Skip to content

chore(deps): update konflux references - #3538

Merged
littlejawa merged 1 commit into
develfrom
konflux/references/devel
Nov 2, 2026
Merged

littlejawa merged 1 commit into
develfrom
konflux/references/devel

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog) tekton-bundle digest a1d5e6d → a77e614
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog) tekton-bundle digest 654446d → daa950c
quay.io/konflux-ci/tekton-catalog/task-buildah (source, changelog) tekton-bundle patch 0.14.0 → 0.14.1
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog) tekton-bundle patch 0.14.0 → 0.14.1
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog) tekton-bundle patch 0.14.0 → 0.14.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog) tekton-bundle digest 6c7e4e2 → 79d5b56
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog) tekton-bundle digest cc7d71d → 43604d0
quay.io/konflux-ci/tekton-catalog/task-fbc-inject-lifecycle-oci-ta (source, changelog) tekton-bundle digest 465d8c8 → 2fdc236
quay.io/konflux-ci/tekton-catalog/task-git-clone (source, changelog) tekton-bundle digest 8c7fc8c → 6fe1a25
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog) tekton-bundle digest a367891 → 590db5c
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog) tekton-bundle digest 5197c2d → e3f908c
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies (source, changelog) tekton-bundle digest 8a62790 → 9a07e87
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog) tekton-bundle digest 7ffdaab → 6c63bc1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile (source, changelog) tekton-bundle digest 7c7d96e → 7e8ac10
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog) tekton-bundle digest 4c567d1 → c6874d3
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog) tekton-bundle digest 2fafbf5 → 41ec2c6
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog) tekton-bundle digest f3d7323 → a094264
quay.io/konflux-ci/tekton-catalog/task-source-build (source, changelog) tekton-bundle digest 3d2a749 → 4826b7e
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog) tekton-bundle digest 7a38719 → 71bd384

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)

v0.14.1

Changed
  • Mobster revision updated.
  • SBOMs now preserve Syft relationships even for Hermeto-prefetched packages.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.14.1

Changed
  • Mobster revision updated.
  • SBOMs now preserve Syft relationships even for Hermeto-prefetched packages.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.14.1

Changed
  • Mobster revision updated.
  • SBOMs now preserve Syft relationships even for Hermeto-prefetched packages.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Only on Saturday (* * * * 6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@openshift-merge-bot

Copy link
Copy Markdown

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between 52acc90 and 78bbe2a.

Files selected for processing: 8
  • .tekton/build-pipeline.yaml
  • .tekton/fbc-pipeline.yaml
  • .tekton/osc-hermeto-pull-request.yaml
  • .tekton/osc-hermeto-push.yaml
  • .tekton/osc-operator-bundle-pull-request.yaml
  • .tekton/osc-operator-bundle-push.yaml
  • .tekton/osc-test-fbc-pull-request.yaml
  • .tekton/osc-test-fbc-push.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.

Walkthrough

The Tekton pipeline and PipelineRun definitions update pinned bundle digests for build, scan, and image-management tasks. Build task references advance from version 0.14.0 to 0.14.1. Pipeline parameters, task wiring, ordering, and conditions remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: littlejawa

Merge Risk: Minimal · up to 78bbe

No actionable merge-blocking risk was identified.

Pre-merge checks: Passed 15
Check name Status Explanation
Title check Passed The title clearly and concisely describes the dependency updates to Konflux references, which are the main changes in the pull request.
Description check Passed The description directly documents the updated Konflux Tekton task digests, Buildah version changes, release notes, and update configuration.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names Passed The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and three Buildah version tags; it adds no Ginkgo test declarations or test titles, including no lega…
Test Structure And Quality Passed The pull request changes only eight .tekton/*.yaml files. The diff updates pinned Tekton bundle digests and three Buildah task versions. It adds no Ginkgo test code or It() blocks, so the listed t…
Microshift Test Compatibility Passed The pull request changes only eight .tekton/*.yaml files. The diff contains only Konflux task bundle tag and digest updates; it adds no Ginkgo tests or MicroShift-relevant API or feature usage. The …
Single Node Openshift (Sno) Test Compatibility Passed PASS: The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and Buildah task versions; it adds no Ginkgo tests or test declarations. Therefore, the SNO mul…
Topology-Aware Scheduling Compatibility Passed The pull request changes only bundle image references in eight .tekton resources. The resources are Tekton Pipeline and PipelineRun objects, not deployment manifests, operator code, or controlle…
Ote Binary Stdout Contract Passed PASS. The pull request changes only eight .tekton/*.yaml files. The diff contains only replacements of pinned Konflux task bundle references and Buildah versions (0.14.0 to 0.14.1). It adds no `…
Ipv6 And Disconnected Network Test Compatibility Passed The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and three Buildah task versions. It adds no Ginkgo e2e tests and introduces no test networking or ext…
No-Weak-Crypto Passed The pull request changes only pinned Tekton bundle references and SHA-256 image digests in eight YAML files. It adds no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token …
Container-Privileges Passed The PR changes only 81 Tekton bundle reference values across eight .tekton manifests. The added lines contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, `allowPrivilegeEscala…
No-Sensitive-Data-In-Logs Passed PASS. The pull request changes only pinned Konflux bundle image digests and three task versions in eight .tekton YAML files. The diff adds no logging commands, log configuration, credentials, tokens…
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and three Buildah version tags; it adds no Ginkgo test declarations or test titles, including no legacy metadata tokens or dynamic values.

