持续集成服务提供商 Buildkite 推出了限定流水线作用域的密钥，以及用于验证流水线、诊断构建失败和修复 Webhook 的新模型上下文协议（MCP）工具。该公司还为其 GitHub Actions 兼容层增加了 Linux arm64 支持，并扩展了 Buildkite Agent v4.1.0 中的 OpenTelemetry 数据。
新的密钥视图位于流水线设置中。工程师可以在此创建仅限当前流水线访问的集群密钥，而不必通过范围更广的集群界面管理每个密钥。团队还可以按分支、队列、构建来源或构建创建者添加访问条件。密钥值在创建后仍会保持隐藏。
Matt Mejia 在 Buildkite 的公告中表示，这项改动“将流水线专用密钥集中在一起”，同时显示集群还管理着多少其他密钥。用户需要同时拥有编辑该流水线和管理其所属集群的权限。GitHub Actions 流水线在首次运行工作流之前，也会显示一个指向密钥配置的提示。
流水线密钥是仅限当前流水线使用的集群密钥，而分支、队列、构建来源或创建者条件可以进一步缩小访问范围。
Buildkite CLI 现在包含用于迁移 GitHub Actions 密钥的命令。3.59.1 版本修复了迁移过程中对相对工作流路径的处理。Agent v4.0.9 还会在作业日志中按前缀遮盖 Buildkite 令牌，而 v4.0.8 会使用为作业注册的密钥遮盖捕获到的作业错误。
这些改动针对的是凭证可能暴露或配置错误的多个环节，但限定存储作用域并不能消除控制密钥在步骤中如何使用的必要性。InfoQ 在 2025 年曾报道，HashiCorp 主张在开发者工具和 CI/CD 系统中采用预防优先的密钥管理方式。Buildkite 自己的文档也建议团队只向需要密钥的步骤提供密钥。
功能变化最多的是 Buildkite 的开源 MCP 服务器。新的 validate_pipeline 工具会根据 Buildkite 的官方模式检查流水线 YAML 的语法和结构，无须上传文件或启动构建。它会返回路径和错误信息，供 AI 编码智能体修正无效步骤。该检查不涵盖环境变量插值、插件配置、依赖引用或动态生成的步骤。
第二个工具 compare_builds 会将失败的构建与同一分支上最近一次成功的构建，或另一个指定构建进行比较。它会报告哪些步骤是新出现的失败、已恢复或仍然失败，并列出运行时间和重试情况的变化。对于最多三个新失败的步骤，它还会附上作业日志的末尾内容，为智能体提供一些即时诊断信息。
仅能访问日志，并不等于能够调试构建。
此次 MCP 版本还增加了 Test Engine 执行轨迹和最慢执行项查询。另一个工具 create_pipeline_webhook 可以为现有流水线补上缺失的 GitHub Webhook，无须重新创建流水线。1.23.0 版本修改了 create_pipeline，要求调用方必须指定 create_webhook；这是一项破坏性变更。
在进行评估后，Buildkite 恢复了此前的一项默认行为：失败摘要现在再次包含那些从未运行的作业，因为将这一行为设为可选会导致智能体发起额外的工具调用。现在还可以通过将 Buildkite 组织添加到服务器 URL，把远程 MCP 连接限定到单个组织。该选项适用于工具集 URL 和只读 URL。
为智能体提供独立的验证、比较和修复工具，应能减少它们对解析完整日志和组合底层 API 调用的依赖。权限仍然重要，因为修复 Webhook 和创建流水线都可能修改 CI 配置。InfoQ 对 GitHub 智能体工作流的报道介绍了一种相关的安全模型，其基础是隔离执行、受限权限和可审计的操作。
Buildkite 的 GitHub Actions 兼容层现在可以在 Linux arm64 Agent 上运行导入器和生成的作业。ubuntu-24.04-arm 等标签需要显式配置队列映射，不会回退到 x86-64 或仿真运行。对于拥有 arm64 CI 集群的组织，这项功能使它们在将兼容的 Actions 工作流迁移到 Buildkite 时，能够继续使用这一架构。
其他兼容性修复解决了服务容器配置中的环境值、命名密钥、运行时变量和矩阵值问题。Buildkite 还向作业和步骤表达式开放了更多 strategy.* 值。路径过滤器使用的变更文件数量上限从 300 提高到 3000，同时修复了原始推送后分支发生移动时的推送工作流问题。
Agent v4.1.0 在 Buildkite 遥测数据中增加了缓存保存和恢复的耗时及大小。OpenTelemetry 作业跨度现在包含提交、拉取请求和构建发起者信息。这些字段为团队调查慢作业或重试模式提供了更多上下文。Pinterest 此前曾介绍如何结合 Honeycomb 与 Buildkite，区分 Agent 等待时间和脚本执行时间，并找出导致构建耗时激增的作业。
配套的 Elastic CI Stack v7 版本在 AWS 上的 Linux 和 Windows 实例中引入了 Agent v4。它移除了对 Agent v3 的支持，并停用或替换了部分追踪和取消操作参数。Buildkite 建议用户在升级前检查自定义参数文件、部署自动化配置，以及通过 AgentEnvFileUrl 提供的值。所有 Agent v3 版本的支持将于 2027 年 9 月 3 日结束。
原文链接：
https://www.infoq.com/news/2026/10/buildkite-ci-secrets-agentic/
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Buildkite, a continuous integration service provider, introduced the key to limiting the current line domain and the new model context protocol (MCP) tool for verifying stream lines, diagnostic failure and repair of Webhook. It also added Linux arm64 support to its GitHub Actions compatibility layer and expanded OpenTelemetry data from Buildkite Agent v4.1.
