Update Konflux references (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	f89a59d → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	714a86d → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	digest	227cf5b → 44c1ca2
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	4619769 → b961f8b
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.5 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	4dbbfed → 5f68715
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.9.0 → 0.10.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	ee041e2 → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2.1 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	beb05ae → c06bee8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	b78e9c0 → 97231d2
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	d09f717 → 6a7fbfa
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	c7ecd1e → 6bb2697

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:48 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [stale-reference] benchmark/offliner/scans.go:90 — The code filters Tekton pipeline task results by task["name"] != "clair-scan" to locate vulnerability scan reports in SLSA provenance attestations. This PR renames the pipeline task from clair-scan to roxctl-scan, so after new pipeline runs, attestations will record the task as roxctl-scan and this filter will never match, silently producing empty scan report lists.
  Remediation: Update the string literal from "clair-scan" to "roxctl-scan" (or match both names for backward compatibility with older attestations).

• [stale-reference] hack/view-clair-reports.sh:39 — The jq filter select(.name=="clair-scan") matches the Tekton pipeline task name in attestation payloads. After this PR renames the task to roxctl-scan, this script will silently return no results for images built by the updated pipeline.
  Remediation: Update the jq filter to select(.name=="roxctl-scan") and rename the variable CLAIR_REPORT_SHAS to reflect the new scanner.

Low

• [scope-intent-mismatch] .tekton/cli-main-pull-request.yaml:373 — The PR body describes this as a clair-scan version update (0.3.2 → 0.4.1), but the actual diff replaces the clair-scan task entirely with roxctl-scan:0.1. This is a task substitution, not a version bump, and the PR description does not accurately communicate this.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Looks good to me

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:07 AM UTC · Completed 7:21 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.52

[fullsend-ai-review]

See the review comment for full details.

[simonbaird]

I did a rebase manually to see if we can get this green.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:04 PM UTC · Ended 6:05 PM UTC

Commit: ca5794c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:06 PM UTC · Completed 6:23 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.10

[simonbaird]

About the fullsend comments:

• Filed Find roxctl reports also using benchmark offliner #3530 for the benchmark offliner
• For the hack/view-clair-reports.sh, actually the format is different, so we'd need a new script to view roxctl reports. Not going to create one now, since this script is not used much.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 6:18 PM UTC · Completed 6:31 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.62

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Workflow outcome: Positive. The review agent delivered high-quality findings on PR #3513, an automated Konflux dependency update that silently substituted the clair-scan Tekton task with roxctl-scan. The agent identified two cross-file stale references in benchmark/offliner/scans.go:90 and hack/view-clair-reports.sh:39 — neither file was in the PR diff — plus a scope-intent-mismatch between the PR description and the actual change. The human reviewer confirmed all findings ("Good catch"), updated the commit message, and filed follow-up PR #3530. This is a clear example of the review agent adding value on an automated bot PR that a human might have rubber-stamped.

Evidence for existing issues:

• Cancel in-flight review workflow when PR merges during review fullsend-ai/fullsend#2388 (cancel in-flight review on merge): Review run 33664955684 ran to completion (~20 min, finishing at 18:24 UTC) despite the PR being merged at 18:17 UTC. The review results were posted to an already-merged PR and never read.
• Skip redundant re-reviews when Renovate rebases a dependency PR without changing the diff fullsend-ai/fullsend#4652 / #4596: The Sep 2 rebase triggered a new review dispatch on a commit whose diff was identical to the already-reviewed Aug 29 commit. The review ran the full analysis again rather than recognizing the unchanged diff.

Follow-up status: PR #3530 (benchmark offliner stale-reference fix) remains open. hack/view-clair-reports.sh has no fix PR — the human noted the script is rarely used and the roxctl output format differs from clair.

Proposals filed

• Add AGENTS.md guidance for cross-file impact when Konflux PRs substitute Tekton tasks (in conforma/cli)