Tech newsbuildkite adds scoped secrets and new agentic CI toolsposted on. Share with your friends! Buildkite has rolled out pipeline-scoped secrets, new agentic CI tools and a series of related updates aimed at tightening security and making build troubleshooting easier for AI-assisted workflows. The changes span its core CI platform, open-source MCP server, GitHub Actions compatibility layer and Buildkite Agent v4.1.0. Pipeline-scoped secrets move closer to the work they protect. The new secrets view appears under Pipeline settings and lets teams create cluster secrets that are restricted to a single pipeline instead of being managed only at the broader cluster level. Buildkite says teams can also narrow access further with conditions based on branch, queue, build source or build creator. Secret values are hidden after creation, and users need permission to both edit the pipeline and manage the cluster. For GitHub Actions pipelines, Buildkite now shows a prompt that links to secret configuration before the first workflow runs. Matt Mejia, writing in Buildkite's announcement, said the update "keeps pipeline-specific secrets together" while still showing how many other secrets the cluster manages. He also noted that "pipeline secrets are cluster secrets restricted to the current pipeline, and branch, queue, build source, or creator conditions narrow access further." Buildkite expands secret handling across the CLI and agents. Buildkite's CLI now includes a command for migrating GitHub Actions secrets, and version 3.59.1 fixes relative workflow path handling during that migration. The company also shipped redaction improvements in its agents: v4.0.9 redacts Buildkite tokens by prefix in job logs, while v4.0.8 redacts captured job errors using secrets registered for the job. Those changes address multiple places where credentials can be exposed or configured incorrectly. At the same time, Buildkite's own guidance still emphasizes that teams should only expose a secret to the steps that actually need it, so scoped storage does not eliminate the need for careful use inside pipelines. Agentic CI tools aim to help AI repair broken pipelines. The most substantial additions are in Buildkite's open-source MCP server, which now includes tools designed for AI coding agents. The new validate_pipeline tool checks pipeline YAML syntax and structure against Buildkite's official schema without uploading the file or starting a build. It returns paths and error messages that an agent can use to correct invalid steps. Buildkite says the tool does not cover environment variable interpolation, plugin configuration, dependency references or dynamically generated steps. That makes it useful for early validation, but not a complete substitute for full pipeline execution. A second tool, compare_builds, compares a failed build with the most recent earlier successful build on the same branch, or with another selected build. It reports steps that are newly failing, recovered or still broken, along with runtime and retry changes. For up to three newly failing steps, it also includes the end of the job log so an agent gets some immediate diagnostic context. Matt Mejia summed up one of the main design goals with the line: "Log access alone does not debug a build." More repair and inspection functions. * create_pipeline_webhook can add a missing GitHub webhook to an existing pipeline. * Test Engine execution traces and slowest-execution queries are now available in the MCP release. * Remote MCP connections can be pinned to one Buildkite organization by adding it to the server URL. * Buildkite reversed an earlier default so failure summaries once again include jobs that never ran. Buildkite said it made that change after evaluations showed that making the behavior optional caused agents to make extra tool calls. It also noted that version 1.23.0 changed create_pipeline so callers must specify create_webhook, which is a breaking change. GitHub Actions compatibility gets broader Linux arm64 support. Buildkite's GitHub Actions compatibility layer now supports Linux arm64 for both its importer and generated jobs. Labels such as ubuntu-24.04-arm require an explicit queue mapping and will not fall back to x86-64 or emulation. That should help organizations running arm64 CI fleets keep the same architecture when moving compatible GitHub Actions workflows to Buildkite. The compatibility layer also received fixes for environment values, named secrets, runtime variables and matrix values in service-container configuration. Other updates expose more strategy.* values to job and step expressions. Buildkite also increased the changed-file limit used by path filters from 300 to 3,000, and fixed a push-workflow issue where a branch moved after the original push. Buildkite Agent v4.1.0 adds richer telemetry. Buildkite Agent v4.1.0 adds cache save and restore durations and sizes to Buildkite telemetry. OpenTelemetry job spans now include the commit, pull request and build author, giving teams more context when investigating slow jobs or retry patterns. The company pointed to earlier usage patterns from customers such as Pinterest, which described using Honeycomb with Buildkite to separate agent waiting time from script execution and identify jobs contributing to build-time spikes. Elastic CI Stack v7 brings Agent v4 to AWS. The related Elastic CI Stack v7 release brings Agent v4 to Linux and Windows instances on AWS. It removes support for Agent v3 and retires or replaces some tracing and cancellation parameters. Buildkite recommends reviewing custom parameter files, deployment automation and values supplied through AgentEnvFileUrl before upgrading. Support for all Agent v3 releases ends on 3 September 2027, giving teams a long runway but also a clear deadline for migration planning. Was this helpful? Click on one of the buttons to rate this post. Your choice cannot be undone, but you can change your mind at any time. Last Modified: October 19, 2026 at 10:32 pm Next up on Hashe tech news. 19-Oct-2026. About Hashe Computer Solutions (Pvt) Ltd.. Hashe Computer Solutions (Pvt) Ltd. was established in 1998 and is a global consulting and IT services company. Hashe provides expert analysts and development teams, who translate corporate strategies into creative, robust, and cost-effective systems that leverage a client's unique competitive advantage resulting in shorter time-to-market cycles. Hashe Computer Solutions (Pvt) Ltd. also offer complete outsourcing solutions from software development to after development mission-critical-level support. Latest blogs. Follow Hashe Computer Solutions (Pvt) Ltd.. Regional offices. Mr. Roger peterson. Chicago USA. Mr. Glenn robertson. Indianapolis USA. Mr. James george. San diego USA. Mr. Dennis wallace. Washington DC USA. Mr. Brian loebig. Midlands UK. Mr. Andrew clarke. Urunga NSW australia. Mr. Ben bassey. Get in touch. Head office. 225 Cavalry Grounds, Street 5, Lahore 54810, Pakistan. Email. Phone. Mr. Mamoon rashid. Director & CEO

