Update Konflux references (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	f89a59d → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	714a86d → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	digest	227cf5b → 44c1ca2
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	4619769 → b961f8b
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.5 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	4dbbfed → 5f68715
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.9.0 → 0.10.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	ee041e2 → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2.1 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	beb05ae → c06bee8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	b78e9c0 → 97231d2
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	d09f717 → 6a7fbfa
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	c7ecd1e → 6bb2697

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:40 AM UTC · Completed 6:48 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [stale-reference] benchmark/offliner/scans.go:90 — The code filters Tekton pipeline task results by task["name"] != "clair-scan" to locate vulnerability scan reports in SLSA provenance attestations. This PR renames the pipeline task from clair-scan to roxctl-scan, so after new pipeline runs, attestations will record the task as roxctl-scan and this filter will never match, silently producing empty scan report lists.
  Remediation: Update the string literal from "clair-scan" to "roxctl-scan" (or match both names for backward compatibility with older attestations).

• [stale-reference] hack/view-clair-reports.sh:39 — The jq filter select(.name=="clair-scan") matches the Tekton pipeline task name in attestation payloads. After this PR renames the task to roxctl-scan, this script will silently return no results for images built by the updated pipeline.
  Remediation: Update the jq filter to select(.name=="roxctl-scan") and rename the variable CLAIR_REPORT_SHAS to reflect the new scanner.

Low

• [scope-intent-mismatch] .tekton/cli-main-pull-request.yaml:373 — The PR body describes this as a clair-scan version update (0.3.2 → 0.4.1), but the actual diff replaces the clair-scan task entirely with roxctl-scan:0.1. This is a task substitution, not a version bump, and the PR description does not accurately communicate this.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Looks good to me

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (-0.01%)	⬇️
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:07 AM UTC · Completed 7:21 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.52

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] scope-intent-mismatch

The PR body describes this as a clair-scan version update (0.3.2 to 0.4.1), but the actual diff replaces the clair-scan task entirely with roxctl-scan:0.1. This is a task substitution, not a version bump, and the PR description does not accurately communicate this.