984
- build(deps): bump the container-images group across 3 directories with 1 update by @dependabot[bot] in #3985
- build(deps): bump the cloud-providers group across 1 directory with 10 updates by @dependabot[bot] in #3986
- chore: run go1.26.3 fix ./... by @DrJosh9000 in #3970
- build(deps): bump github.com/buildkite/go-buildkite/v4 from 4.22.0 to 4.23.0 by @dependabot[bot] in #3973
- [TE-6071] Request xgboost selection plan in collect-commit-metadata by @gchan in #3988
- lint: Prefer t.Context in tests by @lox in #3977
- fix: Test build failure due to missing context import by @DrJosh9000 in #3989
- fix: flaky TestCollect_Literal by @DrJosh9000 in #3990
- fix: flaky TestContextCancelInterrupts by @DrJosh9000 in #3991
- pin creack/pty version in go mod by @jeremybumsted in #3995
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #4001
- build(deps): bump the golang-x group across 1 directory with 3 updates by @dependabot[bot] in #4000
- build(deps): bump the container-images group across 3 directories with 1 update by @dependabot[bot] in #4004
- build(deps): bump the container-images group across 1 directory with 2 updates by @dependabot[bot] in #4005
- build(deps): bump the cloud-providers group across 1 directory with 8 updates by @dependabot[bot] in #4006
- build(deps): bump the otel group across 1 directory with 9 updates by @dependabot[bot] in #3971
- A-1376 part 1: e2e test for basic cache read/write by @zhming0 in #4009
- A-1376 part 3: e2e test for filesystem integrity by @zhming0 in #4011
- A-1376 part 4: e2e test cache fallback logic by @zhming0 in #4012

New Contributors
- @jeremybumsted made their first contribution in #3995
- @jamiemonserrate made their first contribution in #3997
- @maleadt made their first contribution in #3994

What's Changed

✨ Added
- PF-9591-traceset added end-to-end W3C tracestate propagation to the agent by @SorchaAbel in #3958
- feat: Configure artifact upload concurrency by @lox in #3976

🐛 Fixed
- Retry git checkout when per-attempt timeout fires by @scadu in #3962

🏠 Internal
- fix: missing \ in release-homebrew.sh by @DrJosh9000 in #3955
- A-1270 part 1: move zstash into agent repo by @zhming0 in #3953
- A-1270 part 2: merge zstash with cache package by @zhming0 in #3956
- A-1270 part 3: refactor cache package tighten seperation of concern by @zhming0 in #3959
- internal: Add comments about env files by @DrJosh9000 in #3957
- A-1270 part 4: consolidate cache and agent API layer by @zhming0 in #3960
- A-1270 part 5: rename Cache -> Cache Entry by @zhming0 in #3961
- Release oldstable from v3, edge from v4 by @DrJosh9000 in #3931
- A-1320 retry cache commands by @buildkate in #3963
- Enable release pipeline for v... branches by @DrJosh9000 in #3964
- refactor(cache): rename Save/Restore to RunSave/RunRestore by @buildkate in #3965
- Replaces docs redirects for v2/v3 by @karensawrey in #3969

New Contributors
- @quinn-diesel made their first contribution in #3980

What's Changed

🔒 Security
- fix: remove eval from install.sh by @DrJosh9000 in #3940

🐛 Fixed
- fix: resume after job dispatch drops job by @DrJosh9000 in #3930
- fix: Stop sending file paths on context cancellation by @DrJosh9000 in #3933
- fix: nil deref if HTTP/2 is disabled by @DrJosh9000 in #3935
- Fix error variable shadowing causing incorrect OTEL spans in hooks by @calebfroese in #3932
- fix: Always restore process umask by @DrJosh9000 in #3939
- fix: k8s bootstrap: swap env var precedence, with specific overrides by @DrJosh9000 in #3944

🏠 Internal
- A-1214 part 4: allow a special release label by @zhming0 in #3921
- internal: [TE-5828] Add bktec plan step to collect commit metadata on agent builds by @gchan in #3924
- internal: Bump test-engine-client to v2.5.1 and unify bktec call sites by @gchan in #3925
- Update versioned brew formula based on version being released by @DrJosh9000 in #3934
- fix: record temporary homeDir for later cleanup by @DrJosh9000 in #3942
- chore: Add comments rationalising authless world-accessible socket by @DrJosh9000 in #3943
- build(deps): bump the cloud-providers group across 1 directory with 8 updates by @dependabot[bot] in #3950
- build(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 by @dependabot[bot] in #3946
- build(deps): bump github.com/buildkite/go-pipeline from 0.17.0 to 0.17.1 by @dependabot[bot] in #3947
- build(deps): bump the golang-x group across 1 directory with 3 updates by @dependabot[bot] in #3945
- build(deps): bump connectrpc.com/connect from 1.19.2 to 1.20.0 by @dependabot[bot] in #3948
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #3949
- build(deps): bump github.com/buildkite/go-buildkite/v4 from 4.21.0 to 4.22.0 by @dependabot[bot] in #3915
- build(deps): bump the container-images group across 2 directories with 1 update by @dependabot[bot] in #3951
- build(deps): bump the container-images group across 2 directories with 1 update by @dependabot[bot] in #3952

