Skip to content

docs(#3531): add AGENTS.md guidance for Konflux Tekton task substitutions #3532

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fullsend-ai-coder wants to merge 1 commit into
base: main
Choose a base branch
from
+31 −0
Open

docs(#3531): add AGENTS.md guidance for Konflux Tekton task substitutions #3532

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,37 @@ blocking change requests) when the PR's primary purpose is a security
fix. Authors are expected to create follow-up issues or PRs for
documentation updates after the security fix is merged.

## Konflux/MintMaker Tekton task update reviews

Automated Konflux/MintMaker PRs update Tekton task bundle references in
`.tekton/` pipeline files. These updates fall into two categories with
different risk profiles:

**Digest-only bumps and patch version bumps** (e.g., updating the
`@sha256:...` digest or moving from `0.3.1` to `0.3.2`) are low-risk.
The task name and interface are unchanged, so cross-file analysis is
unnecessary — review the bundle reference change itself.

**Task name changes or task substitutions** (e.g., `clair-scan` →
`roxctl-scan`) are higher-risk. When a task name changes, grep the
codebase for references to the old task name. Key locations where task
names appear as string literals:

- **Go source** (`benchmark/`, `cmd/`, `pkg/`) — task-name filtering in
SLSA provenance attestation processing, e.g.,
`benchmark/offliner/scans.go` filters by task name to extract scan
results. Stale references silently return empty results rather than
errors.
- **Shell scripts** (`hack/`) — developer utilities like
`hack/view-clair-reports.sh` use `jq` selects on task names.
- **Documentation and test fixtures** (`docs/`, `pkg/schema/examples/`)
— example JSON and AsciiDoc references to task names.

When stale references are found, distinguish **production code paths**
(Go source in `benchmark/`, `cmd/`, `pkg/` — higher priority, should

@fullsend-ai-review fullsend-ai-review Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] technical accuracy

The guidance states that docs/ and pkg/schema/examples/ contain 'example JSON and AsciiDoc references to task names' in the context of task substitutions like clair-scan to roxctl-scan. However, the actual references in those locations are to get-clair-scan (a different Tekton task that retrieves scan results) and test:get-clair-scan (a policy rule name), not to the clair-scan scan task itself. This imprecision could lead reviewers to conflate the two tasks when evaluating task substitution PRs, potentially causing over-flagging or under-flagging of stale references.

block merge) from **developer utility scripts** in `hack/` (lower
priority, can be addressed in follow-up work).

## CGO and DNS Resolution

Binaries are built with `CGO_ENABLED=0` for portability. This uses Go's native DNS resolver,
Expand Down
Loading