[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	minor	0.3.1 → 0.4
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	minor	0.12.1 → 0.14.1
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	minor	0.12.1 → 0.14.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.3 → 0.3.4
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	0ccc688 → 81b7cad
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	c07d2be → 43604d0
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	2e8fe30 → 590db5c
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	4be9343 → e3f908c
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.10.2 → 0.11.0
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	ef00a86 → c6874d3
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	patch	0.1 → 0.1.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	9ef4dab → a094264
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	patch	0.1 → 0.1.1
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	patch	0.5 → 0.5.1
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	patch	0.4 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	minor	0.3.1 → 0.4.0

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3.2

Added

• ADDITIONAL_TAGS_FROM_LABEL parameter to specify image label to read additional tags from.
  For now set previously hardcoded value konflux.additional-tags by default to avoid changing the task behavior.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.4

Added

• IMAGE_PLATFORM_MAP parameter: optional per-image platform mapping
  (imageRef=os/arch entries) passed to konflux-build-cli as
  --image-platform-map. This sets the platform on each index entry explicitly,
  which is required for OCI artifacts whose empty config carries no platform
  information (e.g. disk images), where the platform would otherwise be null.
  When empty (the default), behaviour is unchanged.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.14.1

Changed

• Mobster revision updated.
• SBOMs now preserve Syft relationships even for Hermeto-prefetched packages.

v0.14.0

Changed

• Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
• Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

v0.13.0

Changed

The BUILD_ARGS_FILE parameter was renamed to BUILD_ARGS_FILES and allows
passing multiple build arguments files as buildah itself does.

v0.12.3

Version 0.12.3 only has relevant changes for the remote variants of this task.

v0.12.2

Changed

• Version 0.12.2 only has relevant changes for the remote variants of this task.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.14.1

Changed

• Mobster revision updated.
• SBOMs now preserve Syft relationships even for Hermeto-prefetched packages.

v0.14.0

Changed

• Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
• Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

v0.13.0

Changed

The BUILD_ARGS_FILE parameter was renamed to BUILD_ARGS_FILES and allows
passing multiple build arguments files as buildah itself does.

v0.12.3

Changed

• All ssh and rsync invocations to the build VM now share a single ssh
  connection. The build step writes an ~/.ssh/config with ControlMaster auto,
  ControlPath and ControlPersist, so only the first invocation pays the cost
  of the TCP handshake, key exchange and authentication.

v0.12.2

Removed

• Removed the SSH port forwarding from decommissioned JVM Build Service artifact cache
  (JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR) from the remote build. This is just cleanup of unused code.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.4

Added

• Pre-extract every nested archive into a loose file tree before scanning, so
  clamd scans each file directly instead of recursing through nested archive
  layers. This makes scanning of deeply nested archives faster. Extraction uses
  bsdtar, which detects archives (zip/jar/war/ear/tar
  and tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
  the OCI dir: payload is an extension-less blob — and unpacks them
  unconditionally with no size/count/depth limits. It is defensive: a corrupt or
  partial archive is left in place for clamd rather than aborting the scan. No new
  parameters are introduced. Requires the clamav-db image to ship bsdtar
  (added in konflux-clamav).

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.11.0

Changed

• Renamed Trusted Artifact result CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
• Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use buildah-oci-ta >= 0.14.0 and source-build-oci-ta >= 0.4.0 for naming
consistency of the result.

v0.10.4

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.63.0

v0.10.3

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.62.0

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)

v0.1.1

Changed

• Updated rox-image-scan and exchange-service-account-token steps image to version 4.11.5 by following digest registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@​sha256:98f01d623e119acbbc211bdeb36192b619969aa149d9c66bab8034eeef84c861

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)

v0.1.1

Fixed

• Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
  from user pipelines. The parameter was dropped from the task definition in an
  earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)

v0.5.1

Fixed

• Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
  from user pipelines. The parameter was dropped from the task definition in an
  earlier release, but pipelines kept passing it.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)

v0.4.1

Fixed

• Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
  from user pipelines. The parameter was dropped from the task definition in an
  earlier release, but pipelines kept passing it.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

v0.4.0

Changed

• Renamed Trusted Artifact parameter CACHI2_ARTIFACT to PREFETCH_ARTIFACT.
• Renamed Trusted Artifact path /var/workdir/cachi2 to /var/workdir/prefetch.

Recommended to use prefetch-dependencies-oci-ta >= 0.11.0 for naming consistency of the parameter.

v0.3.2

Fixed

• Cargo prefetched dependencies are now included in the source image. They are
  vendored as unpacked source trees rather than archives, so previously they
  were missed by the archive-type filter and left out of the source image.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci-robot]

@red-hat-konflux[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	ccd3665 → c177fc2
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	290c9ec → 1e2e00b
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	digest	d44fb2d → 9eef3bf
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	digest	ceecb10 → f34d44f
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	c07d2be → fa53ef4
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	2e8fe30 → a367891
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	4be9343 → c6c414a
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	patch	0.10.2 → 0.10.3
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	ef00a86 → 3e59d63
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	9ef4dab → d9df5d3
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	afa8ba8 → d00c884
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	67a409d → 17b9587
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	69d5fca → 15d654c
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	1808485 → bbad5bf

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.3

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
• Only on Saturday (* * * * 6)
• Automerge
• At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign mytreya-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment