chore(deps): update konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	minor	0.1 → 0.3
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	minor	0.1 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	minor	0.4 → 0.11.0
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.2 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	minor	0.2 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check (source, changelog)	tekton-bundle	digest	91ba738 → 8b50144
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	ced089b → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	minor	0.1 → 0.2
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	minor	0.1 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	minor	0.2 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.2 → 0.7.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	minor	0.1 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2 → 0.2.1
quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta (source, changelog)	tekton-bundle	minor	0.2 → 0.3
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	b00fa02 → d33d800
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	minor	0.3 → 0.5
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	minor	0.1 → 0.4
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	tekton-bundle	minor	0.1 → 0.3
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	minor	0.2 → 0.3

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3

• Switched from bash implementation to Konflux Build CLI.
• Deprecated older 0.1 and 0.2 versions.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

v0.3

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.11.0

Changed

• When scanning the built image with Syft, scans the image filesystem as
  a directory instead of scanning the the image as an OCI archive. This improves
  the scanning time, disk usage and may improve memory usage. More details in
  konflux-build-cli/docs/design/syft-image-scanning.md.
• The remote variants of this task now push the built image to the registry directly
  from the build VM instead of rsyncing the image back to the cluster first.
  For large images, this significantly reduces the time spent on network transfers.

Removed

• BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
  in the build step.
• BREAKING: Removed the push step, the push now happens in the build step.
• If you have step overrides configured for either of the two removed steps,
  the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

1. Your PipelineRun references an external Pipeline. In this case, the migration
   script will never get a chance to run on the PipelineRun.
2. Your PipelineRun is multi-platform, SBOM generation needs more resources
   than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
   taskRunSpecs:
     - pipelineTaskName: build-container
       stepSpecs:
-        - name: sbom-syft-generate
+        - name: build
           computeResources:
             requests:
               memory: 16Gi
             limits:
               memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
   params:
     - name: build-platforms
       value:
         - localhost
-        - linux/arm64
+        - linux-mxlarge/arm64

v0.10.7

Fixed

• Thanks to konflux-build-cli#208, the task now supports per-containerfile
  ignore files, same as buildah itself.
  • Previously, the task supported the .containerignore and .dockerignore files
    in the root of the context directory, but not the <containerfile>.containerignore
    and <containerfile>.dockerignore files.

v0.10.6

Fixed

• Attaching SBOM attestations using keyless signing. This stopped working between
  versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
  • Cosign v3 wants to use a "signing config" JSON file instead of accepting
    service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
    of Konflux doesn't provide the config file in the TUF mirror. Fixed
    by setting --use-signing-config=false to still allow direct URLs.

Changed

• Consolidated all keyless signing code in the upload-sbom step.
  Previously, if keyless signing was enabled, the task would sign the image
  in the push step and then the SBOM in upload-sbom step. Now, it will sign both
  in the upload-sbom step. This has no practical impact, but enables a larger
  rework of the push step in the future.

v0.10.5

Added

• Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
  --rhsm-mount-ca-certs option.

v0.10

Fixed

• Thanks to konflux-build-cli#208, the task now supports per-containerfile
  ignore files, same as buildah itself.
  • Previously, the task supported the .containerignore and .dockerignore files
    in the root of the context directory, but not the <containerfile>.containerignore
    and <containerfile>.dockerignore files.

v0.9

Fixed

• Validate base image architecture before build. The task now fails if a base image
  doesn't match the host architecture, preventing silent emulation builds.

v0.8

Fixed

• Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
  for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
  or linux/arm64).

v0.7

Fixed

• Thanks to konflux-build-cli#208, the task now supports per-containerfile
  ignore files, same as buildah itself.
  • Previously, the task supported the .containerignore and .dockerignore files
    in the root of the context directory, but not the <containerfile>.containerignore
    and <containerfile>.dockerignore files.

v0.6

Fixed

• Attaching SBOM attestations using keyless signing. This stopped working between
  versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
  • Cosign v3 wants to use a "signing config" JSON file instead of accepting
    service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
    of Konflux doesn't provide the config file in the TUF mirror. Fixed
    by setting --use-signing-config=false to still allow direct URLs.

