Update Konflux references to v0.10

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	0.9 → 0.10	⚠️migration⚠️

---

Release Notes

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.10

This version introduces konflux-build-cli. The build step replaces most of the Bash with
konflux-build-cli image build. Other steps still use Bash, this will change soon.

We expect version 0.10 to behave the same as version 0.9 for the vast majority
of use cases. All known (minor) differences documented below.

Added

• The vcs-url label. Previously, the task would inject the following vcs-related labels:
  • org.opencontainers.image.revision and its legacy counterpart,
    vcs-ref
  • org.opencontainers.image.source and nothing else
    • Version 0.10 adds the missing legacy counterpart, vcs-url

Changed

• The precedence of default annotations (those injected by the task automatically)
  • Before: ANNOTATIONS_FILE < ANNOTATIONS < default annotations
  • Now: default annotations < ANNOTATIONS_FILE < ANNOTATIONS
• When handling the YUM_REPOS_D_SRC and YUM_REPOS_D_FETCHED directories,
  injects only regular files into /etc/yum.repos.d. Previously, the task would
  inject the directories as a whole. /etc/yum.repos.d is a flat structure, so
  the task now injects only regular files to avoid injecting unexpected content.
• Prefetch integration:
  • Looks for both prefetch.env and cachi2.env in the prefetch dir (in this order).
    Version 0.3.1 of the prefetch task added prefetch.env and a future version
    will remove cachi2.env.
  • Doesn't rely specifically on cachi2.repo files to enable RPM integration,
    just needs any *.repo file at the expected path.
  • In case the YUM_REPOS_D_SRC or YUM_REPOS_D_FETCHED directories contain
    a repo file with the same name as the repo file from Hermeto, the Hermeto
    repo takes precedence. Previously, YUM_REPOS_* would take precedence.
  • Doesn't copy the prefetch files to /tmp, instead copies them to a directory
    on the same filesystem as the original files. This uses copy-on-write and avoids
    duplicating the underlying data.
• Red Hat subscription-manager integration:
  • Will mount the RHSM CA certificates into the build in two cases:
    • When using ACTIVATION_KEY and the containerfile doesn't include
      subscription-manager register (same as before)
    • When using ENTITLEMENT_SECRET (not done before and should have been)
  • When mounting RHSM CA certificates, mounts the whole /etc/rhsm/ca directory
    instead of mounting a specific file. This closes #​1621.

Fixed

• Injecting metadata to /usr/share/buildinfo and /root/buildinfo:
  • Does not write any new files or modify any existing files in the source directory,
    injects the files using a separate build-context.
  • Will log a warning if the TARGET param is set and SKIP_INJECTIONS=false
    (using TARGET disables metadata injection anyway). Metadata injection never
    worked with a non-default target, version 0.10 just adds the warning.
  • Injecting labels.json:
    • Will skip LABEL instructions in stages that don't affect the labels of the final image.
    • Will correctly omit the io.buildah.version label when SOURCE_DATE_EPOCH is non-empty.
      Previously, labels.json would always include io.buildah.version.
• Pre-pulling base images for hermetic builds and base-arch verification (see 0.9.4):
  • Also pulls images referenced in COPY --from=$image and RUN --mount=from=$image.
    Previously, would only pull images referenced as FROM $image.
  • Does not pull images for unused stages (unless SKIP_UNUSED_STAGES=false).
  • Will skip image references with transports that don't
    represent pullable images. Specifically, will only pull transport-less references
    and docker:// references. Previously, the task would skip oci-archive: references
    but fail on any other kind of non-standard reference.
• Modifying the containerfile to set prefetch environment variables in RUN instructions:

  • No longer mangles RUN instructions that use the exec form or a bare here-doc.
    Instead skips the instruction and logs a warning.

    RUN ["echo", "skips exec-form commands"]
    
    RUN <<EOF
    echo "skips bare heredocs"
    EOF
    
    RUN bash -e <<EOF
    echo "supports heredocs if they start with something other than the <<marker"
    EOF

    • This partially fixes #​1200, in the sense that the containerfile at least
      doesn't become broken. The unsupported instructions don't automatically get
      the variables that may be required to make the hermetic build work though.

  • Fixes dozens of small bugs that most users never would have hit. For example,
    version 0.10:

    • Doesn't mangle heredoc lines that look line RUN instructions
    • Doesn't inject text into the middle of a string with quoted/escaped whitespace
    • Properly handles backtick-escaped containerfiles

---

Configuration

📅 Schedule: Branch creation - Every minute ( * * * * * ) in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by CodeRabbit

• Chores
  • Updated build pipeline tool versions for improved build reliability and performance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6d3599ae-c73d-47e7-95a6-4f2370905f88

📥 Commits

Reviewing files that changed from the base of the PR and between 771eadd and e6dbf1c.

📒 Files selected for processing (2)

• .tekton/lightspeed-console-pf5-pull-request.yaml
• .tekton/lightspeed-console-pf5-push.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• .tekton/lightspeed-console-pf5-push.yaml
• .tekton/lightspeed-console-pf5-pull-request.yaml

---

📝 Walkthrough

Walkthrough

This PR updates the Tekton buildah-remote-oci-ta task bundle reference from 0.9 to 0.10 (including new digests) in the pull-request and push PipelineRun YAMLs.

Changes

Tekton Task Bundle Upgrade

Layer / File(s)	Summary
buildah-remote-oci-ta task bundle version update .tekton/lightspeed-console-pf5-pull-request.yaml, .tekton/lightspeed-console-pf5-push.yaml	The buildah-remote-oci-ta task bundle reference in the build-images matrix is updated from version 0.9 to 0.10 with corresponding SHA digest updates in both pipeline files.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• openshift/lightspeed-console#2001: Overlapping update to the buildah-remote-oci-ta task bundle digest in the same Tekton pipeline YAML files.
• openshift/lightspeed-console#2028: Another PR that updates the buildah-remote-oci-ta bundle reference from v0.9 to v0.10.
• openshift/lightspeed-console#2002: Concurrent update to the same taskRef bundle in pf5 PipelineRun YAMLs.

Suggested reviewers

• joshuawilson
• JoaoFula
• kyoto

Poem

🐰 I hopped through YAML, tidy and spry,
Swapped 0.9 for 0.10 under sky,
Two pipelines sing with matching digest,
Build and push aligned — snug as a nest. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update Konflux references to v0.10' accurately reflects the main change: bumping the buildah-remote-oci-ta task bundle from version 0.9 to 0.10 across two Tekton pipeline files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/pattern-fly-5

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[kyoto]

/approve
/lgtm
/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kyoto

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• .tekton/OWNERS [kyoto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kyoto]

/lgtm