Update Konflux references

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	3ab8441 → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	cc75f64 → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	minor	0.10.5 → 0.12.0
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	4619769 → b961f8b
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.4 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	patch	0.4.2 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	5a6cbeb → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	61b27e6 → c06bee8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	eba24f5 → 97231d2
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	eb9d539 → 6a7fbfa
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	7c5575a → 6bb2697

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.12.0

Changed

• Parameter CONTEXTUALIZE_SBOM is now set to false by default. The SBOM
  contextualization received an overhaul, enabling the support for builder
  content contextualization in SBOMs. To get involved in UAT, set this value
  to true and report issues
  to Mobster maintainers.
• When CONTEXTUALIZE_SBOM is set to true, the built image will contain
  new labels, io.buildah.stage.name and io.buildah.stage.base.

v0.11.2

Fixed

• Per-arch RPM filtering for the prefetch SBOM.
  • With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
    include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
    even for images built on other arches.
  • Now, the SBOM will contain the RPMs for the corresponding arch.

v0.11.1

Version 0.11.1 only has relevant changes for the remote variants of this task.

v0.11.0

Changed

• When scanning the built image with Syft, scans the image filesystem as
  a directory instead of scanning the the image as an OCI archive. This improves
  the scanning time, disk usage and may improve memory usage. More details in
  konflux-build-cli/docs/design/syft-image-scanning.md.
• The remote variants of this task now push the built image to the registry directly
  from the build VM instead of rsyncing the image back to the cluster first.
  For large images, this significantly reduces the time spent on network transfers.

Removed

• BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
  in the build step.
• BREAKING: Removed the push step, the push now happens in the build step.
• If you have step overrides configured for either of the two removed steps,
  the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

1. Your PipelineRun references an external Pipeline. In this case, the migration
   script will never get a chance to run on the PipelineRun.
2. Your PipelineRun is multi-platform, SBOM generation needs more resources
   than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
   taskRunSpecs:
     - pipelineTaskName: build-container
       stepSpecs:
-        - name: sbom-syft-generate
+        - name: build
           computeResources:
             requests:
               memory: 16Gi
             limits:
               memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
   params:
     - name: build-platforms
       value:
         - localhost
-        - linux/arm64
+        - linux-mxlarge/arm64

v0.10.7

Fixed

• Thanks to konflux-build-cli#208, the task now supports per-containerfile
  ignore files, same as buildah itself.
  • Previously, the task supported the .containerignore and .dockerignore files
    in the root of the context directory, but not the <containerfile>.containerignore
    and <containerfile>.dockerignore files.

v0.10.6

Fixed

• Attaching SBOM attestations using keyless signing. This stopped working between
  versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
  • Cosign v3 wants to use a "signing config" JSON file instead of accepting
    service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
    of Konflux doesn't provide the config file in the TUF mirror. Fixed
    by setting --use-signing-config=false to still allow direct URLs.

Changed

• Consolidated all keyless signing code in the upload-sbom step.
  Previously, if keyless signing was enabled, the task would sign the image
  in the push step and then the SBOM in upload-sbom step. Now, it will sign both
  in the upload-sbom step. This has no practical impact, but enables a larger
  rework of the push step in the future.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

0.4 is a dummy version used to facilitate the migration from clair-scan 0.3 to roxctl-scan 0.1

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign aredenba-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 23b1bfc0-42b3-4d8b-ba02-c032b3188318

📥 Commits

Reviewing files that changed from the base of the PR and between 94b7a4d and 5b225f9.

📒 Files selected for processing (4)

• .tekton/hyperfleet-applier-chart-pull-request.yaml
• .tekton/hyperfleet-applier-chart-push.yaml
• .tekton/hyperfleet-applier-pull-request.yaml
• .tekton/hyperfleet-applier-push.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual) → reviewed against open PR #358 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-sentinel (manual) → reviewed against open PR #256 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #287 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Security
  • Updated automated image, source, dependency, malware, and RPM signature scanning checks to newer tooling and versions.
  • Replaced the previous image-scanning check with Roxctl-based scanning across pull request and push validation workflows.
  • Refreshed pipeline components used for builds, tagging, repository operations, and Dockerfile publishing to improve reliability and maintain current validation coverage.

