You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
ADDITIONAL_TAGS_FROM_LABEL parameter to specify image label to read additional tags from.
For now set previously hardcoded value konflux.additional-tags by default to avoid changing the task behavior.
IMAGE_PLATFORM_MAP parameter: optional per-image platform mapping
(imageRef=os/arch entries) passed to konflux-build-cli as --image-platform-map. This sets the platform on each index entry explicitly,
which is required for OCI artifacts whose empty config carries no platform
information (e.g. disk images), where the platform would otherwise be null.
When empty (the default), behaviour is unchanged.
All ssh and rsync invocations to the build VM now share a single ssh
connection. The build step writes an ~/.ssh/config with ControlMaster auto, ControlPath and ControlPersist, so only the first invocation pays the cost
of the TCP handshake, key exchange and authentication.
Removed the SSH port forwarding from decommissioned JVM Build Service artifact cache
(JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR) from the remote build. This is just cleanup of unused code.
Normalize Konflux node-pool suffixes in image-arch before selecting an OCI
manifest. A scheduling label such as linux-m2xlarge/arm64 is treated as linux/arm64, so the scan matches the image manifest.
Scan Linux, Windows, and macOS container images by retaining each manifest's
OCI operating system and architecture during platform selection and layer
extraction. The image-arch parameter now accepts full OCI platforms and
recognizes mac, macos, and osx as aliases for darwin.
Pre-extract every nested archive into a loose file tree before scanning, so
clamd scans each file directly instead of recursing through nested archive
layers. This makes scanning of deeply nested archives faster. Extraction uses bsdtar, which detects archives (zip/jar/war/ear/tar
and tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
the OCI dir: payload is an extension-less blob — and unpacks them
unconditionally with no size/count/depth limits. It is defensive: a corrupt or
partial archive is left in place for clamd rather than aborting the scan. No new
parameters are introduced. Requires the clamav-db image to ship bsdtar
(added in konflux-clamav).
Skip downloading OCI layers whose manifest annotations name only unscannable
model-weight files (.safetensors, .gguf, .ggml, .pt, .pth, .onnx, .onnx_data / .onnx_data_*), using org.opencontainers.image.title and olot.layer.content.inlayerpath. Any other annotated layer is skipped when
the OCI descriptor size is at least 2000MiB (slightly under ClamAV's ~2GiB
MaxFileSize), regardless of extension. Layers without those annotations are
still listed with --dry-run as in 0.3.2. The --dry-run skip uses the
same name list.
Updated rox-image-scan and exchange-service-account-token steps image to version 4.11.5 by following digest registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:98f01d623e119acbbc211bdeb36192b619969aa149d9c66bab8034eeef84c861
Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
Added the missing migration that removes the obsolete CACHI2_ARTIFACT parameter
from user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
Cargo prefetched dependencies are now included in the source image. They are
vendored as unpacked source trees rather than archives, so previously they
were missed by the archive-type filter and left out of the source image.
No actionable comments were generated in the recent review.
Walkthrough
Both Tekton PipelineRuns update task bundle versions and pinned digests. The Snyk, shell, and Unicode SAST tasks no longer receive the CACHI2_ARTIFACT parameter.
Changes: Tekton PipelineRuns
Layer / File(s)
Summary
Setup and build task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml
Both PipelineRuns update bundle references for initialization, source retrieval, dependency prefetch, image building, image indexing, source building, and Tekton bundle tasks.
Validation and scan task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml
Both PipelineRuns update bundle references for image checks, security scans, and preflight checks. The Snyk, shell, and Unicode SAST tasks no longer receive CACHI2_ARTIFACT.
Tagging and publishing task bundles .tekton/cli-main-pull-request.yaml, .tekton/cli-main-push.yaml
Both PipelineRuns update bundle references for applying tags, pushing Dockerfiles, and scanning RPM signatures.
The pipeline references and SAST parameters are updated. No merge-blocking issue is established, though the external bundle contents remain unverified.
