Failed to sign pipelineRun with error: failed to set finalizers: admission webhook \"webhook.pipeline.tekton.dev\" denied the request: mutation failed: cannot decode incoming new object: json: unknown field \"EnableCELInWhenExpression\"

Expected Behavior

using tekton chain to sign a pipelineRun object

Actual Behavior

after pipelineRun finished. Nothing attached to the pipelineRun annotations and tekton-chains-controller pod throws an error

{"level":"error","ts":"2023-12-06T07:09:27.326Z","logger":"watcher","caller":"controller/controller.go:566","msg":"Reconcile error","knative.dev/controller":"github.com.tektoncd.chains.pkg.reconciler.taskrun.Reconciler","knative.dev/kind":"tekton.dev.TaskRun","knative.dev/traceid":"43907be3-2f94-492f-99dc-e5c59219ff8a","knative.dev/key":"default/cicd-pipeline-pd5pr-cut-commit-id","duration":0.013745541,"error":"failed to set finalizers: admission webhook "webhook.pipeline.tekton.dev" denied the request: mutation failed: cannot decode incoming new object: json: unknown field "EnableCELInWhenExpression"","stacktrace":"github.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).handleErr\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:566\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).processNextWorkItem\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:543\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/controller.(*Impl).RunContext.func3\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/controller/controller.go:491"}

Steps to Reproduce the Problem

1. start a pipelinerun
2. pipelinerun completed
3. watch the tekton chains controller logs

Additional Info

• Kubernetes version:

Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.27.4

• Tekton Pipeline version:

Client version: 0.32.2
Chains version: v0.19.0
Pipeline version: v0.50.3
Triggers version: v0.25.2
Dashboard version: v0.39.0
Operator version: v0.68.1

config-map: chains-config

apiVersion: v1
data:
  artifacts.oci.storage: ""
  artifacts.pipelinerun.format: slsa/v1
  artifacts.pipelinerun.storage: tekton
  artifacts.taskrun.format: in-toto
  artifacts.taskrun.storage: ""
kind: ConfigMap

Start by reproducing the completed PipelineRun with Tekton Pipelines 0.50.3 and Chains 0.19.0, then inspect the tekton-chains-controller admission webhook handling of the EnableCELInWhenExpression field and the chains-config ConfigMap. Done means the PipelineRun is signed, annotations are attached, and the controller no longer reports the decoding error.