Update Konflux references#199
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThree Tekton PipelineRun manifests ( Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Supply chain surface — verify before merging:
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/hyperfleet-adapter-push.yaml:
- Line 234: Before committing the task version upgrades for buildah-oci-ta to
0.10 and sast-snyk-check-oci-ta to 0.5 in the hyperfleet-adapter-push.yaml file,
you must complete the breaking change migrations documented in the task
changelogs. For buildah-oci-ta 0.10, update the runner image to
konflux-build-cli, remove workspace bindings from the spec, update all result
references to use IMAGE_URL/IMAGE_DIGEST/IMAGE_REF/SBOM_BLOB_URL, validate the
securityContext configuration, and test the hermetic, prefetch, annotations, and
labels behavior. For sast-snyk-check-oci-ta 0.5, run the automated migration
using the Konflux pmt tool against the MIGRATION.md file and validate all
parameters, results, and workspace configurations. Additionally, update the task
versions in hyperfleet-api and hyperfleet-sentinel configurations from 0.9 and
0.4 respectively to match the new versions (0.10 and 0.5) to eliminate platform
version skew. Document all migration changes with evidence in the repository
before unblocking the merge.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: be0517f4-5ecc-463f-8be1-a2eaeffc9411
📒 Files selected for processing (3)
.tekton/hyperfleet-adapter-chart-push.yaml.tekton/hyperfleet-adapter-push.yaml.tekton/hyperfleet-adapter-tag.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual)openshift-hyperfleet/hyperfleet-adapter(manual)openshift-hyperfleet/hyperfleet-broker(manual)
| value: buildah-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.9@sha256:75ecb662f343f6f34e553c5b37734d28d9b53ce218c2321a19b96c39bf769357 | ||
| value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.10@sha256:1d633027ed426996720890ec9a74576ae264d711a177bf18f39a5a9e8023435c |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Konflux tekton-catalog task-buildah-oci-ta 0.10 migration guide from 0.9 (required parameter/result/workspace changes)
💡 Result:
Required parameter/result/workspace changes for task-buildah-oci-ta:0.10 (Konflux tekton-catalog) migrating from 0.9: 1) Runner image change (impacts how the task runs, not pipeline params/workspaces) - In buildah*/0.10, the buildah task image is replaced with konflux-build-cli (kbc-based flow). [1] - 0.10 now “sets runAsUser: 0 explicitly” (previously it ran as root implicitly), so if your pipeline/controller policies override securityContext you may need to re-check. [1] 2) Workspace binding change in the shipped pipelines - The docker-build-oci-ta pipeline customization patch for 0.10 removes a workspace binding at /spec/workspaces/0. That indicates pipelines upgrading to 0.10 should drop that workspace binding and rely on the task’s OCI-artifact/result-based data flow instead. [2] 3) Task results you must wire (result key names) - buildah-oci-ta:0.10 exposes results including IMAGE_DIGEST, IMAGE_REF, IMAGE_URL, and SBOM_BLOB_URL, and pipeline params can reference them by those result names. If your 0.9 pipeline referenced different result names, update them to the 0.10 keys. [3] 4) Behavior-affecting internal parameter handling (validate your overrides against the new semantics) - 0.10 changes multiple internal behaviors by passing values directly to kbc, including: a) annotations+labels handling via kbc. [4] b) hermetic mode handling via kbc. [5] c) prefetch integration via kbc. [6] d) working directory mount handling via kbc. [7] These may not require parameter schema changes, but they can affect behavior if your 0.9 pipeline depended on previous side-effects. What to do when migrating your pipeline from 0.9 -> 0.10: - Bump the task bundle version to task-buildah-oci-ta:0.10. [1] - Remove the pipeline workspace binding corresponding to /spec/workspaces/0 (as per the 0.10 pipeline patch). [2] - Update any task result references to use IMAGE_DIGEST / IMAGE_REF / IMAGE_URL / SBOM_BLOB_URL for buildah-oci-ta:0.10. [3] - Re-test/verify behavior for hermetic builds, prefetch, and annotations/labels if you set related params, because 0.10 routes these through kbc. [4][5][6] Note: build-definitions does include a per-task version MIGRATION.md file (task/buildah-oci-ta/0.10/MIGRATION.md), but in the retrieved sources for this run I did not get the MIGRATION.md contents themselves; the migration-impact items above are grounded in the 0.10 change commit notes and the published pipeline patch/README schemas. [1][3][2]
Citations:
- 1: konflux-ci/build-definitions@09d4dc9
- 2: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build-oci-ta/patch.yaml
- 3: https://github.com/konflux-ci/build-definitions/blob/main/pipelines/docker-build-oci-ta/README.md
- 4: konflux-ci/build-definitions@e0548cb
- 5: konflux-ci/build-definitions@4b70952
- 6: konflux-ci/build-definitions@6b9d3fc
- 7: konflux-ci/build-definitions@cda8b03
🌐 Web query:
Konflux tekton-catalog task-sast-snyk-check-oci-ta 0.5 migration guide from 0.4 (required parameter/result/workspace changes)
💡 Result:
To migrate the Konflux tekton-catalog task sast-snyk-check-oci-ta from version 0.4 to 0.5, you should rely on the automated migration process provided by Konflux [1]. As of June 2026, version 0.5 of sast-snyk-check-oci-ta has been released in the konflux-sast-tasks repository [2]. Konflux automates task upgrades using the pipeline-migration-tool (pmt), which is integrated into the regular pull request workflow for updating Tekton tasks [1]. If you need to verify or apply these changes manually: 1. Locate the MIGRATION.md file within the task's directory in the konflux-sast-tasks source repository (specifically task/sast-snyk-check-oci-ta/0.5/MIGRATION.md) [2]. This file contains the authoritative, version-specific instructions regarding any required parameter, result, or workspace changes that may have been introduced in the 0.5 release. 2. If your automated build update is not triggering or applying correctly, you can use the pmt CLI tool in your component repository to apply the migration. You will need to generate the appropriate upgrade data—which maps the old bundle (0.4) to the new bundle (0.5)—and execute the pmt migrate command [1]. Because task migrations can involve specific breaking changes to inputs (parameters) or outputs (results), checking the MIGRATION.md file in the source repository is the mandatory step to ensure compatibility with your existing pipeline definition [1][2].
