Control flow

A guard on a pipeline task: if any expression in its `when` list is false, the task is skipped instead of run.

It replaces the removed Conditions CRD. Guards are evaluated by the controller, so a skipped task never creates a Pod.

The structured form of a when expression: an `input` string (usually a param or result reference), an `operator` (`in` or `notin`) and a non-empty list of `values`.

The comparison is plain string matching after variable substitution. Referencing `$(tasks.x.results.y)` in `input` also makes the guarded task wait for x.

An alternative `cel:` field holding a Common Expression Language expression, e.g. `'$(params.branch)'.startsWith('release/')`.

It handles ranges, prefixes, regexes and boolean logic that in/notin can't. Behind the `enable-cel-in-whenexpression` feature flag (alpha); params are substituted as text, so string references need quotes.

When a task is skipped because its when is false, tasks that merely runAfter it still run.

Tekton used to cascade the skip; now the guard is scoped to the task. To skip a whole branch, repeat the guard on each task, or make dependents consume the guarded task's results.

Every skipped task is listed in `status.skippedTasks` with a reason, such as when expressions false, parent tasks skipped, results missing, run stopping, or a timeout reached.

Only a when skip is contained to its task. A task skipped for missing results or a failed run makes its dependents skip too (ParentTasksSkip). The reason tells you which case you hit.

Tasks under `spec.finally` that run in parallel once every DAG task has finished, whether it succeeded, failed or was skipped.

The place for cleanup, notifications and reporting. A failing finally task fails the PipelineRun even if every DAG task passed.

A variable available only to finally tasks: Succeeded, Failed or None (skipped or not run) for one DAG task.

It lets a finally task report, or use a when guard, on how a specific task went without parsing logs.

The aggregate status of all DAG tasks, readable in finally: Succeeded, Failed, Completed (succeeded with some skipped) or None.

The standard way to send a Slack message only on failure: `when: [{input: $(tasks.status), operator: in, values: [Failed]}]`.

Finally tasks can consume DAG task results; if the producing task failed or was skipped, that finally task is skipped.

The skip reason is "Results were missing". The other finally tasks still run, so put a guard-free cleanup task separately.

A field on a pipeline task that fans it out into one TaskRun (or CustomRun) per combination of its array params.

Build or test across platforms × versions without copy-pasting tasks. All combinations run in parallel, and the pipeline task fails if any of them fails.

Named extra entries: params not in the matrix are added to every combination or only to matching ones, and an entry that matches no combination becomes a new one.

Covers the irregular cases, like one extra flag for arm64 or one experimental platform, without blowing up the cartesian product.

Each fanned-out TaskRun emits its own string result; Tekton aggregates them into an array that downstream tasks read whole.

The usual fan-out/fan-in shape: build N images, then publish a single multi-arch manifest from `$(tasks.build.results.IMAGE[*])`.

A config-defaults setting capping how many combinations one matrix may produce (256 by default).

A matrix that would exceed it fails validation, which protects the cluster from a typo that creates thousands of Pods.

Three budgets on a PipelineRun: the whole run, the DAG tasks (from the run's start), and the finally tasks (from when finally starts).

With only a pipeline timeout, hitting it skips finally too. Setting `tasks` reserves the rest for cleanup. tasks + finally must not exceed pipeline, and 0 means no limit.

How many times a failed (or timed-out) pipeline task is re-executed in a fresh Pod before it counts as failed.

It hides flakiness rather than fixing it. Earlier attempts are kept in the TaskRun's `status.retriesStatus` so the history is not lost.

Lets a pipeline task fail without stopping the PipelineRun; its TaskRun is still Failed but dependents run.

Useful for advisory checks like lint or a vulnerability scan that shouldn't block a deploy. The default is stopAndFail. Beta in recent releases.

Patching a PipelineRun's spec.status to Cancelled cancels every running TaskRun and does not run finally.

The hard stop. Cleanup in finally won't happen, so prefer the graceful modes when finally matters.

Graceful cancel: running DAG TaskRuns are cancelled, unstarted ones are skipped, then finally tasks run.

Stop now, but still release locks, delete preview environments and notify.

Graceful stop: running DAG tasks are allowed to finish, no new ones start, then finally runs.

Avoids leaving half-done work, such as a deploy cut off midway, while still not running the rest of the pipeline.

A pipeline task whose taskRef names a foreign apiVersion/kind; Tekton creates a CustomRun and an external controller drives it to a Succeeded condition.

Extends control flow without forking Tekton: waits, approvals, loops over pipelines, or calls to external systems, all scheduled like normal tasks.

A custom task (e.g. the manual-approval-gate ApprovalTask) that blocks the pipeline until enough named approvers approve it.

A human gate before production, enforced inside the PipelineRun instead of by convention. A rejection or timeout fails the CustomRun and stops the run.