The new key view is in the flow line settings. Engineers can create cluster keys that are restricted to current water lines, without having to manage each key through a broader cluster interface. The team can also add access conditions by branch, queue, build source or build creator. The key will remain hidden after it is created.
Matt Mejia, in the Buildkite bulletin, stated that the change “concentrates the dedicated water line key together” and shows how many other keys the cluster manages. Users need to also have permission to edit the current line and manage their clusters. GitHub Actions also shows a hint for key configuration before the first run of workflow.
The flow line key is a cluster key limited to the current flow line, and branch, queue, build source or creator condition can further narrow access.
Buildkite CLI now contains commands for moving GitHub Actions keys. 3.59.1 Versions repair the treatment of the relative workflow path during the migration. Agent v4.0.9 also hides the Buildkite token by prefix in the job log, while v4.0.8 uses the key to register the captured job error.
These changes address multiple links where the document may be exposed or configured, but limiting the storage domain does not obviate the need to use the control key at the step. InfoQ reported in 2025 that HashiCorp advocated a precautionary key management approach in the Developer Tool and CI/CD system. Buildkite's own document also suggests that the team provide the key only to steps that require the key.
The most significant change in functionality is the open source MCP server for Buildkite. The new valaidate pipeline tool examines the syntax and structure of the water line YaML according to the official Buildkite model, without uploading the file or starting construction. It returns path and error information for AI code AI agent to correct invalid steps. The check does not cover environmental variables plug-ins, plugin configuration, reliance on references or dynamically generated steps.
The second toolcompare builds compares failed construction with the latest successful construction in the same branch, or another specified build. It will report on steps that are emerging, restored or still failing, as well as on changes in running time and retry. For a maximum of three new failed steps, it will also be accompanied by the end of the operational log, which will provide some immediate diagnostic information for AI agent.
Accessing logs only does not debug construction.
This MCP version also added the Teest Engineering execution track and the slowest execution entry query. Another tool can replace the missing GitHub Webhuk on the existing stream line without recreating the stream line. Version 1.23.0 modified Create peline, requiring the caller to specify create webhook; this is a destructive change.
Following the assessment, Buildkite reverted to an earlier default: failed summary now again included operations that had never been in operation, because setting it as optional would result in AI agent initiating additional tool call. It is also possible to limit remote MCP connections to individual organizations by adding the Buildkite organization to the server URL. This option applies to URLs for toolsets and read-only URLs.
Providing an independent validation, comparison and restoration tool for AI agent should reduce their reliance on the full log and combination of bottom API calls. permission is still important because repairing Webbook and creating a streaming line may modify the CI configuration. InfoQ reports on GitHub AI agentZ52Z describe a related security model based on isolated, restricted permission and auditable operations.
The GitHub Actions Compatibility of Buildkite can now run the importer and the resulting operation on Linux arm64 Agent. tabs such as ubuntu-24.04-arm require a visible configuration queue map, which does not run from rollback to x86-64. For organizations with arm64 CI clusters, this function enables them to continue using this structure when moving compatible Actions workflow to Buildkite.
Other compatibility restorations address environmental values, naming keys, running time variables and matrix values in the service container configuration. Buildkite has also opened up more strategy.* values for operation and step expressions. The maximum number of file changes used by the path filter was raised from 300 to 3000, while the problem of workflow was repaired when the original push-post branch moved.
Agent v4.1.0 added cache preservation and restoration time-consuming and size to the Buildkite telemetry data. OpenTelemetry now contains submission, pull request and build sponsor information. These fields provided additional contexts for the team survey slow work or the retry model. Pinterest has previously described how to combine Honeycomb with Buildkite, to distinguish between the Agent waiting time and the execution time of the script, and to identify the operations that lead to a time-consuming build.
A companion version of Elastic CI Stack v7 introduces Argentina v4 in Linux and Windows examples on AWS. It removes support for Agent v3 and disables or replaces part of the tracking and cancellation parameters. Buildkite recommends that users check the custom parameter files before upgrading, deploy automated configurations, and values provided through AgentEnvFileUrl. All Agent v3 versions of support will end on 3 September 2027.
Original link:
https://www.infoq.com/news/2026/10/buildkite-ci-secrets-agentic/
Auto-fetched and translated by AI Atlas. All rights belong to the original author.