Update Konflux references (release-v0.7) (patch) by red-hat-konflux[bot] · Pull Request #3514 · conforma/cli

red-hat-konflux · 2026-08-22T06:39:46Z

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	`0.3` → `0.3.2`
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	minor	`0.3.1` → `0.4`
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	`0.11.0` → `0.11.2`
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	`0.3.2` → `0.4.1`
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	`0.3.1` → `0.3.4`
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	`0ccc688` → `81b7cad`
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	`e438f31` → `cc7d71d`
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	`0.2.5` → `0.2.6`
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	`15d3d4a` → `ba9c197`
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	`0.7.1` → `0.11.0`
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	`350a144` → `e3521e7`
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	`0.2.1` → `0.2.2`
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.1` → `0.1.1`
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.5` → `0.5.1`
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.4` → `0.4.1`
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	patch	`0.3` → `0.3.2`

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

`v0.3.2`

Added

ADDITIONAL_TAGS_FROM_LABEL parameter to specify image label to read additional tags from.
For now set previously hardcoded value konflux.additional-tags by default to avoid changing the task behavior.

`v0.3.1`

Changed

Nothing. Started using semver specification for version labels.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

`v0.4`

Added

IMAGE_PLATFORM_MAP parameter: optional per-image platform mapping
(imageRef=os/arch entries) passed to konflux-build-cli as
--image-platform-map. This sets the platform on each index entry explicitly,
which is required for OCI artifacts whose empty config carries no platform
information (e.g. disk images), where the platform would otherwise be null.
When empty (the default), behaviour is unchanged.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

`v0.11.2`

Fixed

Per-arch RPM filtering for the prefetch SBOM.
- With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
  include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
  even for images built on other arches.
- Now, the SBOM will contain the RPMs for the corresponding arch.

`v0.11.1`

Version 0.11.1 only has relevant changes for the remote variants of this task.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

`v0.4.1`

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

`v0.3.4`

Added

Pre-extract every nested archive into a loose file tree before scanning, so
clamd scans each file directly instead of recursing through nested archive
layers. This makes scanning of deeply nested archives faster. Extraction uses
bsdtar, which detects archives (zip/jar/war/ear/tar
and tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
the OCI dir: payload is an extension-less blob — and unpacks them
unconditionally with no size/count/depth limits. It is defensive: a corrupt or
partial archive is left in place for clamd rather than aborting the scan. No new
parameters are introduced. Requires the clamav-db image to ship bsdtar
(added in konflux-clamav).

`v0.3.3`

Changed

Skip downloading OCI layers whose manifest annotations name only unscannable
model-weight files (.safetensors, .gguf, .ggml, .pt, .pth, .onnx,
.onnx_data / .onnx_data_*), using org.opencontainers.image.title and
olot.layer.content.inlayerpath. Any other annotated layer is skipped when
the OCI descriptor size is at least 2000MiB (slightly under ClamAV's ~2GiB
MaxFileSize), regardless of extension. Layers without those annotations are
still listed with --dry-run as in 0.3.2. The --dry-run skip uses the
same name list.

`v0.3.2`

Added

Skip extracting OCI layers that contain only unscannable model-weight files
(.safetensors, .gguf, .ggml). Other layers are still extracted and
scanned. If layer listing fails, the task falls back to extracting the
full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

`v0.11.0`

Changed

Renamed Trusted Artifact result CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use buildah-oci-ta >= 0.14.0 and source-build-oci-ta >= 0.4.0 for naming
consistency of the result.

`v0.10.1`

Changed

When input is empty, only run the skip-ta step and skip other steps
Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

`v0.10.0`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

`v0.9.0`

Added

Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
and pass it to the prefetch-dependencies task.

`v0.8.0`

Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)

`v0.1.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)

`v0.5.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)

`v0.4.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

`v0.3.2`

Fixed

Cargo prefetched dependencies are now included in the source image. They are
vendored as unpacked source trees rather than archives, so previously they
were missed by the archive-type filter and left out of the source image.

`v0.3.1`

Changed

Nothing. Started using semver specification for version labels.