Full details: Test Structure And Quality

Explanation

The pull request changes only eight .tekton/*.yaml files. The diff updates pinned Tekton bundle digests and three Buildah task versions. It adds no Ginkgo test code or It() blocks, so the listed test-quality requirements do not apply.

Full details: Microshift Test Compatibility

Explanation

The pull request changes only eight .tekton/*.yaml files. The diff contains only Konflux task bundle tag and digest updates; it adds no Ginkgo tests or MicroShift-relevant API or feature usage. The check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and Buildah task versions; it adds no Ginkgo tests or test declarations. Therefore, the SNO multi-node compatibility check does not apply.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes only bundle image references in eight .tekton resources. The resources are Tekton Pipeline and PipelineRun objects, not deployment manifests, operator code, or controllers. The diff adds no anti-affinity, topology spread, replica, node selector, toleration, or PDB scheduling constraints.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes only eight .tekton/*.yaml files. The diff contains only replacements of pinned Konflux task bundle references and Buildah versions (0.14.0 to 0.14.1). It adds no main, init, suite setup, or other process-level code, and it adds no stdout writes.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The pull request changes only eight .tekton/*.yaml files. The diff updates Tekton bundle digests and three Buildah task versions. It adds no Ginkgo e2e tests and introduces no test networking or external-service logic.

Full details: No-Weak-Crypto

Explanation

The pull request changes only pinned Tekton bundle references and SHA-256 image digests in eight YAML files. It adds no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token comparisons. The sha256: strings are strong digest pinning and do not match the SHA-1 condition.

Full details: Container-Privileges

Explanation

The PR changes only 81 Tekton bundle reference values across eight .tekton manifests. The added lines contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root user settings. No explicit container privilege condition is introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes only pinned Konflux bundle image digests and three task versions in eight .tekton YAML files. The diff adds no logging commands, log configuration, credentials, tokens, PII, hostnames, or customer data. Existing git_auth_secret references are unchanged.

Finishing Touches
Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

@openshift-ci
openshift-ci Bot requested review from tbuskey and wainersm October 24, 2026 03:33
@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 24, 2026
@openshift-ci

openshift-ci Bot commented Oct 24, 2026

Copy link
Copy Markdown

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@wainersm

wainersm commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Konflux Build Triage — PR #3538

Failed pipelines: 1/1 | Assessment: Code fix needed
Auto-retest: Skipped — no transient failures

prowjob-olmv1 / osc-operator

  • Failed task: unknown
  • Category: Unknown (auto-learned) (not retryable)
  • Log source: GitHub check run summary only
  • Error: (no error text)

Suggested action: Retrieve full logs and error output from the failed task to enable classification.
PipelineRun: View in Konflux


Generated by konflux-build-triage

@wainersm

Copy link
Copy Markdown
Contributor

/retest

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/references/devel branch from 52acc90 to 78bbe2a Compare October 31, 2026 02:50
@littlejawa littlejawa added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Nov 2, 2026
@littlejawa

Copy link
Copy Markdown
Contributor

/ok-to-test

@openshift-ci openshift-ci Bot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Nov 2, 2026
@openshift-ci

openshift-ci Bot commented Nov 2, 2026

Copy link
Copy Markdown

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@littlejawa
littlejawa merged commit 6fc56c1 into devel Nov 2, 2026
43 of 44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants