Update Konflux references by red-hat-konflux[bot] · Pull Request #22994 · stackrox/stackrox

red-hat-konflux · 2026-09-23T01:45:48Z

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	`0.3.1` → `0.3.2`
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	minor	`0.12.2` → `0.14.0`
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	minor	`0.12.2` → `0.14.0`
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	digest	`2199648` → `0c7d9e4`
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	`0.3.3` → `0.3.4`
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	`0ccc688` → `81b7cad`
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	`fa53ef4` → `cc7d71d`
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	`7854d7b` → `5197c2d`
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	`0.10.3` → `0.11.0`
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	patch	`0.1` → `0.1.1`
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	`d9df5d3` → `f3d7323`
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.1` → `0.1.1`
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.5` → `0.5.1`
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	patch	`0.4` → `0.4.1`
quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification (source, changelog)	tekton-bundle	digest	`02842e9` → `55fdfbe`
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	minor	`0.3.2` → `0.4.0`

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

`v0.3.2`

Added

ADDITIONAL_TAGS_FROM_LABEL parameter to specify image label to read additional tags from.
For now set previously hardcoded value konflux.additional-tags by default to avoid changing the task behavior.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

`v0.14.0`

Changed

Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

`v0.13.0`

Changed

The BUILD_ARGS_FILE parameter was renamed to BUILD_ARGS_FILES and allows
passing multiple build arguments files as buildah itself does.

`v0.12.3`

Version 0.12.3 only has relevant changes for the remote variants of this task.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

`v0.14.0`

Changed

Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

`v0.13.0`

Changed

The BUILD_ARGS_FILE parameter was renamed to BUILD_ARGS_FILES and allows
passing multiple build arguments files as buildah itself does.

`v0.12.3`

Changed

All ssh and rsync invocations to the build VM now share a single ssh
connection. The build step writes an ~/.ssh/config with ControlMaster auto,
ControlPath and ControlPersist, so only the first invocation pays the cost
of the TCP handshake, key exchange and authentication.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

`v0.3.4`

Added

Pre-extract every nested archive into a loose file tree before scanning, so
clamd scans each file directly instead of recursing through nested archive
layers. This makes scanning of deeply nested archives faster. Extraction uses
bsdtar, which detects archives (zip/jar/war/ear/tar
and tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
the OCI dir: payload is an extension-less blob — and unpacks them
unconditionally with no size/count/depth limits. It is defensive: a corrupt or
partial archive is left in place for clamd rather than aborting the scan. No new
parameters are introduced. Requires the clamav-db image to ship bsdtar
(added in konflux-clamav).

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

`v0.11.0`

Changed

Renamed Trusted Artifact result CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use buildah-oci-ta >= 0.14.0 and source-build-oci-ta >= 0.4.0 for naming
consistency of the result.

`v0.10.4`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.63.0

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)

`v0.1.1`

Changed

Updated rox-image-scan and exchange-service-account-token steps image to version 4.11.5 by following digest registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:98f01d623e119acbbc211bdeb36192b619969aa149d9c66bab8034eeef84c861

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)

`v0.1.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)

`v0.5.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)

`v0.4.1`

Fixed

Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

`v0.4.0`

Changed

Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- Between 12:00 AM and 07:59 AM (* 0-7 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

rhacs-bot

Auto-approved by automation.

codecov · 2026-09-23T01:50:19Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.98%. Comparing base (e831e09) to head (9dc447a).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22994      +/-   ##
==========================================
- Coverage   52.01%   51.98%   -0.04%     
==========================================
  Files        2913     2913              
  Lines      183638   183638              
==========================================
- Hits        95526    95458      -68     
- Misses      79767    79814      +47     
- Partials     8345     8366      +21

Flag	Coverage Δ
go-unit-tests	`51.98% <ø> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-09-23T01:54:07Z

🚀 Build Images Ready

Images are ready for commit 9dc447a. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.1.x-295-g9dc447a33b

coderabbitai · 2026-09-30T01:31:54Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: 1d4524e
Latest commit, not reviewed: 9dc447a

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 317e9cc7-b891-47b4-bd16-26777c08d6f3

📥 Commits

Reviewing files that changed from the base of the PR and between 83ef597 and 1d4524e.

📒 Files selected for processing (5)

.tekton/basic-component-pipeline.yaml
.tekton/checks.yaml
.tekton/main-pipeline.yaml
.tekton/operator-bundle-pipeline.yaml
.tekton/scanner-v4-pipeline.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 3 remain after this review.

📝 Summary

Summary by CodeRabbit

Pipeline Updates
- Build and validation workflows use updated components for image building, security scanning, certification checks, malware checks, and RPM signature verification.
- Slack notifications are configured through an updated integration.
- These changes apply across standard builds, operator builds, snapshot creation, retagging, and scanner workflows.

📝 Summary

Walkthrough

The Tekton pipeline definitions now resolve Slack notification tasks from a pinned integration-catalog Git revision. Several task bundle references also use updated digests. Buildah and ClamAV task versions advance.