Citations:
- 1: https://konflux-ci.dev/docs/building/apply-task-migrations/
- 2: konflux-ci/konflux-sast-tasks@6badd94
🏁 Script executed:
#!/bin/bash
# Check for migration docs or upgrade notes related to the task versions
find . -type f -name "*.md" | xargs grep -l "migration\|upgrade\|0.10\|0.9" 2>/dev/null || echo "No migration docs found"Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 133
🏁 Script executed:
#!/bin/bash
# Check the actual pipeline file for workspace bindings and result usage
cat -n .tekton/hyperfleet-adapter-push.yaml | grep -A 5 -B 5 "workspaces\|results\|buildah-oci-ta"Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 11190
🏁 Script executed:
#!/bin/bash
# Verify current versions in hyperfleet-api
grep -n "buildah-oci-ta\|sast-snyk-check-oci-ta" .tekton/hyperfleet-api-push.yaml | head -20Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 469
🏁 Script executed:
#!/bin/bash
# Verify current versions in hyperfleet-sentinel
grep -n "buildah-oci-ta\|sast-snyk-check-oci-ta" .tekton/hyperfleet-sentinel-push.yaml | head -20Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 474
Block merge until task-upgrade breaking changes are evaluated.
This PR upgrades buildah-oci-ta 0.9→0.10 and sast-snyk-check-oci-ta 0.4→0.5, both with documented breaking changes (CWE-829: Improper Initialization, CWE-436: Untrusted Input). No migration evidence exists in-repo:
-
buildah-oci-ta 0.10 requires: runner image change to konflux-build-cli, workspace binding removal from spec, result references to IMAGE_URL/IMAGE_DIGEST/IMAGE_REF/SBOM_BLOB_URL, securityContext validation (now runs as root explicitly), and re-testing of hermetic/prefetch/annotations/labels behavior via kbc.
-
sast-snyk-check-oci-ta 0.5 requires: automated migration via Konflux pmt tool against MIGRATION.md from konflux-sast-tasks source, with mandatory parameter/result/workspace validation.
-
Platform version skew:
hyperfleet-apiandhyperfleet-sentinelremain pinned to 0.9 and 0.4 respectively. Post-merge, CI behavior diverges across services, creating integration risk.
PR objectives explicitly require migration-guide review. Verify all breaking changes are handled before unblocking.
References
- buildah-oci-ta 0.10 changelog: https://github.com/konflux-ci/build-definitions/commit/09d4dc96a727135bed510140067cf40eab2f3819 - sast-snyk-check-oci-ta 0.5 migration: https://docs.konflux-ci.dev/apply-task-migrations/🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/hyperfleet-adapter-push.yaml at line 234, Before committing the task
version upgrades for buildah-oci-ta to 0.10 and sast-snyk-check-oci-ta to 0.5 in
the hyperfleet-adapter-push.yaml file, you must complete the breaking change
migrations documented in the task changelogs. For buildah-oci-ta 0.10, update
the runner image to konflux-build-cli, remove workspace bindings from the spec,
update all result references to use
IMAGE_URL/IMAGE_DIGEST/IMAGE_REF/SBOM_BLOB_URL, validate the securityContext
configuration, and test the hermetic, prefetch, annotations, and labels
behavior. For sast-snyk-check-oci-ta 0.5, run the automated migration using the
Konflux pmt tool against the MIGRATION.md file and validate all parameters,
results, and workspace configurations. Additionally, update the task versions in
hyperfleet-api and hyperfleet-sentinel configurations from 0.9 and 0.4
respectively to match the new versions (0.10 and 0.5) to eliminate platform
version skew. Document all migration changes with evidence in the repository
before unblocking the merge.
Source: Linked repositories
This PR contains the following updates:
d3d7e18→da894660.9→0.1088f4fd6→3c4f60e3dc78af→7e84b01237c54b→c78924d3cbb353→e5319fc0.4→0.52238120→99cc372Release Notes
konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)
v0.10Fixed
labels.jsonfile will now better match the actual image labelsin cases when the containerfile includes quoted
LABELvalues. This is a resultof dockerfile-json#16.
Configuration
📅 Schedule: Branch creation - Between 05:00 AM and 11:59 PM, only on Saturday ( * 5-23 * * 6 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.