Repository navigation
chore(deps): update konflux references - #439
Conversation
HyperShell environment destroyedThis ephemeral OpenShift environment has been destroyed. Comment |
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Amber reviewStatus: Complete |
![hypershell-delivery[bot]](https://avatars.githubusercontent.com/u/327175833?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
hypershell-delivery
Bot
added
the
amber/approved
fe5b6bc to
526853b
Compare
There was a problem hiding this comment.
Verdict
This is a Konflux/Renovate bot change that bumps four Tekton task bundle digests (roxctl-scan, ecosystem-cert-preflight-checks, clamav-scan, rpms-signature-scan) across the 12 .tekton/*.yaml pipeline definitions. The update is digest-only, internally consistent, and carries no production-code or security risk; keeping security-scan tasks current is a net positive.
What changed
Only pinned-by-digest references change; the image tags (0.1, 0.2, 0.3.4, 0.2.2) are untouched, so the version surface is unchanged and the bundles remain digest-pinned (supply-chain safe). I verified that each task resolves to exactly one new digest across all 12 files:
| Task | New digest |
|---|---|
task-roxctl-scan |
sha256:8286d4d… |
task-ecosystem-cert-preflight-checks |
sha256:4390141… |
task-clamav-scan |
sha256:22fb08a… |
task-rpms-signature-scan |
sha256:12239e6… |
No HyperShell component code, manifests, specs, or application images are affected.
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Previous concerns
The prior Amber review on this pull request (at the earlier head fe5b6bcf) raised no findings; it covered the same digest-only bundle bump. There are no outstanding Amber findings or inline threads to reconcile against the current head.
Findings Summary
No findings. This is a low-risk, digest-only CI dependency bump.
Convention Checklist
| Convention | Result |
|---|---|
| Image/bundle references consistent across manifests | Pass |
| Bundles remain digest-pinned (no tag-only refs) | Pass |
Conventional commit message (chore(deps): …) |
Pass |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
526853b to
1dc6e2f
Compare
This PR contains the following updates:
0.3.1→0.3.20.12.3→0.13.00.10.5→0.13.03203cd3→6fe7e040ccc688→81b7cadfa53ef4→43901410.2.4→0.2.60.10.1→0.10.35a6cbeb→4c567d14d48db2→e398b9d4b1856e→f72e0ba0.1→0.1.10.1→0.1.10.5→0.5.10.5→0.5.10.4→0.4.10.4→0.4.10.3→0.3.2Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)
v0.3.2Added
ADDITIONAL_TAGS_FROM_LABELparameter to specify image label to read additional tags from.For now set previously hardcoded value
konflux.additional-tagsby default to avoid changing the task behavior.konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)
v0.13.0Changed
The
BUILD_ARGS_FILEparameter was renamed toBUILD_ARGS_FILESand allowspassing multiple build arguments files as buildah itself does.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)
v0.13.0Changed
The
BUILD_ARGS_FILEparameter was renamed toBUILD_ARGS_FILESand allowspassing multiple build arguments files as buildah itself does.
v0.12.3Changed
sshandrsyncinvocations to the build VM now share a single sshconnection. The build step writes an
~/.ssh/configwithControlMaster auto,ControlPathandControlPersist, so only the first invocation pays the costof the TCP handshake, key exchange and authentication.
v0.12.2Removed
(
JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR) from the remote build. This is just cleanup of unused code.v0.12.1Changed
prepare-sbomsstep memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).prepare-sbomsCPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.v0.12.0Changed
CONTEXTUALIZE_SBOMis now set tofalseby default. The SBOMcontextualization received an overhaul, enabling the support for builder
content contextualization in SBOMs. To get involved in UAT, set this value
to
trueand report issuesto Mobster maintainers.
CONTEXTUALIZE_SBOMis set totrue, the built image will containnew labels,
io.buildah.stage.nameandio.buildah.stage.base.v0.11.2Fixed
include the
x86_64RPMs (and no other arches) from the prefetch SBOM,even for images built on other arches.
v0.11.1Changed
The build will fail if the connection goes 5 minutes without transfering
a single byte of data.
Fixed
This directory contains the git repository and prefetched dependencies,
which can be a lot of data. The rsync back was an unfortunate side effect
of how tooling generates the remote-oci-ta task variant from the base task,
and was completely unnecessary.
v0.11.0Changed
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.
Removed
sbom-syft-generatestep, SBOM generation now happensin the
buildstep.pushstep, the push now happens in thebuildstep.the pipeline will fail with
invalid StepOverride. See the migration guidance below.Migration guidance
Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:
script will never get a chance to run on the PipelineRun.
than the build itself and the remote VMs do not have sufficient resources.
If the migration script doesn't solve the problem, please follow the procedure below.
Manual procedure
If you have
sbom-syft-generateorpushstep overrides in the.spec.taskRunSpecssection in your PipelineRun, please remove them. In most cases, this should be all.
However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.
For example:
spec: taskRunSpecs: - pipelineTaskName: build-container stepSpecs: - - name: sbom-syft-generate + - name: build computeResources: requests: memory: 16Gi limits: memory: 16GiThis will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.
For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).
For example:
spec: params: - name: build-platforms value: - localhost - - linux/arm64 + - linux-mxlarge/arm64v0.10.7Fixed
ignore files, same as buildah itself.
.containerignoreand.dockerignorefilesin the root of the context directory, but not the
<containerfile>.containerignoreand
<containerfile>.dockerignorefiles.v0.10.6Fixed
versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
of Konflux doesn't provide the config file in the TUF mirror. Fixed
by setting
--use-signing-config=falseto still allow direct URLs.Changed
Previously, if keyless signing was enabled, the task would sign the image
in the push step and then the SBOM in upload-sbom step. Now, it will sign both
in the upload-sbom step. This has no practical impact, but enables a larger
rework of the push step in the future.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.10.3v0.10.2konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check)
v0.1.1Changed
move to the same version to ship a migration that removes the obsolete
CACHI2_ARTIFACTparameter from user pipelines.konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)
v0.1.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check)
v0.5.1Changed
move to the same version to ship a migration that removes the obsolete
CACHI2_ARTIFACTparameter from user pipelines.konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)
v0.5.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check)
v0.4.1Changed
move to the same version to ship a migration that removes the obsolete
CACHI2_ARTIFACTparameter from user pipelines.konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)
v0.4.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)
v0.3.2Fixed
vendored as unpacked source trees rather than archives, so previously they
were missed by the archive-type filter and left out of the source image.
v0.3.1Changed
Configuration
📅 Schedule: (in timezone America/New_York)
* * * * 6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.