Repository navigation
Update Konflux references (main) (patch) - #3670
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Setup and build task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml |
Both PipelineRuns update bundle references for initialization, source retrieval, dependency prefetch, image building, image indexing, source building, and Tekton bundle tasks. |
Validation and scan task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml |
Both PipelineRuns update bundle references for image checks, security scans, and preflight checks. The Snyk, shell, and Unicode SAST tasks no longer receive CACHI2_ARTIFACT. |
Tagging and publishing task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml |
Both PipelineRuns update bundle references for applying tags, pushing Dockerfiles, and scanning RPM signatures. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Suggested reviewers: simonbaird, joejstuart
Merge Risk: 
afe01
-
No actionable merge-blocking risk is established; the updated PipelineRuns remain aligned and the obsolete SAST parameter removal is locally consistent.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the main change: updating Konflux references on the main branch. Description check The description provides a detailed update table and release notes that explain what changed and why. It does not use the requested What, Why, and Tickets headings, but it is sufficiently complete and… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description provides a detailed update table and release notes that explain what changed and why. It does not use the requested What, Why, and Tickets headings, but it is sufficiently complete and on topic.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
|
<!-- fullsend:risk-assessment --> DetailsRoutine automated bot PR updating two Tekton CI config files with minimal change size, no security-sensitive paths, no regression or revert history, and single-author bot activity; only mild signal is files not touched in ~58 days but this is consistent with automated bundle-reference update cadence. |
|
Looks good to me <!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 --> |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
the
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This PR contains the following updates:
0.3→0.3.20.3.1→0.40.12.0→0.12.30.3.2→0.3.40ccc688→81b7cadb961f8b→43604d03bcd4c3→590db5c5f68715→e3f908c0.10.1→0.10.4393b4d0→c6874d30.1→0.1.1f110c53→a0942640.1→0.1.10.5→0.5.10.4→0.4.10.3→0.3.20.2→0.2.5Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)
v0.3.2Added
ADDITIONAL_TAGS_FROM_LABELparameter to specify image label to read additional tags from.For now set previously hardcoded value
konflux.additional-tagsby default to avoid changing the task behavior.v0.3.1Changed
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-build-image-index)
v0.4Added
IMAGE_PLATFORM_MAPparameter: optional per-image platform mapping(
imageRef=os/archentries) passed tokonflux-build-clias--image-platform-map. This sets the platform on each index entry explicitly,which is required for OCI artifacts whose empty config carries no platform
information (e.g. disk images), where the platform would otherwise be null.
When empty (the default), behaviour is unchanged.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)
v0.12.3Changed
sshandrsyncinvocations to the build VM now share a single sshconnection. The build step writes an
~/.ssh/configwithControlMaster auto,ControlPathandControlPersist, so only the first invocation pays the costof the TCP handshake, key exchange and authentication.
v0.12.2Removed
(
JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR) from the remote build. This is just cleanup of unused code.v0.12.1Changed
prepare-sbomsstep memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).prepare-sbomsCPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)
v0.3.4Added
clamd scans each file directly instead of recursing through nested archive
layers. This makes scanning of deeply nested archives faster. Extraction uses
bsdtar, which detects archives (zip/jar/war/ear/tarand tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
the OCI
dir:payload is an extension-less blob — and unpacks themunconditionally with no size/count/depth limits. It is defensive: a corrupt or
partial archive is left in place for clamd rather than aborting the scan. No new
parameters are introduced. Requires the
clamav-dbimage to shipbsdtar(added in konflux-clamav).
v0.3.3Changed
model-weight files (
.safetensors,.gguf,.ggml,.pt,.pth,.onnx,.onnx_data/.onnx_data_*), usingorg.opencontainers.image.titleandolot.layer.content.inlayerpath. Any other annotated layer is skipped whenthe OCI descriptor
sizeis at least 2000MiB (slightly under ClamAV's ~2GiBMaxFileSize), regardless of extension. Layers without those annotations are
still listed with
--dry-runas in 0.3.2. The--dry-runskip uses thesame name list.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.10.4v0.10.3v0.10.2konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)
v0.1.1Changed
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)
v0.1.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)
v0.5.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)
v0.4.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)
v0.3.2Fixed
vendored as unpacked source trees rather than archives, so previously they
were missed by the archive-type filter and left out of the source image.
v0.3.1Changed
Configuration
📅 Schedule: (UTC)
* * * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.