Buildkite adds scoped secrets and new agentic CI tools. * Matt Saunders DevOps, DevEx, Platform Engineering, Fast Flow at Adaptavist Follow InfoQ on. Continuous integration provider Buildkite has introduced pipeline-scoped secrets and new Model Context Protocol tools for validating pipelines, diagnosing failed builds and repairing webhooks. The company has also added Linux arm64 support to its GitHub Actions compatibility layer and expanded OpenTelemetry data in Buildkite Agent v4.1.0. The new secrets view is available under Pipeline settings. It lets engineers create cluster secrets whose access is restricted to the current pipeline, rather than managing every secret from the wider cluster interface. Teams can add conditions for a branch, queue, build source or build creator. Secret values remain hidden after creation. Matt Mejia, writing in Buildkite's announcement, says the change "keeps pipeline-specific secrets together" while showing how many other secrets the cluster manages. Users need permission both to edit the pipeline and manage its cluster. GitHub Actions pipelines also display a prompt linking to secret configuration before their first workflow runs. "Pipeline secrets are cluster secrets restricted to the current pipeline, and branch, queue, build source, or creator conditions narrow access further." Matt Mejia The Buildkite CLI now includes a command for migrating GitHub Actions secrets. Version 3.59.1 fixes handling of relative workflow paths during that migration. Agent v4.0.9 also redacts Buildkite tokens by prefix in job logs, while v4.0.8 redacts captured job errors using secrets registered for the job. The work addresses several places where credentials can be exposed or configured incorrectly, although scoped storage does not remove the need to control their use inside steps. InfoQ reported in 2025 that HashiCorp was advocating prevention-first secret management throughout developer tools and CI/CD systems. Buildkite's own documentation advises teams to expose a secret only to the steps that require it. The most extensive feature changes are in Buildkite's open-source MCP server. The new validate_pipeline tool checks pipeline YAML syntax and structure against Buildkite's official schema without uploading it or starting a build. It returns paths and error messages that an AI coding agent can use to correct invalid steps. The check does not cover environment variable interpolation, plugin configuration, dependency references or dynamically generated steps. A second tool, compare_builds, compares a failed build with the most recent earlier successful build on the same branch, or with another selected build. It reports steps that have newly failed, recovered or remained broken, together with changes in runtime and retries. For up to three newly failing steps, it includes the end of the job log so an agent has some immediate diagnostic context. "Log access alone does not debug a build." Matt Mejia The MCP release also adds Test Engine execution traces and slowest-execution queries. Another tool, create_pipeline_webhook, can add a missing GitHub webhook to an existing pipeline, avoiding the need to recreate it. Version 1.23.0 changed create_pipeline so that callers must specify create_webhook, which is a breaking change. Buildkite reversed one earlier default after running evaluations, with failure summaries now again including jobs that never ran because making that behaviour optional led agents to issue extra tool calls. Remote MCP connections can now be pinned to one Buildkite organisation by adding it to the server URL. The option works with both toolset and read-only URLs. Giving agents discrete validation, comparison and repair tools should reduce their reliance on parsing full logs and composing lower-level API calls. Permissions remain important because webhook repair and pipeline creation can modify CI configuration. InfoQ's coverage of GitHub agentic workflows describes a related security model based on isolated execution, restricted permissions and auditable actions. Buildkite's GitHub Actions compatibility layer can now run its importer and generated jobs on Linux arm64 agents. Labels such as ubuntu-24.04-arm require an explicit queue mapping and do not fall back to x86-64 or emulation. The feature allows organisations with arm64 CI fleets to retain that architecture when bringing compatible Actions workflows to Buildkite. Other compatibility fixes resolve environment values, named secrets, runtime variables and matrix values in service-container configuration. Buildkite has also exposed more strategy.* values to job and step expressions. The changed-file limit used by path filters has risen from 300 to 3,000, alongside a fix for push workflows where a branch moved after the original push. Agent v4.1.0 adds cache save and restore durations and sizes to Buildkite telemetry. OpenTelemetry job spans now include the commit, pull request and build author. These fields add context for teams investigating slow jobs or retry patterns. Pinterest previously described using Honeycomb with Buildkite to separate agent waiting time from script execution and identify jobs behind build-time spikes. The associated Elastic CI Stack v7 release brings Agent v4 to Linux and Windows instances on AWS. It removes Agent v3 support and retires or replaces some tracing and cancellation parameters. Buildkite advises users to review custom parameter files, deployment automation and values supplied through AgentEnvFileUrl before upgrading. Support for all Agent v3 releases ends on 3 September 2027. Matt Saunders. I am VP DevOps at Adaptavist. I help teams use DevOps, platform engineering and cloud-native tools and technologies to deliver reliable quality software quickly and efficiently and with minimal stress. I've worked with complex enterprises, small start-ups, SMEs and everything in between. I also co-organise the London DevOps meetup group, which has over 10,000 members, hosting a hugely popular monthly industry event.

Australian software developer Buildkite has secured $21 million through a convertible note as the company faced dwindling cash reserves and mounting losses whilst undergoing a leadership transition. The financing comes as artificial intelligence is driving renewed demand for Buildkite's coding tools. The company has not disclosed investor details, pricing, or conversion terms for the note. This marks Buildkite's first announced funding since its $21 million Series B in 2022, which was co-led by Airtree and OneVentures. The company did not respond to requests for comment regarding the new financing arrangement. The convertible note provides crucial runway for Buildkite as it navigates operational challenges and capitalises on emerging opportunities in the AI-driven development tools market.