Buildkite shipped pipeline-scoped secrets in pipeline settings, Linux arm64 support for GitHub Actions workflows, and new Model Context Protocol (MCP) server tools for validating pipelines, comparing builds, and repairing webhooks between September 27 and October 3, 2026. Platform teams can now manage secrets for each pipeline, pin each Remote MCP Server connection to one organization, and plan for the end of agent v3 support on September 3, 2027. Agent v4.1.0 also adds cache timings and commit details to OpenTelemetry spans, and RSS feeds now announce new macOS base image releases on hosted agents.
\nIf you can edit a pipeline and manage its cluster, you can now create and manage secrets from Pipeline settings → Secrets. Pipeline secrets are cluster secrets restricted to the current pipeline, and branch, queue, build source, or creator conditions narrow access further. Values stay hidden after creation.
\nThe new view keeps pipeline-specific secrets together, shows how many others the cluster manages, and links through to the cluster's secrets page, where restricted secrets now carry a lock indicator. GitHub Actions pipelines get a dismissible prompt pointing at secrets setup before the first workflow runs.
\nThe Buildkite CLI 3.59.0 adds a command to migrate GitHub Actions secrets, and 3.59.1 fixes relative workflow paths when you do.
\nLog access alone does not debug a build. MCP server v1.23.0 adds validate_pipeline to check pipeline YAML against the official schema before upload, compare_builds to diff a failing build against an earlier success, and Test Engine execution traces with slowest-execution lookups.
v1.24.0 adds create_pipeline_webhook, so an agent can repair a pipeline created without its GitHub webhook instead of recreating it. Both releases sharpen failure summaries.
One v1.23.0 default hid jobs that never ran, and v1.24.0 reversed it after eval runs showed the opt-in forced extra tool calls. Measure, then decide.
\nv1.23.0 carries one breaking change: create_pipeline now requires create_webhook.
If your agents work across more than one organization, add ?organization=your-organization to the Remote MCP Server URL. The authorization page then preselects it. It works with toolset and read-only URLs, and leaving it off changes nothing.
Fourteen buildkite-gha releases this week:
\nubuntu-24.04-arm need an explicit queue mapping, and they never fall back to x86-64 or emulation.vars , and matrix values in service containerenv andcredentials , acrossv0.94.0 ,v0.95.0 , andv0.96.0 .strategy.job-index ,job-total ,fail-fast , andmax-parallel in job and step expressions inv0.93.0 .fail-fast reports its configured value but still does not cancel sibling matrix jobs.push workflows that failed when the branch advanced after the push.You pick these up through the GitHub Actions Buildkite plugin, which installs and verifies the selected CLI release and defaults to the latest stable one. Every release ships with upgrade notes that say exactly what is still unsupported.
\nAgent v4.1.0 reports cache save and restore timings and sizes back to Buildkite, carries commit, pull request, and build author as OpenTelemetry job span attributes, and fixes intermittent Windows crashes. v4.0.9 redacts Buildkite tokens by prefix in job logs, v4.0.8 redacts captured job errors using the job's registered secrets, and v4.0.7 surfaces cache restore keys, scopes, and policy outcomes in build logs.
\nAround the agent, Elastic CI Stack for AWS v7.1.0 and v7.2.0 now replace Linux instances whose agent stops responding for three minutes and bundle v4.1.0, the Kubernetes stack completes its move to agent v4 in v0.51.0, and the agent scaler v1.15.0 stores its last scale-in time in SSM Parameter Store so Lambda cold starts stop causing duplicate scale-ins.
\nFrom January 1, 2027, we support each minor release line for 1 year from its first stable release, with the final 3 months a deprecation window. Installing an agent or updating to a newer patch does not restart that window.
\nWe will not block out-of-support agents for that reason alone, but we no longer guarantee compatibility. We manage updates for hosted agents, so there is nothing to do there. On self-hosted agents, check the versions across your fleet and plan the move to v4, or read the full agent version support policy.
\nIf you run macOS on hosted agents, new RSS feeds now tell you when a base image changes. The stable feed covers production images, and the canary feed covers the latest Xcode betas and runtimes.
\nThe Buildkite test engine client 3.2.0 adds bktec pool plan and bktec pool exec for shared Test Scheduler pools, and hosts the protocol and lifecycle for persistent test runners. Pool plan supports dynamic parallelism.
Underneath, bktec releases active leases when it terminates, retains them through transient heartbeat failures, and prefetches the next lease while the current one runs.
\nManual test selection comes out of preview, and you can now opt out of git metadata collection. Release candidates went out on September 29 and October 1.
\n35 releases across 13 public repos in the buildkite and buildkite-plugins GitHub orgs, newest first. Where one repo shipped a run of releases, they share a row. Dates are US Pacific time.
