-
Notifications
You must be signed in to change notification settings - Fork 21
Update Konflux references #199
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
red-hat-konflux-kflux-prd-rh02
wants to merge
1
commit into
main
Choose a base branch
from
konflux/references/main
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
Konflux tekton-catalog task-buildah-oci-ta 0.10 migration guide from 0.9 (required parameter/result/workspace changes)💡 Result:
Required parameter/result/workspace changes for task-buildah-oci-ta:0.10 (Konflux tekton-catalog) migrating from 0.9: 1) Runner image change (impacts how the task runs, not pipeline params/workspaces) - In buildah*/0.10, the buildah task image is replaced with konflux-build-cli (kbc-based flow). [1] - 0.10 now “sets runAsUser: 0 explicitly” (previously it ran as root implicitly), so if your pipeline/controller policies override securityContext you may need to re-check. [1] 2) Workspace binding change in the shipped pipelines - The docker-build-oci-ta pipeline customization patch for 0.10 removes a workspace binding at /spec/workspaces/0. That indicates pipelines upgrading to 0.10 should drop that workspace binding and rely on the task’s OCI-artifact/result-based data flow instead. [2] 3) Task results you must wire (result key names) - buildah-oci-ta:0.10 exposes results including IMAGE_DIGEST, IMAGE_REF, IMAGE_URL, and SBOM_BLOB_URL, and pipeline params can reference them by those result names. If your 0.9 pipeline referenced different result names, update them to the 0.10 keys. [3] 4) Behavior-affecting internal parameter handling (validate your overrides against the new semantics) - 0.10 changes multiple internal behaviors by passing values directly to kbc, including: a) annotations+labels handling via kbc. [4] b) hermetic mode handling via kbc. [5] c) prefetch integration via kbc. [6] d) working directory mount handling via kbc. [7] These may not require parameter schema changes, but they can affect behavior if your 0.9 pipeline depended on previous side-effects. What to do when migrating your pipeline from 0.9 -> 0.10: - Bump the task bundle version to task-buildah-oci-ta:0.10. [1] - Remove the pipeline workspace binding corresponding to /spec/workspaces/0 (as per the 0.10 pipeline patch). [2] - Update any task result references to use IMAGE_DIGEST / IMAGE_REF / IMAGE_URL / SBOM_BLOB_URL for buildah-oci-ta:0.10. [3] - Re-test/verify behavior for hermetic builds, prefetch, and annotations/labels if you set related params, because 0.10 routes these through kbc. [4][5][6] Note: build-definitions does include a per-task version MIGRATION.md file (task/buildah-oci-ta/0.10/MIGRATION.md), but in the retrieved sources for this run I did not get the MIGRATION.md contents themselves; the migration-impact items above are grounded in the 0.10 change commit notes and the published pipeline patch/README schemas. [1][3][2]
Citations:
🌐 Web query:
Konflux tekton-catalog task-sast-snyk-check-oci-ta 0.5 migration guide from 0.4 (required parameter/result/workspace changes)💡 Result:
To migrate the Konflux tekton-catalog task
sast-snyk-check-oci-tafrom version 0.4 to 0.5, you should rely on the automated migration process provided by Konflux [1]. As of June 2026, version 0.5 ofsast-snyk-check-oci-tahas been released in thekonflux-sast-tasksrepository [2]. Konflux automates task upgrades using thepipeline-migration-tool(pmt), which is integrated into the regular pull request workflow for updating Tekton tasks [1]. If you need to verify or apply these changes manually: 1. Locate theMIGRATION.mdfile within the task's directory in thekonflux-sast-taskssource repository (specificallytask/sast-snyk-check-oci-ta/0.5/MIGRATION.md) [2]. This file contains the authoritative, version-specific instructions regarding any required parameter, result, or workspace changes that may have been introduced in the 0.5 release. 2. If your automated build update is not triggering or applying correctly, you can use thepmtCLI tool in your component repository to apply the migration. You will need to generate the appropriate upgrade data—which maps the old bundle (0.4) to the new bundle (0.5)—and execute thepmt migratecommand [1]. Because task migrations can involve specific breaking changes to inputs (parameters) or outputs (results), checking theMIGRATION.mdfile in the source repository is the mandatory step to ensure compatibility with your existing pipeline definition [1][2].Citations:
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 133
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-adapter
Length of output: 11190
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 469
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 474
Block merge until task-upgrade breaking changes are evaluated.
This PR upgrades
buildah-oci-ta0.9→0.10 andsast-snyk-check-oci-ta0.4→0.5, both with documented breaking changes (CWE-829: Improper Initialization, CWE-436: Untrusted Input). No migration evidence exists in-repo:buildah-oci-ta 0.10 requires: runner image change to konflux-build-cli, workspace binding removal from spec, result references to IMAGE_URL/IMAGE_DIGEST/IMAGE_REF/SBOM_BLOB_URL, securityContext validation (now runs as root explicitly), and re-testing of hermetic/prefetch/annotations/labels behavior via kbc.
sast-snyk-check-oci-ta 0.5 requires: automated migration via Konflux pmt tool against MIGRATION.md from konflux-sast-tasks source, with mandatory parameter/result/workspace validation.
Platform version skew:
hyperfleet-apiandhyperfleet-sentinelremain pinned to 0.9 and 0.4 respectively. Post-merge, CI behavior diverges across services, creating integration risk.PR objectives explicitly require migration-guide review. Verify all breaking changes are handled before unblocking.
References
- buildah-oci-ta 0.10 changelog: https://github.com/konflux-ci/build-definitions/commit/09d4dc96a727135bed510140067cf40eab2f3819 - sast-snyk-check-oci-ta 0.5 migration: https://docs.konflux-ci.dev/apply-task-migrations/🤖 Prompt for AI Agents
Source: Linked repositories