Update Konflux references digest

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	b1c71d8 → c177fc2
quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta (source, changelog)	tekton-bundle	minor	0.3 → 0.4.0
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	6ead03c → 1e2e00b
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	digest	dd0c817 → 9eef3bf
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	1d7ba56 → a367891
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	digest	9fd7d25 → 0c386f2
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	64bb1cf → d9df5d3
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	d9b0153 → d00c884
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	a973b32 → 17b9587
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	3817504 → 15d654c

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2a8ff004-475f-49bf-8f00-6262586cd0ea

📥 Commits

Reviewing files that changed from the base of the PR and between a0fbb04 and 5d9ac05.

📒 Files selected for processing (4)

• .tekton/hyperfleet-sentinel-chart-push.yaml
• .tekton/hyperfleet-sentinel-chart-tag.yaml
• .tekton/hyperfleet-sentinel-push.yaml
• .tekton/hyperfleet-sentinel-tag.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual) → reviewed against open PR #377 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #304 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the pinned build and release task references used by chart and container publishing workflows.
  • Refreshed repository, dependency, build, security scanning, tagging, and signing task bundles.
  • Pipeline task versions and execution behavior remain unchanged, preserving existing build and release processes while using updated task bundle references.

Walkthrough

The change updates pinned OCI bundle digests for Tekton tasks in four pipeline definitions. Chart pipelines update five task digests each. Image pipelines update nine task digests each. Task versions, parameters, ordering, conditions, and pipeline behavior remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: ciaranroche

Merge Risk: ⚪ Minimal · up to 5d9ac

The PR updates Tekton bundle digests without changing pipeline behavior, so it is ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: updating Konflux reference digests. It is concise and related to the dependency updates.
Description check	✅ Passed	The description directly documents the updated Tekton bundle references, version change, and Renovate configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No failure condition is introduced. The authoritative diff changes only 28 YAML bundle-reference values across four .tekton files. Every added line is a quay.io reference pinned by a SHA-256 digest. N…
No Hardcoded Secrets	✅ Passed	PASS. The PR changes only 28 OCI bundle reference values in four Tekton YAML files. Each added value contains a quay.io reference with a 64-character hexadecimal sha256 content digest. The additio…
No Weak Cryptography	✅ Passed	The pull request changes only 28 OCI bundle reference lines in four Tekton YAML files. Every addition is a quay.io/...@sha256:<64-hex> digest. No added line uses MD5, DES, RC4, SHA-1, ECB, HMAC comp…
No Injection Vectors	✅ Passed	PASS. The authoritative diff changes only 56 lines in four Tekton YAML files, and every changed line is a replacement of a quay.io/konflux-ci/tekton-catalog/...@sha256: bundle reference. The added l…
No Privileged Containers	✅ Passed	PASS. The authoritative diff changes only 28 OCI bundle-reference lines in four .tekton PipelineRun build manifests. No added or removed line contains privileged: true, hostPID, hostNetwork,…
No Pii Or Sensitive Data In Logs	✅ Passed	The pull request changes only 28 Tekton bundle-reference lines in four YAML files. The added lines contain image names, versions, and SHA-256 digests. No slog, logr, zap, log, or fmt.Print* statements…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	56 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}