Chitrang Patel

> Thanks, this looks good! Could you add a "negative" test to see that propagation on a referenced task is not allowed? Done! PTAL!

/approve

I think this is a general issue in param substitutions. This is true for even Tasks. My guess is that we do not perform substitution of params into other params...

/ok-to-test

/retest

/retest

/retest

/lgtm Will fix the linter issues caused by deprecated intoto-golang structs and functions in a followup PR

/approve /lgtm

Please fix the linter errors and add a release note.