chore(deps): update konflux references - #1428
Open
red-hat-konflux[bot] wants to merge 1 commit into
Open
Conversation
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates both Pulp Tekton pipelines to use the Roxctl scanner instead of Clair and refreshes the pinned Konflux task bundles, including RPM signature, certificate preflight, SAST, and ClamAV references with new versions or immutable digests. Flow diagram for refreshed pinned Konflux task bundlesflowchart TD
Pipelines[Pulp pull request and push pipelines]
Roxctl[task-roxctl-scan:0.1]
RPM[task-rpms-signature-scan:0.2.2]
Cert[task-ecosystem-cert-preflight-checks:0.2]
Snyk[task-sast-snyk-check:0.5]
Shell[task-sast-shell-check:0.1]
Unicode[task-sast-unicode-check:0.4]
ClamAV[task-clamav-scan:0.3.2]
Pipelines --> Roxctl
Pipelines --> RPM
Pipelines --> Cert
Pipelines --> Snyk
Pipelines --> Shell
Pipelines --> Unicode
Pipelines --> ClamAV
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. This replaces the Clair vulnerability gate with a different externally supplied Roxctl scanning task and changes several pinned security-check task bundles. If the new scanner or bundle is misconfigured or misses findings, images could pass CI and be promoted without the intended security checks; reverting prevents future runs but does not recall artifacts that already passed.
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
red-hat-konflux
Bot
force-pushed
the
konflux/references/main
branch
from
September 5, 2026 07:22
be5c4a9 to
e1ebbd9
Compare
red-hat-konflux
Bot
changed the title
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/references/main
branch
from
September 12, 2026 05:56
e1ebbd9 to
49ce909
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.3→0.3.10.12.0→0.12.10.4.0→0.4.10.3.1→0.3.34619769→fa53ef47d5d1ae→55126065f68715→c6c414a0.10.1→0.10.30.2.1→0.2.2f3e8337→b850ba32dc0d6d→39d5cbbca39124→1b653e60.3→0.3.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)
v0.3.1Changed
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)
v0.12.1Changed
prepare-sbomsstep memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).prepare-sbomsCPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.4.1Changed
Allign script and task version.
konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)
v0.3.3Changed
model-weight files (
.safetensors,.gguf,.ggml,.pt,.pth,.onnx,.onnx_data/.onnx_data_*), usingorg.opencontainers.image.titleandolot.layer.content.inlayerpath. Any other annotated layer is skipped whenthe OCI descriptor
sizeis at least 2000MiB (slightly under ClamAV's ~2GiBMaxFileSize), regardless of extension. Layers without those annotations are
still listed with
--dry-runas in 0.3.2. The--dry-runskip uses thesame name list.
v0.3.2Added
(
.safetensors,.gguf,.ggml). Other layers are still extracted andscanned. If layer listing fails, the task falls back to extracting the
full image.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies)
v0.10.3v0.10.2konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build)
v0.3.1Changed
Configuration
📅 Schedule: (UTC)
* 5-23 * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.
Summary by Sourcery
Update Konflux Tekton bundle references and switch container vulnerability scanning from Clair to Roxctl.
Enhancements: