Update Konflux references by red-hat-konflux[bot] · Pull Request #707 · validatedpatterns/patterns-operator

red-hat-konflux · 2026-06-20T06:52:43Z

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-buildah (source, changelog)	tekton-bundle	minor	`0.5` → `0.12.0`
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	patch	`0.3` → `0.3.2`
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	`0.3` → `0.3.1`
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	`f59175d` → `0ccc688`
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	`dae8e28` → `4619769`
quay.io/konflux-ci/tekton-catalog/task-git-clone (source, changelog)	tekton-bundle	minor	`0.1` → `0.2.5`
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	minor	`0.2` → `0.4.3`
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies (source, changelog)	tekton-bundle	minor	`0.2` → `0.9.0`
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check (source, changelog)	tekton-bundle	minor	`0.4` → `0.5`
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	tekton-bundle	minor	`0.1` → `0.3`
quay.io/konflux-ci/tekton-catalog/task-source-build (source, changelog)	tekton-bundle	digest	`268bf4d` → `2cedad4`
quay.io/konflux-ci/tekton-catalog/task-summary (source, changelog)	tekton-bundle	minor	`0.2` → `0.4`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)

`v0.12.0`

Changed

Parameter CONTEXTUALIZE_SBOM is now set to false by default. The SBOM
contextualization received an overhaul, enabling the support for builder
content contextualization in SBOMs. To get involved in UAT, set this value
to true and report issues
to Mobster maintainers.
When CONTEXTUALIZE_SBOM is set to true, the built image will contain
new labels, io.buildah.stage.name and io.buildah.stage.base.

`v0.11.2`

Fixed

Per-arch RPM filtering for the prefetch SBOM.
- With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
  include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
  even for images built on other arches.
- Now, the SBOM will contain the RPMs for the corresponding arch.

`v0.11.1`

Version 0.11.1 only has relevant changes for the remote variants of this task.

`v0.11.0`

Changed

When scanning the built image with Syft, scans the image filesystem as
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
The remote variants of this task now push the built image to the registry directly
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.

Removed

BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
in the build step.
BREAKING: Removed the push step, the push now happens in the build step.
If you have step overrides configured for either of the two removed steps,
the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

Your PipelineRun references an external Pipeline. In this case, the migration
script will never get a chance to run on the PipelineRun.
Your PipelineRun is multi-platform, SBOM generation needs more resources
than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
taskRunSpecs:
- pipelineTaskName: build-container
stepSpecs:
- - name: sbom-syft-generate+ - name: build
computeResources:
requests:
memory: 16Gi
limits:
memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
params:
- name: build-platforms
value:
- localhost
- - linux/arm64+ - linux-mxlarge/arm64

`v0.10.7`

Fixed

Thanks to konflux-build-cli#208, the task now supports per-containerfile
ignore files, same as buildah itself.
- Previously, the task supported the .containerignore and .dockerignore files
  in the root of the context directory, but not the <containerfile>.containerignore
  and <containerfile>.dockerignore files.

`v0.10.6`

Fixed

Attaching SBOM attestations using keyless signing. This stopped working between
versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
- Cosign v3 wants to use a "signing config" JSON file instead of accepting
  service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
  of Konflux doesn't provide the config file in the TUF mirror. Fixed
  by setting --use-signing-config=false to still allow direct URLs.

Changed

Consolidated all keyless signing code in the upload-sbom step.
Previously, if keyless signing was enabled, the task would sign the image
in the push step and then the SBOM in upload-sbom step. Now, it will sign both
in the upload-sbom step. This has no practical impact, but enables a larger
rework of the push step in the future.

`v0.10.5`

Added

Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
--rhsm-mount-ca-certs option.

`v0.10`

Fixed

Thanks to konflux-build-cli#208, the task now supports per-containerfile
ignore files, same as buildah itself.
- Previously, the task supported the .containerignore and .dockerignore files
  in the root of the context directory, but not the <containerfile>.containerignore
  and <containerfile>.dockerignore files.

`v0.9`

Fixed

Validate base image architecture before build. The task now fails if a base image
doesn't match the host architecture, preventing silent emulation builds.

`v0.8`

Fixed

Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
or linux/arm64).

`v0.7`

Fixed

Thanks to konflux-build-cli#208, the task now supports per-containerfile
ignore files, same as buildah itself.
- Previously, the task supported the .containerignore and .dockerignore files
  in the root of the context directory, but not the <containerfile>.containerignore
  and <containerfile>.dockerignore files.

`v0.6`

Fixed

Attaching SBOM attestations using keyless signing. This stopped working between
versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
- Cosign v3 wants to use a "signing config" JSON file instead of accepting
  service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
  of Konflux doesn't provide the config file in the TUF mirror. Fixed
  by setting --use-signing-config=false to still allow direct URLs.