\n| Date | Release | Summary |
|---|---|---|
| October 2 | Docker Compose plugin v5.15.0 | Adds a bake option to build and push withdocker buildx bake , captures structured Docker Compose errors through the agent, and fixes thepre-exit hook exit code. |
| October 1 | Test engine client (bktec) v3.2.0 | Adds bktec pool plan andbktec pool exec to run tests from shared scheduler pools with persistent runners and dynamic parallelism, takes manual test selection out of preview, and lets you opt out of git metadata collection. Release candidates went out September 29 and October 1. |
| October 1 | Elastic CI Stack for AWS v7.1.0 and v7.2.0 | Replaces Linux instances whose agent stops responding for three minutes, retries transient EC2 metadata failures, bundles agent v4.1.0 and agent scaler v1.15.0, and fixes the instance termination fallback. |
| October 1 | GitHub Actions workflows on Buildkite (buildkite-gha) v0.90.1 to v0.97.2 | Fourteen releases from September 28: a Linux arm64 runtime, vars, named secrets and matrix values in service containers, strategy.* expressions, GitHub-matching event filter behavior, and a path-filter fix that raises the changed-file limit from 300 to 3,000. |
| September 30 | Agent v4.1.0 | Reports cache save and restore timings and sizes to Buildkite, adds commit, pull request, and build author attributes to OpenTelemetry job spans, and fixes intermittent Windows crashes. |
| September 29 | CLI 3.59.1 | Fixes relative workflow paths when migrating secrets. |
| September 29 | Go API client (go-buildkite) v5.19.0 to v5.21.0 | Three releases from September 27 adding cluster cache registry, default cache registry, and repository connections support. |
| September 29 | macOS menu bar app 1.0.63 | Fixes stuck sign-in and lost sessions, makes build notifications more reliable, and adds live build times. 1.0.62 and earlier need a one-time manual update. |
| September 29 | MCP server v1.24.0 | Adds create_pipeline_webhook so agents can repair a pipeline created without its GitHub webhook, and makes failure summaries list jobs that never ran by default, reversing v1.23.0 after evals showed the opt-in cost extra tool calls. |
| September 29 | Agent v4.0.9 | Redacts Buildkite tokens by prefix in job logs and closes each job's log temp file when the job finishes. |
| September 29 | Agent scaler v1.15.0 | Stores the last scale-in time in SSM Parameter Store, so Lambda cold starts no longer cause duplicate scale-ins. |
| September 29 | Agent Stack for Kubernetes v0.51.0 | Completes the agent v4 migration. Breaking: tracing config keys are renamed or removed, and the controller will not start if the old keys remain. |
| September 28 | CLI 3.59.0 | Adds bk commands to migrate GitHub Actions secrets and manage the cache registry, plus clearer guidance when the OAuth credential store is unavailable. |
| September 28 | Artifacts plugin v1.10.0 | Adds an option to expand variables, and fixes a command injection via env-name parsing in post-command upload discovery. |
| September 28 | Agent v4.0.8 | Turns on error capture without an experiment flag, redacts captured job errors using the job's registered secrets, and fixes a file-descriptor leak. |
| September 28 | MCP server v1.23.0 | Adds validate_pipeline ,compare_builds , test execution trace and slowest-execution tools, and sharpens failure summaries. Breaking:create_pipeline now requirescreate_webhook . |
| September 27 | Pipeline parser (go-pipeline) v0.18.1 | Rejects pipeline YAML with excessive alias expansion instead of exhausting memory while parsing. |
| September 27 | Agent v4.0.7 | Shows cache restore keys, scopes, and policy outcomes in build logs, supports provider-specific Git usernames for repository credentials, and preserves Linux mount points during cache restore. |
| September 27 | CLI 3.58.0 | Accepts stdin request bodies in bk api , supports repeated--path flags for artifacts, and keeps cluster secret request bodies out of debug logs. |
Point any RSS reader at the Atom feed and new entries arrive as they ship. You can also read the Buildkite changelog.
\nSee you next week!
","headings":[{"level":2,"text":"Summary","id":"summary"},{"level":2,"text":"Related changelog entries","id":"related-changelog-entries"},{"level":2,"text":"What does this mean for you","id":"what-does-this-mean-for-you"},{"level":3,"text":"Secrets move closer to the pipeline","id":"secrets-move-closer-to-the-pipeline"},{"level":3,"text":"Agents get the moves an engineer would make","id":"agents-get-the-moves-an-engineer-would-make"},{"level":3,"text":"GitHub Actions workflows on Buildkite","id":"github-actions-workflows-on-buildkite"},{"level":3,"text":"Four agent releases, and a clock on v3","id":"four-agent-releases-and-a-clock-on-v3"},{"level":3,"text":"Test splitting moves to shared pools","id":"test-splitting-moves-to-shared-pools"},{"level":2,"text":"GitHub releases","id":"github-releases"},{"level":2,"text":"**Subscribe to changelog updates**","id":"subscribe-to-changelog-updates"}]}}