What shipped at Buildkite: September 27 – October 3, 2026

What does this mean for you

Secrets move closer to the pipeline

If you can edit a pipeline and manage its cluster, you can now create and manage secrets from Pipeline settings → Secrets. Pipeline secrets are cluster secrets restricted to the current pipeline, and branch, queue, build source, or creator conditions narrow access further. Values stay hidden after creation.

The new view keeps pipeline-specific secrets together, shows how many others the cluster manages, and links through to the cluster's secrets page, where restricted secrets now carry a lock indicator. GitHub Actions pipelines get a dismissible prompt pointing at secrets setup before the first workflow runs.

The Buildkite CLI 3.59.0 adds a command to migrate GitHub Actions secrets, and 3.59.1 fixes relative workflow paths when you do.

Agents get the moves an engineer would make

Log access alone does not debug a build. MCP server v1.23.0 adds validate_pipeline to check pipeline YAML against the official schema before upload, compare_builds to diff a failing build against an earlier success, and Test Engine execution traces with slowest-execution lookups.

v1.24.0 adds create_pipeline_webhook, so an agent can repair a pipeline created without its GitHub webhook instead of recreating it. Both releases sharpen failure summaries.

One v1.23.0 default hid jobs that never ran, and v1.24.0 reversed it after eval runs showed the opt-in forced extra tool calls. Measure, then decide.

v1.23.0 carries one breaking change: create_pipeline now requires create_webhook.

If your agents work across more than one organization, add ?organization=your-organization to the Remote MCP Server URL. The authorization page then preselects it. It works with toolset and read-only URLs, and leaving it off changes nothing.

GitHub Actions workflows on Buildkite

Fourteen buildkite-gha releases this week:

• Publishes a Linux arm64 runtime in v0.97.0 , so the importer and generated jobs run on arm64 agents. Labels such asubuntu-24.04-arm need an explicit queue mapping, and they never fall back to x86-64 or emulation.
• Resolves job environment values, named secrets, runtime vars , and matrix values in service containerenv andcredentials , acrossv0.94.0 ,v0.95.0 , andv0.96.0 .
• Exposes strategy.job-index ,job-total ,fail-fast , andmax-parallel in job and step expressions inv0.93.0 .fail-fast reports its configured value but still does not cancel sibling matrix jobs.
• Ignores branch, tag, and path filters on ten event families in v0.93.1 , matching GitHub's behavior.
• Raises the changed-file limit from 300 to 3,000 in v0.97.2 , and fixes path-filteredpush workflows that failed when the branch advanced after the push.

You pick these up through the GitHub Actions Buildkite plugin, which installs and verifies the selected CLI release and defaults to the latest stable one. Every release ships with upgrade notes that say exactly what is still unsupported.

Four agent releases, and a clock on v3

Agent v4.1.0 reports cache save and restore timings and sizes back to Buildkite, carries commit, pull request, and build author as OpenTelemetry job span attributes, and fixes intermittent Windows crashes. v4.0.9 redacts Buildkite tokens by prefix in job logs, v4.0.8 redacts captured job errors using the job's registered secrets, and v4.0.7 surfaces cache restore keys, scopes, and policy outcomes in build logs.

Around the agent, Elastic CI Stack for AWS v7.1.0 and v7.2.0 now replace Linux instances whose agent stops responding for three minutes and bundle v4.1.0, the Kubernetes stack completes its move to agent v4 in v0.51.0, and the agent scaler v1.15.0 stores its last scale-in time in SSM Parameter Store so Lambda cold starts stop causing duplicate scale-ins.

From January 1, 2027, we support each minor release line for 1 year from its first stable release, with the final 3 months a deprecation window. Installing an agent or updating to a newer patch does not restart that window.

• v3.115.x and earlier become unsupported on January 1, 2027.
• v3.116.x through v3.121.x become deprecated that day, and stay supported until their own windows end.
• v3 support ends entirely on September 3, 2027.

We will not block out-of-support agents for that reason alone, but we no longer guarantee compatibility. We manage updates for hosted agents, so there is nothing to do there. On self-hosted agents, check the versions across your fleet and plan the move to v4, or read the full agent version support policy.

If you run macOS on hosted agents, new RSS feeds now tell you when a base image changes. The stable feed covers production images, and the canary feed covers the latest Xcode betas and runtimes.

Test splitting moves to shared pools

The Buildkite test engine client 3.2.0 adds bktec pool plan and bktec pool exec for shared Test Scheduler pools, and hosts the protocol and lifecycle for persistent test runners. Pool plan supports dynamic parallelism.

Underneath, bktec releases active leases when it terminates, retains them through transient heartbeat failures, and prefetches the next lease while the current one runs.

Manual test selection comes out of preview, and you can now opt out of git metadata collection. Release candidates went out on September 29 and October 1.

GitHub releases

35 releases across 13 public repos in the buildkite and buildkite-plugins GitHub orgs, newest first. Where one repo shipped a run of releases, they share a row. Dates are US Pacific time.

Subscribe to changelog updates

Point any RSS reader at the Atom feed and new entries arrive as they ship. You can also read the Buildkite changelog.

See you next week!