ROX-36447: Migrate from clair-scan to roxctl-scan

[vickeybrown]

Replace clair-scan task with roxctl-scan to provide better security coverage as per Konflux Integration Service Team migration plan.

Changes:

• Updated task name from clair-scan to roxctl-scan
• Updated bundle reference to task-roxctl-scan:0.1
• Removed matrix configuration as roxctl-scan handles multi-arch natively

[openshift-ci]

Hi @vickeybrown. Thanks for your PR.

I'm waiting for a stackrox member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 130186b5-3d5e-4c93-b1d9-71c5821d1711

📥 Commits

Reviewing files that changed from the base of the PR and between 3d523a9 and 542c65b.

📒 Files selected for processing (1)

• .tekton/scanner-component-pipeline.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b40e42cf-3993-4fe3-9781-1f978e5a8a90

📥 Commits

Reviewing files that changed from the base of the PR and between a42e2d5 and 3d523a9.

📒 Files selected for processing (1)

• .tekton/scanner-component-pipeline.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Updated the container scanning step in the build pipeline to use the newer scanning task.
  • Preserved existing image validation inputs and conditional execution behavior.
  • Simplified scanning execution by removing platform-specific matrix processing.

Walkthrough

The Tekton pipeline replaces clair-scan with roxctl-scan, removes platform matrix execution, and updates the task bundle reference. Image parameters and the skip-checks condition remain unchanged.

Changes

Scanner pipeline update

Layer / File(s)	Summary
Wire the roxctl scan task .tekton/scanner-component-pipeline.yaml	The pipeline removes the build-platforms matrix and image-platform parameter. It references roxctl-scan task version 0.1 with the updated bundle digest.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 3d523

This localized pipeline task migration has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review.

Suggested reviewers: rhacs-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the migration from clair-scan to roxctl-scan, which is the main change.
Description check	✅ Passed	The description directly explains the task replacement, bundle update, and matrix removal described in the changeset.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch migrate-to-roxctl-scan

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}