持续集成服务提供商 Buildkite 推出了限定流水线作用域的密钥，以及用于验证流水线、诊断构建失败和修复 Webhook 的新模型上下文协议（MCP）工具。该公司还为其 GitHub Actions 兼容层增加了 Linux arm64 支持，并扩展了 Buildkite Agent v4.1.0 中的 OpenTelemetry 数据。
新的密钥视图位于流水线设置中。工程师可以在此创建仅限当前流水线访问的集群密钥，而不必通过范围更广的集群界面管理每个密钥。团队还可以按分支、队列、构建来源或构建创建者添加访问条件。密钥值在创建后仍会保持隐藏。
Matt Mejia 在 Buildkite 的公告中表示，这项改动“将流水线专用密钥集中在一起”，同时显示集群还管理着多少其他密钥。用户需要同时拥有编辑该流水线和管理其所属集群的权限。GitHub Actions 流水线在首次运行工作流之前，也会显示一个指向密钥配置的提示。
流水线密钥是仅限当前流水线使用的集群密钥，而分支、队列、构建来源或创建者条件可以进一步缩小访问范围。
Buildkite CLI 现在包含用于迁移 GitHub Actions 密钥的命令。3.59.1 版本修复了迁移过程中对相对工作流路径的处理。Agent v4.0.9 还会在作业日志中按前缀遮盖 Buildkite 令牌，而 v4.0.8 会使用为作业注册的密钥遮盖捕获到的作业错误。
这些改动针对的是凭证可能暴露或配置错误的多个环节，但限定存储作用域并不能消除控制密钥在步骤中如何使用的必要性。InfoQ 在 2025 年曾报道，HashiCorp 主张在开发者工具和 CI/CD 系统中采用预防优先的密钥管理方式。Buildkite 自己的文档也建议团队只向需要密钥的步骤提供密钥。
功能变化最多的是 Buildkite 的开源 MCP 服务器。新的 validate_pipeline 工具会根据 Buildkite 的官方模式检查流水线 YAML 的语法和结构，无须上传文件或启动构建。它会返回路径和错误信息，供 AI 编码智能体修正无效步骤。该检查不涵盖环境变量插值、插件配置、依赖引用或动态生成的步骤。
第二个工具 compare_builds 会将失败的构建与同一分支上最近一次成功的构建，或另一个指定构建进行比较。它会报告哪些步骤是新出现的失败、已恢复或仍然失败，并列出运行时间和重试情况的变化。对于最多三个新失败的步骤，它还会附上作业日志的末尾内容，为智能体提供一些即时诊断信息。
仅能访问日志，并不等于能够调试构建。
此次 MCP 版本还增加了 Test Engine 执行轨迹和最慢执行项查询。另一个工具 create_pipeline_webhook 可以为现有流水线补上缺失的 GitHub Webhook，无须重新创建流水线。1.23.0 版本修改了 create_pipeline，要求调用方必须指定 create_webhook；这是一项破坏性变更。
在进行评估后，Buildkite 恢复了此前的一项默认行为：失败摘要现在再次包含那些从未运行的作业，因为将这一行为设为可选会导致智能体发起额外的工具调用。现在还可以通过将 Buildkite 组织添加到服务器 URL，把远程 MCP 连接限定到单个组织。该选项适用于工具集 URL 和只读 URL。
为智能体提供独立的验证、比较和修复工具，应能减少它们对解析完整日志和组合底层 API 调用的依赖。权限仍然重要，因为修复 Webhook 和创建流水线都可能修改 CI 配置。InfoQ 对 GitHub 智能体工作流的报道介绍了一种相关的安全模型，其基础是隔离执行、受限权限和可审计的操作。
Buildkite 的 GitHub Actions 兼容层现在可以在 Linux arm64 Agent 上运行导入器和生成的作业。ubuntu-24.04-arm 等标签需要显式配置队列映射，不会回退到 x86-64 或仿真运行。对于拥有 arm64 CI 集群的组织，这项功能使它们在将兼容的 Actions 工作流迁移到 Buildkite 时，能够继续使用这一架构。
其他兼容性修复解决了服务容器配置中的环境值、命名密钥、运行时变量和矩阵值问题。Buildkite 还向作业和步骤表达式开放了更多 strategy.* 值。路径过滤器使用的变更文件数量上限从 300 提高到 3000，同时修复了原始推送后分支发生移动时的推送工作流问题。
Agent v4.1.0 在 Buildkite 遥测数据中增加了缓存保存和恢复的耗时及大小。OpenTelemetry 作业跨度现在包含提交、拉取请求和构建发起者信息。这些字段为团队调查慢作业或重试模式提供了更多上下文。Pinterest 此前曾介绍如何结合 Honeycomb 与 Buildkite，区分 Agent 等待时间和脚本执行时间，并找出导致构建耗时激增的作业。
配套的 Elastic CI Stack v7 版本在 AWS 上的 Linux 和 Windows 实例中引入了 Agent v4。它移除了对 Agent v3 的支持，并停用或替换了部分追踪和取消操作参数。Buildkite 建议用户在升级前检查自定义参数文件、部署自动化配置，以及通过 AgentEnvFileUrl 提供的值。所有 Agent v3 版本的支持将于 2027 年 9 月 3 日结束。
原文链接：
https://www.infoq.com/news/2026/10/buildkite-ci-secrets-agentic/
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
A continuous integrated service provider, Buildkite, has introduced keys to define the current line role and a new model context protocol (MCP) tool to validate current line, diagnostic failure and repair Webhook. It also added Linux arm64 to its GitHub Actions compatibility layer and expanded OpenTelemetry data from Buildkite Agent v4.1.
The new key view is in the flow line settings. Engineers can create cluster keys that are limited to current water lines, without having to manage each key through a broader cluster interface. The team can also add access conditions by branch, queue, build source or build creator. The key will remain hidden after it is created.
Matt Mejia, in the Buildkite bulletin, stated that the change “concentrates the dedicated water-line key” and shows how many other keys the cluster manages. Users need to also have permission to edit the current line and manage their clusters. GitHub Actions also shows a hint to the key configuration before workflow is first run.
The flow line key is a cluster key limited to the current flow line, and branch, queue, build source or creator condition can further narrow access.
Buildkite CLI now contains commands for moving GitHub Actions keys. 3.59.1 Versions repair the treatment of the relative workflow path during the migration. Agent v4.0.9 also hides the Buildkite token by prefix in the job log, while v4.0.8 uses the key to register the captured job error.
These changes are for multiple links where the document may be exposed or configured, but limiting the storage domain does not obviate the need for how the control key is used in the process. InfoQ reported in 2025 that HashiCorp advocated a precautionary key management approach in the Developer Tool and CI/CD system. Buildkite's own document also suggests that the team provide the key only to the steps requiring the key.
The most significant change in functionality is the open source MCP server for Buildkite. The new valaidate pipeline tool will check the syntax and structure of the water line YaML according to the official Buildkite model, without uploading the file or starting construction. It returns path and error information for AI code AI agent to correct invalid steps. The check does not cover interpolation values for environmental variables, configuration of plugins, reliance on references or dynamic-generated steps.
The second toolcompare builds compares failed construction with the last successful construction in the same branch, or another specified build. It reports on steps that have emerged, recovered or still failed, and outlines changes in operating time and retry. For a maximum of three new failed steps, it will also be accompanied by the end of the operational log, which will provide some immediate diagnostic information for AI agent.
Accessing logs only does not mean that you can debug construction.
This MCP version also adds the Test Engineering execution track and the slowest execution entry query. Another tool can replace the missing GitHub Webhuk with the existing current line without recreating the current line. Version 1.23.0 modified file peline, requiring the caller to specify cause webhook; this is a destructive change.
Following the assessment, Buildkite resumed an earlier default: failed summary now includes operations that have never been operated again, as setting this as optional would result in AI agent initiating additional tool call. It is now possible to limit remote MCP connections to individual organizations by adding the Buildkite organization to the server URL. This option applies to the URL of the tool set and the read-only URL.
Providing an independent validation, comparison and restoration tool for AI agent should reduce their reliance on a full log and a combination of bottom API calls. permission is still important because repairing Webhook and creating a streaming line may modify the CI configuration. InfoQ reports on GitHub AI agentZ52Z describe a related security model based on isolated, restricted permission and auditable operations.
The GitHub Actions interface of Buildkite can now run the importer and the resulting operation on Linux arm64 Agent. tabs such as ubuntu-24.04-arm require a visible configuration queue map, which does not run from rollback to x86-64. For organizations with arm64 CI clusters, this function allows them to continue using this structure when moving compatible Actions workflow to Buildkite.
Other compatibility repairs address the environmental, named key, running time variables and matrix values in the service container configuration. Buildkite has also opened more strategy.* values for operation and step expressions. The maximum number of files to be used by the path filter was raised from 300 to 3000, while the issue of the transfer of workflow when the original thrust branch moved was repaired.
Agent v4.1.0 added cache preservation and restoration time and size to the Buildkite telemetry data. OpenTelemetry now contains submission, pull request and build sponsor information. These fields provided additional contexts for the team survey slow work or the retry model. Pinterest has previously described how to combine Honeycomb with Buildkite, to distinguish between Agent waiting time and script execution time, and to identify operations that lead to construction time-consuming surges.
The accompanying Elastic CI Stack v7 version introduces Agent v4 in Linux and Windows examples on AWS. It removes support for Agent v3 and disables or replaces part of the tracking and cancellation parameters. Buildkite suggests that users check the custom parameter files, deploy automated configurations and values provided through AgentEnvFileUrl before upgrading. All Agent v3 versions of support will end on 3 September 2027.
Original link:
https://www.infoq.com/news/2026/10/buildkite-ci-secrets-agentic/
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.