Configuration

📅 Schedule: (UTC)

Branch creation
- Only on Saturday (* * * * 6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

fullsend-ai-review · 2026-08-22T06:40:54Z

🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:47 AM UTC

Commit: 87c4a29 · View workflow run →

codecov · 2026-08-22T06:46:45Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	`69.55% <ø> (ø)`
integration	`69.55% <ø> (ø)`
unit	`69.55% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-08-22T06:47:54Z

Review

Findings

Low

[scope-bundling] .tekton/cli-v07-pull-request.yaml:329 — The clair-scan task is replaced with roxctl-scan in the v0.7 pipelines. While this is a scanner tool substitution rather than a version bump, the main branch pipelines already use roxctl-scan, confirming the migration was previously authorized. This update aligns the v0.7 branch with the established pattern.
[stale-reference] hack/view-clair-reports.sh:39 — The script queries attestation data for tasks named clair-scan (select(.name=="clair-scan")), but no pipeline in the repository uses clair-scan anymore. The main branch already migrated to roxctl-scan previously; this PR completes the migration for v0.7 pipelines, making the script fully non-functional. This is pre-existing technical debt that may warrant a separate cleanup.
Remediation: Update the jq filter to also match roxctl-scan, or remove the script if clair-scan support is no longer needed.

Previous run

Review

Findings

Low

[scope-authorization-implicit] .tekton/cli-v07-pull-request.yaml:329 — The pipeline task clair-scan is replaced by roxctl-scan (bundle switched from task-clair-scan:0.3.2 to task-roxctl-scan:0.1). This is a security scanner swap (Clair CVE scanning → StackRox/ACS roxctl), not a version bump of the same tool. The Renovate label and red-hat-konflux[bot] authorship implicitly authorize routine Konflux reference updates, but a scanner replacement is a distinct tooling decision with no linked issue or in-repo rationale.
Remediation: Confirm the project accepts replacing Clair with roxctl/ACS as the image vulnerability scanner on release-v0.7 (e.g., link the upstream Konflux deprecation note or add a brief rationale in the PR description). No code change required; the finding is advisory.
[scope-authorization-implicit] .tekton/cli-v07-push.yaml:328 — Mirror of the previous finding in the push pipeline: clair-scan is replaced by roxctl-scan. Same scope-authorization concern applies.
Remediation: Addressed by the same confirmation as the pull-request pipeline finding above.

Previous run (2)

Review

Findings

Medium

[api-contract] cmd/sigstore/initialize.go:68 — The cosign v2.6.2 upgrade adds a new --root-checksum flag via opts.AddFlags(cmd), but the RunE handler only passes opts.Root and opts.Mirror. Since DoInitialize calls doInitialize with forceSkipChecksumValidation: true, any --root-checksum value is silently ignored. A user relying on this flag for root integrity verification would have a false sense of security.
Remediation: Update sigstoreInitializeFunc to pass opts.RootChecksum through. When non-empty, call initialize.DoInitializeWithRootChecksum. Alternatively, hide the --root-checksum flag if the feature is intentionally not supported.
[scope-creep] .tekton/cli-v07-pull-request.yaml — The PR description table (generated by Renovate) characterizes the clair-scan change as a minor version bump (0.3.2 → 0.4.1), but the actual diff replaces task-clair-scan entirely with task-roxctl-scan:0.1. This is a tool substitution, not a version bump. The mismatch between the bot-generated description and the actual change warrants reviewer attention.

Low

[stale-reference] benchmark/offliner/scans.go:90 — The pipeline task clair-scan is renamed to roxctl-scan in both .tekton/ YAML files, but benchmark/offliner/scans.go (line 90) and hack/view-clair-reports.sh (line 39) still search for clair-scan. New attestations will use roxctl-scan, causing these tools to silently return empty results.
Remediation: Update both files to handle roxctl-scan (or both names for backward compatibility).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Medium

[stale-reference] benchmark/offliner/scans.go:90 — The Go benchmark code filters tasks by task["name"] != "clair-scan". After this PR merges, pipelines on the release-v0.7 branch will produce attestations with the task named roxctl-scan instead of clair-scan. This code will no longer match those attestation results, causing it to silently skip the scan results. The TODO comment on line 89 acknowledges this fragility.
Remediation: Update line 90 to also match roxctl-scan, e.g.: if task["name"] != "clair-scan" && task["name"] != "roxctl-scan". Alternatively, switch to matching by task reference as the TODO suggests.
[stale-reference] hack/view-clair-reports.sh:39 — The helper script uses select(.name=="clair-scan") to extract scan reports from attestations. After this rename, attestations from v0.7 branch builds will have the task named roxctl-scan, so this script will produce empty output for those images.
Remediation: Update the jq filter to also match roxctl-scan: select(.name=="clair-scan" or .name=="roxctl-scan").

Low

[scope-body-divergence] .tekton/cli-v07-pull-request.yaml — The PR body table describes the clair-scan update as a version bump from 0.3.2 to 0.4.1, but the actual diff replaces clair-scan entirely with roxctl-scan:0.1. This is generated by Renovate's replacementName feature when handling an upstream package deprecation.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

[scope-authorization-mismatch] .tekton/cli-v07-pull-request.yaml:329, .tekton/cli-v07-push.yaml:328 — The PR description (generated by Renovate/MintMaker) claims this is a minor version bump of task-clair-scan from 0.3.2 to 0.4.1. However, the actual diff replaces the clair-scan task entirely with a different scanning tool: task-roxctl-scan:0.1. This is not a version update — it is a tool substitution. The task name changes from clair-scan to roxctl-scan, the taskRef name changes, and the bundle reference switches from task-clair-scan to task-roxctl-scan. The roxctl-scan task is at version 0.1, indicating this is the initial release of a new tool being introduced into the CI pipeline. The same change occurs in both pipeline files.
Remediation: A human reviewer must verify that the clair-scan to roxctl-scan migration is intentional and approved. If the Konflux platform has deprecated clair-scan in favor of roxctl-scan, the PR description should be updated to accurately describe the tool replacement rather than presenting it as a version bump.

Low

[stale-reference] benchmark/offliner/scans.go:90 — The benchmark code filters tasks by the name clair-scan. After the rename to roxctl-scan in v0.7 pipeline definitions, this filter will silently skip the scan task when run against v0.7 pipeline results, producing incomplete benchmark data with no error.
[stale-reference] hack/view-clair-reports.sh:39 — The helper script filters for task results where .name=="clair-scan". After the rename to roxctl-scan in v0.7 pipelines, this script will return no results when pointed at v0.7 pipeline runs.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Looks good to me

fullsend-ai-review · 2026-08-29T07:08:35Z

🤖 Finished Review · ✅ Success · Started 7:08 AM UTC · Completed 7:23 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.12

simonbaird · 2026-09-02T18:02:13Z

I did a rebase manually to see if it goes green.

fullsend-ai-review · 2026-09-02T18:03:10Z

🤖 Finished Review · ✅ Success · Started 6:03 PM UTC · Completed 6:15 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.99

fullsend-ai-review · 2026-09-02T18:15:37Z

Risk Assessment: low (1/5)

Details

Automated Konflux bot PR updating 2 Tekton release-branch pipeline files with 92 changed lines, no protected or security-sensitive paths, and no Go dependency changes; Tier 1 signals unchanged from prior assessment and Tier 2 remains a moderate baseline because the release-branch files are absent from the main-branch git history, yielding a weighted composite of 1.38 (rounds to 1).

Previous run

Risk Assessment: low (1/5)

Details

Automated Renovate bot PR updating 2 Tekton pipeline files with 84 changed lines, no protected or security-sensitive paths, and no Go dependency changes; Tier 2 set to moderate baseline because the release-branch files are absent from the main-branch git history, yielding a weighted composite of 1.38 (rounds to 1).

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-authored dependency update with 8 files and 167 lines changed, two dependency files modified (go.mod/go.sum), no protected or security-sensitive paths, low git churn, moderate code age across changed files.

Previous run (3)

Risk Assessment: low (1/5)

Details

Minimal-risk automated bot PR updating Konflux CI pipeline references on a release branch. Only 2 Tekton YAML files changed with 68 lines (symmetric additions/deletions suggesting version bumps). No protected paths, no security-sensitive files, no dependency changes. Bot author with prior contributions. Pure CI configuration update with no functional code impact.

fullsend-ai-review · 2026-09-02T20:04:37Z

🤖 Review · ⚠️ Cancelled · Started 8:04 PM UTC · Ended 8:05 PM UTC

Commit: ca5794c · View workflow run →

fullsend-ai-review · 2026-09-02T20:06:10Z

🤖 Finished Review · ✅ Success · Started 8:06 PM UTC · Completed 8:27 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $10.01

coderabbitai · 2026-10-10T04:10:07Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2d838582-265f-4094-a683-ff1c082fa1d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-10-10T04:11:47Z

🤖 Finished Review · ✅ Success · Started 4:11 AM UTC · Completed 4:20 AM UTC

Commit: d82bc4d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $5.44

Superseded by updated review

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review · 2026-10-24T07:23:33Z

🤖 Review · ⚠️ Cancelled · Ended 7:23 AM UTC

Commit: 51099a5 · View workflow run →

fullsend-ai-review · 2026-10-24T07:25:27Z

🤖 Finished Review · ✅ Success · Started 7:25 AM UTC · Completed 7:42 AM UTC

Commit: bfeaa4e · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.33

Superseded by updated review

red-hat-konflux Bot added release-v0.7 renovate labels Aug 22, 2026

github-actions Bot added the size: S label Aug 22, 2026