New Contributors
- @gchan made their first contribution in #3924
- @calebfroese made their first contribution in #3932

What's Changed

✨ Added
- feat: add BUILDKITE_JOB_TIMED_OUT env var for hooks by @mastermanas805 in #3871
- Add BUILDKITE_GIT_CHECKOUT_TIMEOUT timeout to add upper duration on the checkout hook by @brandonnovick in #3794

🐛 Fixed
- fix: surface permission errors when checking plugin directories by @ss1909 in #3907

🏠 Internal
- A-1244 agent: fix issue template and add an affiliation field by @zhming0 in #3918
- A-1214 part 1: implement a PR label linter by @zhming0 in #3893
- A-1214 part 2: revamp agent release process by @zhming0 in #3917
- A-1214 part 3: update agent release skill and remove bin/release by @zhming0 in #3919
- build(deps): bump cloud.google.com/go/kms from 1.30.0 to 1.31.0 by @dependabot[bot] in #3916
- build(deps): bump the cloud-providers group with 4 updates by @dependabot[bot] in #3914
- build(deps): bump the container-images group across 1 directory with 3 updates by @dependabot[bot] in #3913
- build(deps): bump the container-images group across 4 directories with 1 update by @dependabot[bot] in #3911
- build(deps): bump the golang-x group with 4 updates by @dependabot[bot] in #3910
- A-1214 part 5: upgrade gh version on release pipeline by @zhming0 in #3922

New Contributors
- @brandonnovick made their first contribution in #3794

v3.125.0 (2026-05-04)
Full Changelog

Added
- Multipart S3 download for faster artifact downloads #3875 (@buildkate)
- New --fail-on-missing-tags flag (and BUILDKITE_AGENT_FAIL_ON_MISSING_TAGS env var) to exit the agent on startup if a configured cloud tag source (EC2/ECS/GCP) returns no tags #3801 (@omehegan)
- Automatic tracing for CLI subcommands (e.g. artifact upload, pipeline upload) when BUILDKITE_TRACING_BACKEND=opentelemetry and a TRACEPARENT is present #3866 (@ss1909)
- Register application/zstd MIME type for .zst artifact uploads #3864 (@ladd)

Fixed
- Preserve literal percent sequences in JSON job logs (previously rewritten by Go format-string handling) #3877 (@friel-openai)

Internal
- Remove Bazel from the agent build #3873 (@moskyb)
- Rename logger.Logger methods to end in f (e.g. Debugf, Infof) #3878 #3881 (@DrJosh9000, @buildkate)
- Separate OTel provider provisioning from span generation #3880 (@ss1909)
- Only log the first stream connection to reduce log noise #3872 (@moskyb)
- Remove and prevent use of assert libraries (testify) #3858 (@DrJosh9000)
- Bump go-pipeline to v0.17.0 #3865 (@CerealBoy)

v3.124.0 (2026-04-28)
Full Changelog

Added
- feat: build and publish freebsd/arm64 binary #3855 (@buildkate)
- feat: add metrics to record histogram of chunk sizes and compressed size #3833 (@wolfeidau)

Changed
- fix: Hide detached-HEAD advice #3851 (@DrJosh9000)
- Big process refactor, improved Windows signal handling #3814 (@DrJosh9000)

Fixed
- fix: use single-quoted shell escaping for --format env output #3856 (@ss1909)
- fix: More consistent protected env vars #3838 (@DrJosh9000)
- fix: set PTY raw mode before process start #3837 (@lox)

Internal
- fix: Flakes in shell_test.go due to missing signal grace period #3854 (@DrJosh9000)
- fix: Make TestChunksIntervalSeconds less flaky #3850 (@DrJosh9000)
- chore: rename mise config and add tasks #3839 (@lox)
- feat: migrate to github.com/klauspost/compress/gzip for optimized deflate #3832 (@wolfeidau)
- Removal manual gates from deployment process #3830 (@zhming0)
- Normalise HTTP status-based retry policies across the agent #3827 (@moskyb)