Can You Trust Your CI? Building Reproducible Pipelines with Tekton

Most CI/CD pipelines answer one question: Did the build succeed? Very few answer another equally important one: Can the build be reproduced and verified independently?

In this session, we'll explore reproducible builds, why identical artifacts matter, and how hidden sources of nondeterminism creep into modern build systems. Using Tekton and Tekton Chains, we'll build deterministic pipelines, verify identical container image digests across independent runs, and generate provenance that can be independently validated.

The session is packed with practical demonstrations and techniques that attendees can apply to improve the reliability, auditability, and trustworthiness of their own CI/CD pipelines.

• Understand what reproducible builds are and why they are critical for software supply chain security.

• Learn the common sources of non-determinism in modern CI/CD pipelines and how to eliminate them.

• Discover how Tekton enables deterministic, hermetic, and reproducible build workflows.

• See how to verify build reproducibility by comparing identical container image digests across independent pipeline runs.

• Learn how Tekton Chains generates SLSA-compliant provenance to improve artifact integrity and traceability.

• Walk away with practical patterns that can be applied to existing CI/CD pipelines to make builds more transparent, auditable, and trustworthy.