[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-buildah (source, changelog)	tekton-bundle	minor	0.12.3 → 0.14.0
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	digest	3203cd3 → 6c7e4e2
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	0ccc688 → 81b7cad
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	fa53ef4 → cc7d71d
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	7854d7b → 5197c2d
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies (source, changelog)	tekton-bundle	minor	0.10.3 → 0.11.0
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	patch	0.1 → 0.1.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	4b1856e → f3d7323
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check (source, changelog)	tekton-bundle	patch	0.1 → 0.1.1
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check (source, changelog)	tekton-bundle	patch	0.5 → 0.5.1
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check (source, changelog)	tekton-bundle	patch	0.4 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-source-build (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3.2

Added

• ADDITIONAL_TAGS_FROM_LABEL parameter to specify image label to read additional tags from.
  For now set previously hardcoded value konflux.additional-tags by default to avoid changing the task behavior.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)

v0.14.0

Changed

• Prefetch workspace directory $(workspaces.source.path)/cachi2 is now $(workspaces.source.path)/prefetch.

Requires prefetch-dependencies >= 0.11.0

v0.13.0

Changed

The BUILD_ARGS_FILE parameter was renamed to BUILD_ARGS_FILES and allows
passing multiple build arguments files as buildah itself does.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies)

v0.11.0

Changed

• Workspace prefetch directory $(workspaces.source.path)/cachi2 is now $(workspaces.source.path)/prefetch.

Requires buildah >= 0.14.0 and source-build >= 0.4.0

v0.10.4

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.63.0

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)

v0.1.1

Changed

• Updated rox-image-scan and exchange-service-account-token steps image to version 4.11.5 by following digest registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@​sha256:98f01d623e119acbbc211bdeb36192b619969aa149d9c66bab8034eeef84c861

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check)

v0.1.1

Changed

• Version bump only, the task itself is unchanged. The Trusted Artifacts variants
  move to the same version to ship a migration that removes the obsolete
  CACHI2_ARTIFACT parameter from user pipelines.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check)

v0.5.1

Changed

• Version bump only, the task itself is unchanged. The Trusted Artifacts variants
  move to the same version to ship a migration that removes the obsolete
  CACHI2_ARTIFACT parameter from user pipelines.

konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check)

v0.4.1

Changed

• Version bump only, the task itself is unchanged. The Trusted Artifacts variants
  move to the same version to ship a migration that removes the obsolete
  CACHI2_ARTIFACT parameter from user pipelines.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build)

v0.4.0

Changed

• Renamed workspace directory $(workspaces.workspace.path)/cachi2 to $(workspaces.workspace.path)/prefetch.

Requires prefetch-dependencies >= 0.11.0

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign jdubrick for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a devfile member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 573813ee-a1ed-4cab-bf04-88de0d1f9390

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[michael-valdron]

/retest

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

[michael-valdron]

/ok-to-test

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.