Changes

Tekton pipeline task references

Layer / File(s)	Summary
Slack task Git resolution `.tekton/basic-component-pipeline.yaml`, `.tekton/checks.yaml`, `.tekton/create-custom-snapshot.yaml`, `.tekton/main-pipeline.yaml`, `.tekton/operator-bundle-pipeline.yaml`, `.tekton/operator-index-build.yaml`, `.tekton/retag-pipeline.yaml`, `.tekton/scanner-v4-pipeline.yaml`	Slack notification tasks now resolve from the pinned integration-catalog revision and task path instead of bundle references.
Task bundle version and digest updates `.tekton/basic-component-pipeline.yaml`, `.tekton/checks.yaml`, `.tekton/main-pipeline.yaml`, `.tekton/operator-bundle-pipeline.yaml`, `.tekton/operator-index-build.yaml`, `.tekton/scanner-v4-pipeline.yaml`	Task bundle references for buildah, Roxctl, Clair, ecosystem certification, ClamAV, and RPM signature scans use updated digests. Buildah advances to version `0.12.3`; ClamAV advances to version `0.3.4`.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: msugakov

Merge Risk: ⚪ Minimal · up to 1d452

No actionable issue was established in the updated pipeline references; the change is mergeable with normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description provides dependency update details and release notes, but it does not complete the repository template. It omits the required user-facing documentation, testing and quality, automated …	Add the missing template sections. Mark documentation and test items as not needed when applicable, state whether CI results were inspected, and describe how the Tekton reference changes were validated.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the dependency updates to Konflux references.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides dependency update details and release notes, but it does not complete the repository template. It omits the required user-facing documentation, testing and quality, automated testing, and validation sections.

✨ Finishing Touches 💡 1

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-04T05:18:09Z

/konflux-retest scanner-v4-db-on-push

github-actions · 2026-10-04T05:18:19Z

/konflux-retest central-db-on-push

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

github-actions · 2026-10-17T07:20:57Z

/konflux-retest roxctl-on-push

github-actions · 2026-10-17T07:33:37Z

/konflux-retest roxctl-on-push

github-actions · 2026-10-17T07:44:00Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-10-17T07:44:06Z

/konflux-retest operator-on-push

github-actions · 2026-10-17T07:44:09Z

/konflux-retest roxctl-on-push

github-actions · 2026-10-17T07:51:40Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-10-17T07:51:41Z

/konflux-retest operator-on-push

github-actions · 2026-10-17T07:59:27Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-10-17T07:59:29Z

/konflux-retest operator-on-push

github-actions · 2026-10-17T09:20:03Z

/konflux-retest main-on-push

github-actions · 2026-10-17T09:20:09Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-10-17T09:32:47Z

/konflux-retest main-on-push

github-actions · 2026-10-17T09:32:50Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-10-17T09:42:59Z

/konflux-retest main-on-push

github-actions · 2026-10-17T09:43:02Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-10-17T10:18:34Z

/konflux-retest operator-index-on-push

github-actions · 2026-10-17T10:18:41Z

/konflux-retest create-custom-snapshot

github-actions · 2026-10-17T10:32:12Z

/konflux-retest operator-index-on-push

github-actions · 2026-10-17T10:32:17Z

/konflux-retest create-custom-snapshot

github-actions · 2026-10-17T10:41:44Z

/konflux-retest operator-index-on-push

github-actions · 2026-10-17T10:41:48Z

/konflux-retest create-custom-snapshot

red-hat-konflux Bot added the mintmaker-auto-merge Automatically approve and merge PRs from MintMaker via the corresponding workflow. label Sep 23, 2026

red-hat-konflux Bot requested review from a team and rhacs-bot as code owners September 23, 2026 01:45

github-actions Bot added the konflux-build Run Konflux in PR. Push commit to trigger it. label Sep 23, 2026

rhacs-bot approved these changes Sep 23, 2026

View reviewed changes

rhacs-bot enabled auto-merge (squash) September 23, 2026 01:46

red-hat-konflux Bot force-pushed the konflux/references/master branch 10 times, most recently from be0169e to 6bc6a05 Compare September 30, 2026 01:30

red-hat-konflux Bot force-pushed the konflux/references/master branch 8 times, most recently from 27b5ec0 to 92adc8d Compare October 4, 2026 04:50

red-hat-konflux Bot force-pushed the konflux/references/master branch 6 times, most recently from a02ead1 to 45c1ae5 Compare October 17, 2026 01:50

red-hat-konflux Bot changed the title ~~chore(deps): update konflux references~~ Update Konflux references Oct 17, 2026

Update Konflux references

9dc447a

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/references/master branch from 45c1ae5 to 9dc447a Compare October 17, 2026 06:35

Conversation

red-hat-konflux Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Added

Changed

Changed

Changed

Changed

Changed

Added

Changed

Changed

Fixed

Fixed

Fixed

Changed

Configuration

Documentation

Uh oh!

rhacs-bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 4, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

Uh oh!

github-actions Bot commented Oct 17, 2026

red-hat-konflux Bot commented Sep 23, 2026 •

edited

Loading

codecov Bot commented Sep 23, 2026 •

edited

Loading

github-actions Bot commented Sep 23, 2026 •

edited

Loading

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading