Update Konflux references (release-v0.8) (patch)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	minor	0.9 → 0.10.7
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	e78d0d3 → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	2e5ebe0 → 27c9760
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	minor	0.1 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	patch	0.4 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	patch	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2 → 0.2.1
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	f6a115e → 61b27e6
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	minor	0.4 → 0.5
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	4961c44 → eb9d539
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	2dd5b3e → 6081c41

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.3.2

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[simonbaird]

I might force push to get rid of my deps updates, (which should be done in the base branch by now).

[simonbaird]

I'm still hoping @red-hat-konflux[bot] will redo this PR on a newer parent.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 PM UTC · Completed 2:02 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [api-contract] .tekton/cli-v08-pull-request.yaml — The PR adds three new build parameters (SOURCE_DATE_EPOCH, REWRITE_TIMESTAMP, OMIT_HISTORY) and passes them to the build-container task in both pipeline files, but the buildah-remote-oci-ta task reference in pull-request.yaml remains at version 0.9 while push.yaml is updated to 0.10.7. These parameters were introduced in the 0.10.x line. With safe defaults ('', 'false', 'false'), existing behavior is preserved, but the reproducibility features will silently not take effect in PR builds if explicitly configured. The main-branch equivalent (cli-main-pull-request.yaml) already uses 0.10.5 with these parameters.
  Remediation: Update the buildah-remote-oci-ta task reference in cli-v08-pull-request.yaml to 0.10.7 to match push.yaml.

Previous run

Looks good to me

Previous run (2)

Looks good to me

---

Labels: PR modifies Tekton CI pipeline definitions under .tekton/

Previous run (3)

Review

Findings

Low

• [security scanning scope] .tekton/cli-v08-pull-request.yaml:114 — The new pipeline parameter sast-target-dirs (default: .) is wired to the TARGET_DIRS param of sast-snyk-check, sast-shell-check, and sast-unicode-check tasks. While the default value . preserves full scan coverage, this parameter could theoretically be overridden at PipelineRun time to narrow SAST scan scope. Practical risk is low since pipeline parameters in Konflux are controlled by platform trigger configuration, not PR authors.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:05 PM UTC · Completed 2:11 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:54 PM UTC · Completed 10:03 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:28 PM UTC · Completed 10:40 PM UTC
Commit: 87c4a29 · View workflow run →