Update Konflux references (release-v0.7)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	da0cff2 → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	b00c9e6 → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.11.0 → 0.11.2
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	e438f31 → b961f8b
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.5 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	15d3d4a → 5f68715
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.7.1 → 0.10.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	350a144 → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2.1 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	d33d800 → c06bee8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	f4818f8 → 97231d2
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	f31055c → 6a7fbfa
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	93f1df1 → 6bb2697

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.11.2

Fixed

• Per-arch RPM filtering for the prefetch SBOM.
  • With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
    include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
    even for images built on other arches.
  • Now, the SBOM will contain the RPMs for the corresponding arch.

v0.11.1

Version 0.11.1 only has relevant changes for the remote variants of this task.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

v0.9.0

Added

• Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
  When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
  To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
  and pass it to the prefetch-dependencies task.

v0.8.0

• Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:47 AM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <100.00%> (ø)
integration	69.55% <100.00%> (ø)
unit	69.55% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/validate/vsa/attest.go	90.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

Medium

• [api-contract] cmd/sigstore/initialize.go:68 — The cosign v2.6.2 upgrade adds a new --root-checksum flag via opts.AddFlags(cmd), but the RunE handler only passes opts.Root and opts.Mirror. Since DoInitialize calls doInitialize with forceSkipChecksumValidation: true, any --root-checksum value is silently ignored. A user relying on this flag for root integrity verification would have a false sense of security.
  Remediation: Update sigstoreInitializeFunc to pass opts.RootChecksum through. When non-empty, call initialize.DoInitializeWithRootChecksum. Alternatively, hide the --root-checksum flag if the feature is intentionally not supported.

• [scope-creep] .tekton/cli-v07-pull-request.yaml — The PR description table (generated by Renovate) characterizes the clair-scan change as a minor version bump (0.3.2 → 0.4.1), but the actual diff replaces task-clair-scan entirely with task-roxctl-scan:0.1. This is a tool substitution, not a version bump. The mismatch between the bot-generated description and the actual change warrants reviewer attention.

Low

• [stale-reference] benchmark/offliner/scans.go:90 — The pipeline task clair-scan is renamed to roxctl-scan in both .tekton/ YAML files, but benchmark/offliner/scans.go (line 90) and hack/view-clair-reports.sh (line 39) still search for clair-scan. New attestations will use roxctl-scan, causing these tools to silently return empty results.
  Remediation: Update both files to handle roxctl-scan (or both names for backward compatibility).

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

Medium

• [stale-reference] benchmark/offliner/scans.go:90 — The Go benchmark code filters tasks by task["name"] != "clair-scan". After this PR merges, pipelines on the release-v0.7 branch will produce attestations with the task named roxctl-scan instead of clair-scan. This code will no longer match those attestation results, causing it to silently skip the scan results. The TODO comment on line 89 acknowledges this fragility.
  Remediation: Update line 90 to also match roxctl-scan, e.g.: if task["name"] != "clair-scan" && task["name"] != "roxctl-scan". Alternatively, switch to matching by task reference as the TODO suggests.

• [stale-reference] hack/view-clair-reports.sh:39 — The helper script uses select(.name=="clair-scan") to extract scan reports from attestations. After this rename, attestations from v0.7 branch builds will have the task named roxctl-scan, so this script will produce empty output for those images.
  Remediation: Update the jq filter to also match roxctl-scan: select(.name=="clair-scan" or .name=="roxctl-scan").

Low

• [scope-body-divergence] .tekton/cli-v07-pull-request.yaml — The PR body table describes the clair-scan update as a version bump from 0.3.2 to 0.4.1, but the actual diff replaces clair-scan entirely with roxctl-scan:0.1. This is generated by Renovate's replacementName feature when handling an upstream package deprecation.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [scope-authorization-mismatch] .tekton/cli-v07-pull-request.yaml:329, .tekton/cli-v07-push.yaml:328 — The PR description (generated by Renovate/MintMaker) claims this is a minor version bump of task-clair-scan from 0.3.2 to 0.4.1. However, the actual diff replaces the clair-scan task entirely with a different scanning tool: task-roxctl-scan:0.1. This is not a version update — it is a tool substitution. The task name changes from clair-scan to roxctl-scan, the taskRef name changes, and the bundle reference switches from task-clair-scan to task-roxctl-scan. The roxctl-scan task is at version 0.1, indicating this is the initial release of a new tool being introduced into the CI pipeline. The same change occurs in both pipeline files.
  Remediation: A human reviewer must verify that the clair-scan to roxctl-scan migration is intentional and approved. If the Konflux platform has deprecated clair-scan in favor of roxctl-scan, the PR description should be updated to accurately describe the tool replacement rather than presenting it as a version bump.

Low

• [stale-reference] benchmark/offliner/scans.go:90 — The benchmark code filters tasks by the name clair-scan. After the rename to roxctl-scan in v0.7 pipeline definitions, this filter will silently skip the scan task when run against v0.7 pipeline results, producing incomplete benchmark data with no error.
• [stale-reference] hack/view-clair-reports.sh:39 — The helper script filters for task results where .name=="clair-scan". After the rename to roxctl-scan in v0.7 pipelines, this script will return no results when pointed at v0.7 pipeline runs.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:08 AM UTC · Completed 7:23 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.12

[simonbaird]

I did a rebase manually to see if it goes green.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:03 PM UTC · Completed 6:15 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.99

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored dependency update with 8 files and 167 lines changed, two dependency files modified (go.mod/go.sum), no protected or security-sensitive paths, low git churn, moderate code age across changed files.

Previous run

Risk Assessment: low (1/5)

Details

Minimal-risk automated bot PR updating Konflux CI pipeline references on a release branch. Only 2 Tekton YAML files changed with 68 lines (symmetric additions/deletions suggesting version bumps). No protected paths, no security-sensitive files, no dependency changes. Bot author with prior contributions. Pure CI configuration update with no functional code impact.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 8:04 PM UTC · Ended 8:05 PM UTC

Commit: ca5794c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:06 PM UTC · Completed 8:27 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $10.01

[fullsend-ai-review]

See the review comment for full details.