Starting August 1st 2022, jobs which are not run within 30 days will automatically expire 🧹

In the past, it's been very easy to have lingering jobs in your Buildkite account which are never assigned an agent, and will never run. Not only does this create unnecessary noise and risk within your account, but it means that Buildkite’s job processing logic needs to handle years-old jobs.

With this change, we've introduced a new job state: expired. This is similar to the canceled state, and once a job is transitioned to this state, the build will fail.

This will be enabled for everyone on Monday, 1st August 2022, but you can opt in today at an organisation level, or a per-pipeline level, to start testing and verifying that it works with your own builds. Once enabled, jobs older than 30 days that haven't been run by an agent will be automatically transitioned to expired and their builds cancelled. This new state will also appear in the REST and GraphQL APIs.

To enable this today, see the "Job Expiry" section in your organization's pipelines settings page, or each pipeline's Pipeline Settings > Builds page:

If you have any questions or feedback we'd love to hear from you in our community Slack channel, or drop us an email to support@buildkite.com.

After releasing Test Analytics, we've been working on improving the navigation bar in the Docs to make it easier for you to find and read docs on both Pipelines and Test Analytics.

This change and other recent UI and UX improvements are already live in the docs.

For teams that have a large number of connected agents, we’ve added a new filter to the Agents page so you can quickly find which ones are busy working on jobs 🕵️‍♀️🕵️‍♀️🕵️‍♀️

We hope this makes it easier to find and interact with agents which are running jobs in your organization.

If you have any feedback we'd love to hear from you in our community Slack channel, or drop us an email to support@buildkite.com.

Buildkite Agent v3.36.1 and the AWS Elastic Stack v5.9.0 are now available! 🎉

This agent version ships with experimental support for tracing CI runs through OpenTelemetry, as well as improvements to logging, and an experimental file locking system that should unlock more reliably when the agent hasn't shut down cleanly.

This agent release has been added to the v5.9.0 release of the elastic stack, which also:

• Adds ability to fetch EC2 instance tags via Instance Metadata
• Updates the Linux Kernel on elastic stack instances from 4.14 to 5.10
• Adds an option to enable EC2 Detailed Instance Monitoring

For full list of additions, changes, and fixes, see the buildkite-agent changelog and the elastic-ci-stack-for-aws changelog on GitHub.

We're changing the $BUILDKITE_PULL_REQUEST_REPO environment variable value supplied for GitHub and GitHub Enterprise repositories from the unauthenticated git protocol to https 🔒

GitHub announced some time ago that they are removing the unauthenticated git protocol. This change has been in effect since 15th March 2022. Now we're modifying how we generate this environment variable to match their change.

$BUILDKITE_PULL_REQUEST_REPO is not used by the Buildkite Agent to clone your repositories. The value is only provided as a reference, and is particularly useful for pull requests from repository forks. Some customers use this value to ensure that pull requests from forks come from trusted sources, for example.

We recommend reviewing your agent hooks and making sure any security rules that utilise this value are adjusted to be agnostic to the protocol used, and are at least able to handle https.

From Monday, 20th June 2022, all new builds will use a https:// protocol URL for $BUILDKITE_PULL_REQUEST_REPO. If you need a little more time, or would like this change to take effect earlier for your organization, please reach out via support@buildkite.com.

The 5.8.0 version of the AWS elastic stack is now available. 🚀

This release added:

• Ability to customise docker address pools to use more, slightly smaller networks rather than a few big ones
• Support for additional ARM/Graviton instance types: c7g, g5g, lm4gn, lm4gen, and x2gd
• SecretsBucketRegion parameter and updated s3secrets-hooks
• Docs on updating the different components #957 (@keithduncan)

It also fixed:

• Overwrite /usr/bin/buildkite-agent symlink if it already exists

For full list of additions, changes, and fixes, see the elastic-ci-stack-for-aws changelog on GitHub.

The 3.35.0 version of the buildkite-agent is now available. 🚀

This release has added:

• An option to skip updating the mirror when using git mirrors. Useful when git is mounted from an external volume
• The more secure SHA256 hashing algorithm alongside SHA1 when working with artifacts
• Additional security when creating directories, making them only accessible by current user and group

For full list of additions, changes, and fixes, see the buildkite-agent changelog on GitHub.

As announced in 2019, Schedules no longer need a user 🏃🏼‍♂️💨

Schedules created before then and not manually migrated have now had their build ownership user removed. Builds created from those schedules will no longer have a creator, which may affect trigger step permission, build.creator conditionals, and $BUILDKITE_BUILD_CREATOR environment variable checks.

Schedules created since the 2019 announcement are unaffected, as they never had a build ownership user.

The 3.34.0 version of the buildkite-agent is now available. 🚀

This release has added:

• a new combination flag: spawn-with-priority
• locked down file permissions on Windows
• increased security by rejecting pipeline uploads containing redacted vars

For full list of additions, changes, and fixes, see the buildkite-agent changelog on GitHub.

API Access Tokens can be restricted to allow access only from specific Allowed IP Addresses. Those restrictions have been honoured by the REST API, but not by the GraphQL API — until now. We've made sure these restrictions are also applied to GraphQL requests.

Check out the API Access Token documentation and configure your tokens on the API Access Tokens page.

Last week a serious vulnerability, CVE-2021-44228, was disclosed in the Java-based logging package Log4j. We’ve ensured that Buildkite internal systems, and our open source projects, are not vulnerable to this exploit.

We've performed an audit on our internal software and infrastructure, and we have no instances of Log4j in use directly or via dependencies, and therefore are not vulnerable to this exploit. Additionally we've reviewed our open source projects (including the Buildkite Agent and the Elastic CI Stack for AWS) and have verified they also don't have any use of Log4j and are not vulnerable to CVE-2021-44228.

We use a number of services from AWS and other cloud vendors, and are actively monitoring them to validate that they are not vulnerable and take any necessary mitigation.

If you haven't already, we also recommend updating any use of Log4j within your own build tooling.

If you have any further questions please contact support@buildkite.com.

The 5.7.2 version of the AWS elastic stack is now available. 🚀

This release includes:

• Upgrade Docker for Linux (20.10.9) and Windows (20.10.7)
• Upgrade docker-compose for Linux (1.29.2) and Windows (1.29.2)

It also fixes:

• BuildkiteAgentTokenParameterStorePath support for AWS Secrets Manager SSM references

For full list of additions, changes, and fixes, see the elastic-ci-stack-for-aws changelog on GitHub.

The 3.33.3 version of the buildkite-agent and the 5.7.0 version of the AWS elastic stack are now available. 🚀

The 3.33.3 Agent release has added:

• Support for unset environment variables in Job Lifecycle Hooks

The 5.7.0 Elastic Stack release has added:

• Support for storing builds, git-mirrors, and Docker data on NVMe Instance Storage
• Retried login for ECR and generic Docker registries
• Experimental CloudFormation service role, listing the IAM Actions required to create, update, and delete the template
• A README feature matrix for Linux and Windows
• qemu and binfmt hooks for cross-architecture Docker image builds
• Support for AWS SSM sessions

For full list of additions, changes, and fixes, see the buildkite-agent changelog and the elastic-ci-stack-for-aws changelog on GitHub.

The 3.32.3 version of the buildkite-agent and the 5.6.0 version of the AWS elastic stack are now available.

The 3.32.3 Agent release has added:

• Support for cross-region artifact buckets
• Improved error logging around AWS Credentials
• Logging to the artifact upload command to say where artifacts are being sent

The 5.6.0 Elastic Stack release has added:

• Cross-region secrets bucket support to git-credentials-s3-secrets
• AssumeRole support in the ECR Login plug-in

For full list of additions, changes, and fixes, see the buildkite-agent changelog and the elastic-ci-stack-for-aws changelog on GitHub.

From 1 October 2021, build artifacts hosted by Buildkite will be retained for six months from time of upload, after which they will be deleted. Artifacts uploaded before 1 April 2021 will also be deleted at this time.

Previously, build artifacts were retained indefinitely, which means we're currently storing over 7PB of data 🤯📈

Custom-hosted build artifacts are not affected by this change, and remain available to any customer who wants more control over their retention.

As always, you can reach out to us with any questions about this change.

We've released v5.5.0 of the Elastic Stack CI for AWS ☁️

Included in this release:

• Template validation rules for the Buildkite Agent token
• Secret redaction in build logs
• Support for the pre-bootstrap Buildkite Agent lifecycle hook

You can read the full release notes on the v5.5.0 release on GitHub.

We've released v3.32.0 of the Buildkite Agent 🦾🤖

The release adds a new pre-bootstrap lifecycle hook which can accept or reject jobs before environment variables are loaded, providing an additional layer of security and control over your Buildkite agents. See the documentation on lifecycle hooks for details on how to use it.

You can read the full release notes on the v3.32.0 release on GitHub. To upgrade, follow the instructions in the Agent docs.

We've released v1.2.0 of the Buildkite CLI 📎💪🏼🪟

Included in this release:

• The bk build create command now has a --meta-data argument, for setting Build Meta-Data when creating a build
• Running local builds (via bk local run) now works on Windows
• An improved GitHub authentication flow

You can read full release notes on the v1.2.0 release on GitHub

To upgrade, if you're using Homebrew on a Mac run brew upgrade bk, otherwise download the latest release for your platform from the GitHub release page.

The latest release of the Buildkite Terraform provider adds buildkite_meta: a data source providing the IP addresses Buildkite uses for webhooks ✨

The new data source can be used in your terraform project to dynamically set firewall and ingress rules, allowing in traffic from Buildkite 🚦

You can find a code sample and attribute reference in the Buildkite provider docs on the Terraform Registry. For more detailed information about the addition, check out the v0.4.0 release on GitHub.

To support customers with inbound network firewalls, Buildkite's Meta API lists the IP addresses that Buildkite uses to send outbound traffic such as webhooks and commit statuses.

To improve network resilience, new IP addresses were added to the Meta API earlier this month. If you use network ACL/firewall rules to allow-list traffic from Buildkite, these should be updated immediately.

During the week of 2021-04-19 traffic will intermittently be switched to the new IPs for short periods as a low-impact method of uncovering issues. During the following week of 2021-04-26 outbound traffic will be permanently switched to the new addresses.