What we shipped last week

Summary

Between September 27 and October 3, 2026, we published 4 changelog entries and 35 releases across 13 public repos. Three things run through them: more control and predictability for platform teams, fewer gaps for teams moving off GitHub Actions, and more of the platform agents can drive directly.

• Tightened how secrets are handled. Pipeline-scoped secrets live in pipeline settings, the Buildkite CLI (bk) migrates GitHub Actions secrets, and the agent now redacts anything shaped like a Buildkite-issued token from job logs. Captured errors redact the secrets registered for that job.
• Expanded what agents can do. The MCP server added pipeline validation, build comparison, test execution traces, and webhook repair, and each Remote MCP connection now pins to an organization.
• Steadied build environments. Agent v4.1.0 reports cache timings and adds commit, pull request, and author attributes to OpenTelemetry spans. Elastic CI Stack for AWS replaces instances whose agent stops responding, the Kubernetes stack completes its move to agent v4, and the agent scaler stops duplicate scale-ins. New RSS feeds announce macOS base image releases on hosted agents. All v3 agent support ends September 3, 2027.
• Closed more gaps in GitHub Actions workflows on Buildkite. Fourteen releases added a Linux arm64 runtime and broader support for vars, secrets, matrix values, and strategy expressions.
• Moved test splitting toward shared pools. The Buildkite test engine client (`bktec`) 3.2.0 adds commands to plan and run tests from shared scheduler pools, with persistent runners and dynamic parallelism.

Changelog entries

Dates are US Pacific time.

What does this mean for you

Secrets move closer to the pipeline

If you can edit a pipeline and manage its cluster, you can now create and manage secrets from Pipeline settings → Secrets. Pipeline secrets are cluster secrets restricted to the current pipeline, and branch, queue, build source, or creator conditions narrow access further. Values stay hidden after creation.

The new view keeps pipeline-specific secrets together, shows how many others the cluster manages, and links through to the cluster's secrets page, where restricted secrets now carry a lock indicator. GitHub Actions pipelines get a dismissible prompt pointing at secrets setup before the first workflow runs.

The Buildkite CLI 3.59.0 adds a command to migrate GitHub Actions secrets, and 3.59.1 fixes relative workflow paths when you do.

Agents get the moves an engineer would make

Log access alone does not debug a build. MCP server v1.23.0 adds validate_pipeline to check pipeline YAML against the official schema before upload, compare_builds to diff a failing build against an earlier success, and Test Engine execution traces with slowest-execution lookups.

v1.24.0 adds create_pipeline_webhook, so an agent can repair a pipeline created without its GitHub webhook instead of recreating it. Both releases sharpen failure summaries.

One v1.23.0 default hid jobs that never ran, and v1.24.0 reversed it after eval runs showed the opt-in forced extra tool calls. Measure, then decide.

v1.23.0 carries one breaking change: create_pipeline now requires create_webhook.

If your agents work across more than one organization, add ?organization=your-organization to the Remote MCP Server URL. The authorization page then preselects it. It works with toolset and read-only URLs, and leaving it off changes nothing.

GitHub Actions workflows on Buildkite

Fourteen buildkite-gha releases this week:

• Publishes a Linux arm64 runtime in v0.97.0, so the importer and generated jobs run on arm64 agents. Labels such as ubuntu-24.04-arm need an explicit queue mapping, and they never fall back to x86-64 or emulation.
• Resolves job environment values, named secrets, runtime vars, and matrix values in service container env and credentials, across v0.94.0, v0.95.0, and v0.96.0.
• Exposes strategy.job-index, job-total, fail-fast, and max-parallel in job and step expressions in v0.93.0. fail-fast reports its configured value but still does not cancel sibling matrix jobs.
• Ignores branch, tag, and path filters on ten event families in v0.93.1, matching GitHub's behavior.
• Raises the changed-file limit from 300 to 3,000 in v0.97.2, and fixes path-filtered push workflows that failed when the branch advanced after the push.

You pick these up through the GitHub Actions Buildkite plugin, which installs and verifies the selected CLI release and defaults to the latest stable one. Every release ships with upgrade notes that say exactly what is still unsupported.

Four agent releases, and a clock on v3

Agent v4.1.0 reports cache save and restore timings and sizes back to Buildkite, carries commit, pull request, and build author as OpenTelemetry job span attributes, and fixes intermittent Windows crashes. v4.0.9 redacts Buildkite tokens by prefix in job logs, v4.0.8 redacts captured job errors using the job's registered secrets, and v4.0.7 surfaces cache restore keys, scopes, and policy outcomes in build logs.

Around the agent, Elastic CI Stack for AWS v7.1.0 and v7.2.0 now replace Linux instances whose agent stops responding for three minutes and bundle v4.1.0, the Kubernetes stack completes its move to agent v4 in v0.51.0, and the agent scaler v1.15.0 stores its last scale-in time in SSM Parameter Store so Lambda cold starts stop causing duplicate scale-ins.

From January 1, 2027, we support each minor release line for 1 year from its first stable release, with the final 3 months a deprecation window. Installing an agent or updating to a newer patch does not restart that window.

• v3.115.x and earlier become unsupported on January 1, 2027.
• v3.116.x through v3.121.x become deprecated that day, and stay supported until their own windows end.
• v3 support ends entirely on September 3, 2027.

We will not block out-of-support agents for that reason alone, but we no longer guarantee compatibility. We manage updates for hosted agents, so there is nothing to do there. On self-hosted agents, check the versions across your fleet and plan the move to v4, or read the full agent version support policy.

If you run macOS on hosted agents, new RSS feeds now tell you when a base image changes. The stable feed covers production images, and the canary feed covers the latest Xcode betas and runtimes.

Test splitting moves to shared pools

The Buildkite test engine client 3.2.0 adds bktec pool plan and bktec pool exec for shared Test Scheduler pools, and hosts the protocol and lifecycle for persistent test runners. Pool plan supports dynamic parallelism.

Underneath, bktec releases active leases when it terminates, retains them through transient heartbeat failures, and prefetches the next lease while the current one runs.

Manual test selection comes out of preview, and you can now opt out of git metadata collection. Release candidates went out on September 29 and October 1.

GitHub releases

35 releases across 13 public repos in the buildkite and buildkite-plugins GitHub orgs, newest first. Where one repo shipped a run of releases, they share a row. Dates are US Pacific time.

Subscribe to changelog updates

Point any RSS reader at the Atom feed and new entries arrive as they ship. You can also read the Buildkite changelog.

See you next week!