Walkthrough

Four Tekton pipeline definitions update pinned task bundle versions and digests. Build, image-index, source-image, security-scan, tagging, Dockerfile-push, and RPM-signature tasks are refreshed. The conditional clair-scan task is replaced with roxctl-scan in each pipeline. Existing skip-checks conditions and image inputs remain in place.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 5b225

This PR updates pinned Konflux task references without any identified merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: pnguyen44, sherine-k

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: The PR changes only four YAML pipeline files. The 64 added lines contain bundle references and the clair-scan to roxctl-scan rename. A precise scan found zero slog, logr, zap, or `fmt.…
No Hardcoded Secrets	✅ Passed	No hardcoded secret was introduced. The PR changes only Tekton bundle names, versions, and OCI sha256 digests. All 56 added bundle values use 64-character hexadecimal digests, not base64-encoded sec…
No Weak Cryptography	✅ Passed	PASS. The pull request changes only four Tekton YAML files. The additions update pinned bundle references and replace clair-scan with roxctl-scan. The added values contain SHA-256 image digests, n…
No Injection Vectors	✅ Passed	PASS. The pull request changes only pinned Tekton bundle references and renames the scan task from clair-scan to roxctl-scan in four .tekton/*.yaml files. The exact diff contains no SQL construc…
No Privileged Containers	✅ Passed	PASS. The commit changes only four .tekton PipelineRun CI manifests. The diff updates Tekton bundle references and renames clair-scan to roxctl-scan; it adds no privileged: true, hostPID, …
No Pii Or Sensitive Data In Logs	✅ Passed	PASS. The pull request changes only four Tekton YAML files. The diff updates task bundle names, versions, digests, and the Clair-to-Roxctl task reference. It adds no slog, logr, zap, log, fmt.Print*, …
Title check	✅ Passed	The title clearly identifies the main change: updating Konflux references, including Tekton bundle versions and digests.
Description check	✅ Passed	The description directly documents the Konflux Tekton bundle updates, affected tasks, version changes, release notes, and configuration.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

Full details: Sec-02: Secrets In Log Output

Explanation

PASS: The PR changes only four YAML pipeline files. The 64 added lines contain bundle references and the clair-scan to roxctl-scan rename. A precise scan found zero slog, logr, zap, or fmt.Print* statements and zero sensitive terms in added lines. Neither the base nor head versions contain these logging APIs in the changed files. No CWE/CVE condition applies.

Full details: No Hardcoded Secrets

Explanation

No hardcoded secret was introduced. The PR changes only Tekton bundle names, versions, and OCI sha256 digests. All 56 added bundle values use 64-character hexadecimal digests, not base64-encoded secrets. No added URL contains embedded credentials, and no added secret/token/password variable has a string literal assignment. Existing git_auth_secret entries remain template references. No CWE/CVE applies.

Full details: No Weak Cryptography

Explanation

PASS. The pull request changes only four Tekton YAML files. The additions update pinned bundle references and replace clair-scan with roxctl-scan. The added values contain SHA-256 image digests, not SHA-1 or banned primitives. Targeted scans found no crypto/md5, crypto/des, crypto/rc4, SHA-1, ECB, HMAC comparison, or custom cryptographic implementation. The referenced upstream roxctl-scan task also contains no explicit banned-primitive usage. No CWE or CVE applies.

Full details: No Injection Vectors

Explanation

PASS. The pull request changes only pinned Tekton bundle references and renames the scan task from clair-scan to roxctl-scan in four .tekton/*.yaml files. The exact diff contains no SQL construction, fmt.Sprintf query, exec.Command or exec.CommandContext, template.HTML, or yaml.Unmarshal/decoder call. No changed source files contain executable code. Therefore, no CWE-89, CWE-78, CWE-79, or CWE-502 injection vector is introduced.

Full details: No Privileged Containers

Explanation

PASS. The commit changes only four .tekton PipelineRun CI manifests. The diff updates Tekton bundle references and renames clair-scan to roxctl-scan; it adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or runAsUser: 0 declaration. The existing privileged-nested parameter remains false by default and is unchanged. The existing Dockerfile:8 USER root line has a documented build-time reason and switches back to non-root; the runtime uses USER 65532:65532. The custom check excludes CI manifests. No CWE/CVE is implicated.

Full details: No Pii Or Sensitive Data In Logs

Explanation

PASS. The pull request changes only four Tekton YAML files. The diff updates task bundle names, versions, digests, and the Clair-to-Roxctl task reference. It adds no slog, logr, zap, log, fmt.Print*, or other logging statement, and no PII, session ID, raw body, or credential-bearing hostname appears in added lines.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[kuudori]

/ok-to-test