[master] Update Konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	6387614 → da0cff2
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	0.10.7 → 0.11.0	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	27c9760 → e438f31
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	510daad → 799e609
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	b8465d5 → 15d3d4a
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	0.6.0 → 0.7.1	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	ccb77d1 → 41ff593
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	61b27e6 → d33d800
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	eba24f5 → f4818f8
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	eb9d539 → f31055c
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	0.2 → 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	6081c41 → 93f1df1

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.11.0

Changed

• When scanning the built image with Syft, scans the image filesystem as
  a directory instead of scanning the the image as an OCI archive. This improves
  the scanning time, disk usage and may improve memory usage. More details in
  konflux-build-cli/docs/design/syft-image-scanning.md.
• The remote variants of this task now push the built image to the registry directly
  from the build VM instead of rsyncing the image back to the cluster first.
  For large images, this significantly reduces the time spent on network transfers.

Removed

• BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
  in the build step.
• BREAKING: Removed the push step, the push now happens in the build step.
• If you have step overrides configured for either of the two removed steps,
  the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

1. Your PipelineRun references an external Pipeline. In this case, the migration
   script will never get a chance to run on the PipelineRun.
2. Your PipelineRun is multi-platform, SBOM generation needs more resources
   than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
   taskRunSpecs:
     - pipelineTaskName: build-container
       stepSpecs:
-        - name: sbom-syft-generate
+        - name: build
           computeResources:
             requests:
               memory: 16Gi
             limits:
               memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
   params:
     - name: build-platforms
       value:
         - localhost
-        - linux/arm64
+        - linux-mxlarge/arm64

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.7.1

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.1
• Fixes GHSA-rfhj-wcpf-9jcx
• Fixes GHSA-rpww-j58f-22xr
• Fixes GHSA-pxcg-wp85-mcrg
• Fixes GHSA-wx26-fvpq-v9rp

v0.7.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.0
• The .repo file for RPM dependencies is now named hermeto.repo instead of cachi2.repo

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)

v0.3

Fixed

The migration script wasn't attached to the task bundle.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test

[coderabbitai]

📝 Walkthrough

Walkthrough

The Tekton PipelineRuns remove the show-sbom final task. They update pinned bundle digests for initialization, cloning, dependency prefetching, image building, source-image building, certification, SAST, tagging, and RPM signature scanning. Dependency prefetching advances from version 0.6.0 to 0.7.1. Build tasks advance from version 0.10.7 to 0.11.0 where applicable.

🚥 Pre-merge checks | ✅ 20

✅ Passed checks (20 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Best Practices & Build Tags	✅ Passed	The commit changes only four Tekton PipelineRun YAML files; it adds no Go code, error handling, panic, pointer dereference, daemon, or controller changes requiring this check.
Security: Secrets, Ssh & Csr	✅ Passed	PASS: The PR changes only four Tekton bundle references and removes show-sbom; it adds no secret, key, SSH, or CSR data, and the git-auth Secret workspace is unchanged.
Kubernetes Controller Patterns	✅ Passed	The commit changes only four .tekton PipelineRun manifests; it does not modify controllers, reconciliation, status conditions, predicates, finalizers, or owner references.
Windows Service Management	✅ Passed	The commit changes only four Tekton manifests and task bundle digests; no Windows service ordering, dependencies, descriptions, cleanup, reboot, or Service Control Manager code changed.
Platform-Specific Requirements	✅ Passed	Only four Tekton pipeline files changed. No platform runtime or machine configuration changed; repository guidance and source cover vSphere, AWS, Azure, and GCP requirements.
Stable And Deterministic Test Names	✅ Passed	The commit changes only four Tekton YAML files; no Ginkgo test source or It/Describe/Context/When test title was added or modified.
Test Structure And Quality	✅ Passed	The patch changes only four Tekton YAML files and adds no Ginkgo tests, test files, cluster operations, or assertions to review.
Microshift Test Compatibility	✅ Passed	The PR changes only four Tekton YAML files and adds no Ginkgo tests or test references to MicroShift-unavailable APIs or features.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only four .tekton YAML pipeline files; no Go files or new Ginkgo constructs such as It(), Describe(), Context(), or When() were added.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch changes only four Tekton PipelineRun YAML files, removing show-sbom and updating bundle digests; it adds no deployment, operator, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR changes only Tekton YAML; OTE main has no stdout writes, its suite initializer only registers tests, and vendored klog defaults to stderr.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only four Tekton YAML files; it adds no Ginkgo e2e tests or test networking code. The check is not applicable.
No-Weak-Crypto	✅ Passed	The PR changes only four Tekton manifests. Added lines contain no MD5, SHA-1, DES, RC4, Blowfish, ECB, crypto implementation, or secret comparison; image pins use SHA-256.
Container-Privileges	✅ Passed	All four changed PipelineRun manifests contain no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root security settings; the diff only updates bundle digests and r...
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only pinned Tekton bundle references and removes show-sbom; the diff adds no logging directives or sensitive values.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: updating Konflux task references on the master branch.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/master

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jrvaldes]

/retest

[jrvaldes]

/retest