Update Konflux references (release-v0.7)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	da0cff2 → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	b00c9e6 → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.11.0 → 0.11.2
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	e438f31 → b961f8b
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.5 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	15d3d4a → 5f68715
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.7.1 → 0.10.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	350a144 → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2.1 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	d33d800 → c06bee8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	f4818f8 → 97231d2
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	f31055c → 6a7fbfa
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	93f1df1 → 6bb2697

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.11.2

Fixed

• Per-arch RPM filtering for the prefetch SBOM.
  • With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
    include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
    even for images built on other arches.
  • Now, the SBOM will contain the RPMs for the corresponding arch.

v0.11.1

Version 0.11.1 only has relevant changes for the remote variants of this task.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

v0.9.0

Added

• Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
  When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
  To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
  and pass it to the prefetch-dependencies task.

v0.8.0

• Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:47 AM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <100.00%> (ø)
integration	69.55% <100.00%> (ø)
unit	69.55% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/validate/vsa/attest.go	90.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

Medium

• [api-contract] cmd/sigstore/initialize.go:68 — The cosign v2.6.2 upgrade adds a new --root-checksum flag via opts.AddFlags(cmd), but the RunE handler only passes opts.Root and opts.Mirror. Since DoInitialize calls doInitialize with forceSkipChecksumValidation: true, any --root-checksum value is silently ignored. A user relying on this flag for root integrity verification would have a false sense of security.
  Remediation: Update sigstoreInitializeFunc to pass opts.RootChecksum through. When non-empty, call initialize.DoInitializeWithRootChecksum. Alternatively, hide the --root-checksum flag if the feature is intentionally not supported.

• [scope-creep] .tekton/cli-v07-pull-request.yaml — The PR description table (generated by Renovate) characterizes the clair-scan change as a minor version bump (0.3.2 → 0.4.1), but the actual diff replaces task-clair-scan entirely with task-roxctl-scan:0.1. This is a tool substitution, not a version bump. The mismatch between the bot-generated description and the actual change warrants reviewer attention.

Low

• [stale-reference] benchmark/offliner/scans.go:90 — The pipeline task clair-scan is renamed to roxctl-scan in both .tekton/ YAML files, but benchmark/offliner/scans.go (line 90) and hack/view-clair-reports.sh (line 39) still search for clair-scan. New attestations will use roxctl-scan, causing these tools to silently return empty results.
  Remediation: Update both files to handle roxctl-scan (or both names for backward compatibility).

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

Medium

• [stale-reference] benchmark/offliner/scans.go:90 — The Go benchmark code filters tasks by task["name"] != "clair-scan". After this PR merges, pipelines on the release-v0.7 branch will produce attestations with the task named roxctl-scan instead of clair-scan. This code will no longer match those attestation results, causing it to silently skip the scan results. The TODO comment on line 89 acknowledges this fragility.
  Remediation: Update line 90 to also match roxctl-scan, e.g.: if task["name"] != "clair-scan" && task["name"] != "roxctl-scan". Alternatively, switch to matching by task reference as the TODO suggests.

• [stale-reference] hack/view-clair-reports.sh:39 — The helper script uses select(.name=="clair-scan") to extract scan reports from attestations. After this rename, attestations from v0.7 branch builds will have the task named roxctl-scan, so this script will produce empty output for those images.
  Remediation: Update the jq filter to also match roxctl-scan: select(.name=="clair-scan" or .name=="roxctl-scan").

Low

• [scope-body-divergence] .tekton/cli-v07-pull-request.yaml — The PR body table describes the clair-scan update as a version bump from 0.3.2 to 0.4.1, but the actual diff replaces clair-scan entirely with roxctl-scan:0.1. This is generated by Renovate's replacementName feature when handling an upstream package deprecation.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [scope-authorization-mismatch] .tekton/cli-v07-pull-request.yaml:329, .tekton/cli-v07-push.yaml:328 — The PR description (generated by Renovate/MintMaker) claims this is a minor version bump of task-clair-scan from 0.3.2 to 0.4.1. However, the actual diff replaces the clair-scan task entirely with a different scanning tool: task-roxctl-scan:0.1. This is not a version update — it is a tool substitution. The task name changes from clair-scan to roxctl-scan, the taskRef name changes, and the bundle reference switches from task-clair-scan to task-roxctl-scan. The roxctl-scan task is at version 0.1, indicating this is the initial release of a new tool being introduced into the CI pipeline. The same change occurs in both pipeline files.
  Remediation: A human reviewer must verify that the clair-scan to roxctl-scan migration is intentional and approved. If the Konflux platform has deprecated clair-scan in favor of roxctl-scan, the PR description should be updated to accurately describe the tool replacement rather than presenting it as a version bump.

Low

• [stale-reference] benchmark/offliner/scans.go:90 — The benchmark code filters tasks by the name clair-scan. After the rename to roxctl-scan in v0.7 pipeline definitions, this filter will silently skip the scan task when run against v0.7 pipeline results, producing incomplete benchmark data with no error.
• [stale-reference] hack/view-clair-reports.sh:39 — The helper script filters for task results where .name=="clair-scan". After the rename to roxctl-scan in v0.7 pipelines, this script will return no results when pointed at v0.7 pipeline runs.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:08 AM UTC · Completed 7:23 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.12

[simonbaird]

I did a rebase manually to see if it goes green.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:03 PM UTC · Completed 6:15 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.99

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored dependency update with 8 files and 167 lines changed, two dependency files modified (go.mod/go.sum), no protected or security-sensitive paths, low git churn, moderate code age across changed files.

Previous run

Risk Assessment: low (1/5)

Details

Minimal-risk automated bot PR updating Konflux CI pipeline references on a release branch. Only 2 Tekton YAML files changed with 68 lines (symmetric additions/deletions suggesting version bumps). No protected paths, no security-sensitive files, no dependency changes. Bot author with prior contributions. Pure CI configuration update with no functional code impact.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 8:04 PM UTC · Ended 8:05 PM UTC

Commit: ca5794c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:06 PM UTC · Completed 8:27 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $10.01

[fullsend-ai-review]

See the review comment for full details.

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.