Changed

• Consolidated all keyless signing code in the upload-sbom step.
  Previously, if keyless signing was enabled, the task would sign the image
  in the push step and then the SBOM in upload-sbom step. Now, it will sign both
  in the upload-sbom step. This has no practical impact, but enables a larger
  rework of the push step in the future.

v0.5

Added

• Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
  --rhsm-mount-ca-certs option.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

v0.3

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3

Changed

• Replaced clamscan with clamdscan for parallel scanning support.
• Added image-arch parameter for multi-architecture builds.
• Added clamd-max-threads parameter with default of 8 threads.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.7.1

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.1
• Fixes GHSA-rfhj-wcpf-9jcx
• Fixes GHSA-rpww-j58f-22xr
• Fixes GHSA-pxcg-wp85-mcrg
• Fixes GHSA-wx26-fvpq-v9rp

v0.7.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.0
• The .repo file for RPM dependencies is now named hermeto.repo instead of cachi2.repo

v0.6.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

v0.4.1

Fixed

• Mount the trusted-ca volume in the use-trusted-artifact and create-trusted-artifact steps.
  Previously, the mount was missing, which means the task did not support container registries
  with certificates signed by a private/self-signed CA.

v0.4.0

• Hermeto releases from 0.55.0 to 0.57.1 - hermetoproject/hermeto@0.55.0...0.57.1

v0.3.2

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

v0.3

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)

v0.3

Fixed

The migration script wasn't attached to the task bundle.

v0.2

Removed

The task show-sbom is deprecated. The migration script deletes it from the pipeline.

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

v0.3

Added

• BREAKING: new required parameter: BINARY_IMAGE_DIGEST.

  For pipelines that include the build-image-index task, pass its result to this param:

  - name: BINARY_IMAGE_DIGEST
    value: "$(tasks.build-image-index.results.IMAGE_DIGEST)"

  For those that don't, pass the result from the build-container task instead:

  - name: BINARY_IMAGE_DIGEST
    value: "$(tasks.build-container.results.IMAGE_DIGEST)"

  Note: the MintMaker PR updating source-build to v0.3 should apply these changes automatically.

• Started tracking changes in this file.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[psturc]

/retest

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:09 AM UTC · Completed 11:13 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Low

• [parameter-field-ordering] .tekton/tekton-integration-catalog-utils-pull-request.yaml:109 — Inconsistent parameter field ordering in newly added parameters. The new parameters (source-date-epoch, rewrite-timestamp, omit-history) use name → type → default → description order, while enable-package-registry-proxy uses name → default → description → type, and existing parameters use default → description → name → type. Three different ordering patterns coexist. This is cosmetic only — bot-generated YAML in internal CI pipeline definitions; no functional impact.

• [parameter-field-ordering] .tekton/tekton-integration-catalog-utils-push.yaml — Same ordering inconsistency as the pull-request file.

Previous run (2)

Looks good to me

Previous run (3)

Review — ✅ Approve

PR: #109 — chore(deps): update konflux references
Author: red-hat-konflux[bot] (automated dependency update)
Files changed: 2 (.tekton/tekton-integration-catalog-utils-pull-request.yaml, .tekton/tekton-integration-catalog-utils-push.yaml)

Summary

This is an automated Konflux dependency update that bumps 19 Tekton task bundle references to newer versions across both PAC PipelineRun definitions (pull-request and push triggers). The changes include:

1. Task version bumps with SHA256 digest updates — all 19 task bundles updated consistently in both files. All images remain pinned by SHA256 digest (good supply chain security).

2. Migration changes for build-image-index (0.1 → 0.3) — correctly removes deprecated COMMIT_SHA and IMAGE_EXPIRES_AFTER parameters that the upstream changelog confirms were unused.

3. Migration changes for source-build-oci-ta (0.2 → 0.3) — BINARY_IMAGE source correctly updated from $(params.output-image) to $(tasks.build-image-index.results.IMAGE_URL), and new required BINARY_IMAGE_DIGEST parameter added, wired to $(tasks.build-image-index.results.IMAGE_DIGEST).

4. New image-digest parameter added to sast-coverity-check-oci-ta (0.2 → 0.3) and sast-unicode-check-oci-ta (0.1 → 0.4), both correctly wired to $(tasks.build-image-index.results.IMAGE_DIGEST).

5. Minor YAML formatting — CEL expressions and descriptions consolidated to single lines; creationTimestamp: null → creationTimestamp:. No functional impact.

Verification

• ✅ Bundle references are identical between both pipeline files (pull-request and push)
• ✅ All images use SHA256 digest pinning
• ✅ Removed parameters match upstream deprecation/removal documentation
• ✅ New parameters are correctly wired to existing task results
• ✅ No credentials or secrets exposed
• ✅ No injection patterns detected in PR body (standard bot-generated content)

Verdict

No blocking findings. The automated dependency update correctly follows upstream migration guides, maintains digest pinning, and applies changes consistently across both pipeline definitions.

Previous run (4)

Review — approve

PR: #109 — chore(deps): update konflux references
Author: red-hat-konflux[bot] (MintMaker/Renovate)
Files changed: 2 (.tekton/tekton-integration-catalog-utils-pull-request.yaml, .tekton/tekton-integration-catalog-utils-push.yaml)

Summary

Automated dependency update bumping 19 Tekton task bundle references in the two Pipelines-as-Code PipelineRun templates for the tekton-integration-catalog-utils component.

Changes verified

Task version bumps (with interface changes):

• task-init 0.2 → 0.4, task-git-clone-oci-ta 0.1 → 0.2, task-p... 0.2 → 0.3, task-buildah-oci-ta 0.4 → 0.10, task-build-image-index 0.1 → 0.3, task-source-build-oci-ta 0.2 → 0.3, task-s... 0.3 → 0.5, task-clair-scan 0.2 → 0.3, task-e... 0.1 → 0.2, task-clamav-scan 0.2 → 0.3, task-s... 0.2 → 0.3, task-s... 0.1 → 0.4, task-apply-tags 0.1 → 0.3, task-p... 0.1 → 0.3

Digest-only bumps (same version):

• task-c... 0.2, task-d... 0.5, task-rpms-signature-scan 0.2, task-show-sbom 0.1, task-s... 0.1

Parameter adaptations (aligned with upstream interface changes):

• build-image-index: Removed COMMIT_SHA and IMAGE_EXPIRES_AFTER params — confirmed removed in task 0.3 per release notes (unused by implementation)
• build-source-image: BINARY_IMAGE now sourced from $(tasks.build-image-index.results.IMAGE_URL) instead of $(params.output-image); added BINARY_IMAGE_DIGEST param — aligns with source-build-oci-ta 0.3 interface
• sast-coverity-check and sast-unicode-check: Added image-digest param from $(tasks.build-image-index.results.IMAGE_DIGEST) — aligns with task 0.3/0.4 interfaces

Review dimensions

Dimension	Assessment
Correctness	✅ All 19 bundle references updated with sha256 digest pins. Parameter additions/removals match documented upstream task interface changes. Both files have identical structural changes. Task dependency ordering (runAfter) preserved correctly for result references.
Security	✅ All images pinned by sha256 digest. No secrets exposed. No privilege changes. Author is the official Konflux dependency bot.
Intent & coherence	✅ Scope is appropriate — only .tekton build pipeline templates for the utils component. Changes match PR title and body.
Style/conventions	✅ Minor cosmetic changes (creationTimestamp: null → creationTimestamp:, multi-line strings collapsed) are YAML-equivalent and consistent.
Documentation	✅ No documentation updates needed for CI pipeline dependency bumps.
Cross-repo contracts	✅ Parameter changes are properly adapted to new task interfaces. No downstream consumers of these PipelineRun templates are affected.

No findings at or above the severity threshold.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:14 AM UTC · Completed 6:17 AM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:15 AM UTC · Completed 6:23 AM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:12 AM UTC · Completed 6:24 AM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:42 AM UTC · Completed 9:51 AM UTC

Commit: 701e62a · View workflow run →