Changed

Consolidated all keyless signing code in the upload-sbom step.
Previously, if keyless signing was enabled, the task would sign the image
in the push step and then the SBOM in upload-sbom step. Now, it will sign both
in the upload-sbom step. This has no practical impact, but enables a larger
rework of the push step in the future.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

`v0.3.2`

Changed

Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

set docker-config-dir in clair-action report command

`v0.3.1`

Added

Declare DOCKER_CONFIG to get get credential to quay.io.
Increase retry to 5

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies)

`v0.9.0`

Added

Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
and pass it to the prefetch-dependencies task.

`v0.8.0`

Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

`v0.7.1`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.1
Fixes GHSA-rfhj-wcpf-9jcx
Fixes GHSA-rpww-j58f-22xr
Fixes GHSA-pxcg-wp85-mcrg
Fixes GHSA-wx26-fvpq-v9rp

`v0.7.0`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.0
The .repo file for RPM dependencies is now named hermeto.repo instead of cachi2.repo

`v0.6.0`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

`v0.5.0`

Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

`v0.4.1`

Version 0.4.1 only changes the -oci-ta variant of this task.
Nothing changed in the base task (the one you're looking at).

`v0.4.0`

Hermeto releases from 0.55.0 to 0.57.1 - hermetoproject/hermeto@0.55.0...0.57.1

`v0.3.2`

Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

`v0.3`

Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)

`v0.3`

Fixed

The migration script wasn't attached to the task bundle.

`v0.2`

Removed

The task show-sbom is deprecated. The migration script deletes it from the pipeline.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-summary)

`v0.4`

Fixed

The migration script wasn't attached to the task bundle.

`v0.3`

Removed

The task show-summary is deprecated. The migration script deletes it from the pipeline.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

openshift-ci · 2026-06-20T06:52:47Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign mbaldessari for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-06-20T06:52:53Z

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a validatedpatterns member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

mbaldessari · 2026-06-22T06:56:55Z

/ok-to-test

mbaldessari · 2026-08-07T07:18:56Z

/ok-to-test

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

openshift-ciBot requested review from day0hero and mbaldessari June 20, 2026 06:52

openshift-ciBot added the needs-ok-to-test label Jun 20, 2026

openshift-ciBot added ok-to-test and removed needs-ok-to-test labels Jun 22, 2026

red-hat-konfluxBotforce-pushed the konflux/references/main branch from ebc10b2 to 929c836Compare June 27, 2026 06:25

red-hat-konfluxBotforce-pushed the konflux/references/main branch from 929c836 to e8e4139Compare July 4, 2026 06:54

red-hat-konfluxBotforce-pushed the konflux/references/main branch from e8e4139 to ff94eeeCompare July 11, 2026 07:49

red-hat-konfluxBot changed the title ~~chore(deps): update konflux references~~Update Konflux referencesJul 11, 2026

red-hat-konfluxBotforce-pushed the konflux/references/main branch 2 times, most recently from 1542bc1 to da72a7dCompare July 25, 2026 06:44

red-hat-konfluxBotforce-pushed the konflux/references/main branch 2 times, most recently from 050df80 to b67c125Compare August 1, 2026 11:31

red-hat-konfluxBotforce-pushed the konflux/references/main branch from b67c125 to 04e362eCompare August 8, 2026 06:34

Update Konflux references
73ee94d
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konfluxBotforce-pushed the konflux/references/main branch from 04e362e to 73ee94dCompare August 15, 2026 06:55

Navigation Menu

Uh oh!

Update Konflux references - #707

Update Konflux references#707
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/references/main

red-hat-konfluxBot commented Jun 20, 2026•
edited
Loading

Uh oh!

openshift-ciBot commented Jun 20, 2026

Uh oh!

openshift-ciBot commented Jun 20, 2026

Uh oh!

mbaldessari commented Jun 22, 2026

Uh oh!

mbaldessari commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

red-hat-konfluxBot commented Jun 20, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changed

Fixed

Changed

Removed

Migration guidance

Manual procedure

Fixed

Fixed

Changed

Added

Fixed

Fixed

Fixed

Fixed

Fixed

Changed

Changed

Added

Added

Added

Fixed

Removed

Fixed

Removed

Configuration

Documentation

Uh oh!

openshift-ciBot commented Jun 20, 2026

Uh oh!

openshift-ciBot commented Jun 20, 2026

Uh oh!

mbaldessari commented Jun 22, 2026

Uh oh!

mbaldessari commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

red-hat-konfluxBot commented Jun 20, 2026•
edited
Loading