Pre-merge checks: 4 · 1
Failed checks: 1 inconclusive
Check name
Status
Explanation
Resolution
Description check
The description follows the Renovate-generated format. It lists each updated bundle reference with its version or digest change, release notes, and configuration details. It does not use the repositor…
Add the repository template sections to the description. Under "What", state that the PR updates Konflux Tekton bundle references in .tekton/cli-main-pull-request.yaml and .tekton/cli-main-push.yaml. Under "Why", explain the reason for the …
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title "Update Konflux references (main) (patch)" identifies the change type and the affected component. The changeset updates Konflux Tekton bundle references in .tekton PipelineRun files, which m…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "Update Konflux references (main) (patch)" identifies the change type and the affected component. The changeset updates Konflux Tekton bundle references in .tekton PipelineRun files, which matches the title. The title is generic about which references change, but it is related to the main change and is not misleading.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Full details: Description check
Explanation
The description follows the Renovate-generated format. It lists each updated bundle reference with its version or digest change, release notes, and configuration details. It does not use the repository template sections "What", "Why", or "Tickets". The Why section is covered only by the auto-generated objective and release notes, and no Jira ticket is linked. The description also does not report test results.
Resolution
Add the repository template sections to the description. Under "What", state that the PR updates Konflux Tekton bundle references in .tekton/cli-main-pull-request.yaml and .tekton/cli-main-push.yaml. Under "Why", explain the reason for the update and note the removal of the obsolete CACHI2_ARTIFACT parameter from the Snyk, shell, and Unicode SAST tasks. Under "Tickets", link the related Jira issue, or state that none exists.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2c8ad2dd-932e-4d6e-bb89-d1848e5b66a0
Commits
Reviewing files that changed from the base of the PR and between afe0145 and 4b4b4ae.
Files selected for processing: 2
.tekton/cli-main-pull-request.yaml
.tekton/cli-main-push.yaml
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.
Routine automated bot PR updating two Tekton CI config files with uniformly low Tier 1 signals (score 1.0) and benign Tier 2 history; only mild signal is files last touched about 63 days ago, consistent with automated bundle-reference update cadence, yielding a composite of 0.62x1.0 + 0.38x1.5 = 1.19, rounding to 1.
Routine automated bot PR updating two Tekton CI config files with minimal change size, no security-sensitive paths, no regression or revert history, and single-author bot activity; only mild signal is files not touched in ~58 days but this is consistent with automated bundle-reference update cadence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
the
ready-for-merge
This PR contains the following updates:
0.3→0.3.20.3.1→0.40.12.0→0.12.30.3.2→0.3.60ccc688→f86e420b961f8b→0b1783a3bcd4c3→c3c10715f68715→67bea820.10.1→0.10.4393b4d0→d9d5ecd0.1→0.1.1f110c53→a0942640.1→0.1.10.5→0.5.10.4→0.4.10.3→0.3.20.2→0.2.5Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)
v0.3.2Added
ADDITIONAL_TAGS_FROM_LABELparameter to specify image label to read additional tags from.For now set previously hardcoded value
konflux.additional-tagsby default to avoid changing the task behavior.v0.3.1Changed
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-build-image-index)
v0.4Added
IMAGE_PLATFORM_MAPparameter: optional per-image platform mapping(
imageRef=os/archentries) passed tokonflux-build-clias--image-platform-map. This sets the platform on each index entry explicitly,which is required for OCI artifacts whose empty config carries no platform
information (e.g. disk images), where the platform would otherwise be null.
When empty (the default), behaviour is unchanged.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)
v0.12.3Changed
sshandrsyncinvocations to the build VM now share a single sshconnection. The build step writes an
~/.ssh/configwithControlMaster auto,ControlPathandControlPersist, so only the first invocation pays the costof the TCP handshake, key exchange and authentication.
v0.12.2Removed
(
JVM_BUILD_WORKSPACE_ARTIFACT_CACHE_PORT_80_TCP_ADDR) from the remote build. This is just cleanup of unused code.v0.12.1Changed
prepare-sbomsstep memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).prepare-sbomsCPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)
v0.3.6Fixed
image-archbefore selecting an OCImanifest. A scheduling label such as
linux-m2xlarge/arm64is treated aslinux/arm64, so the scan matches the image manifest.v0.3.5Added
OCI operating system and architecture during platform selection and layer
extraction. The
image-archparameter now accepts full OCI platforms andrecognizes
mac,macos, andosxas aliases fordarwin.v0.3.4Added
clamd scans each file directly instead of recursing through nested archive
layers. This makes scanning of deeply nested archives faster. Extraction uses
bsdtar, which detects archives (zip/jar/war/ear/tarand tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
the OCI
dir:payload is an extension-less blob — and unpacks themunconditionally with no size/count/depth limits. It is defensive: a corrupt or
partial archive is left in place for clamd rather than aborting the scan. No new
parameters are introduced. Requires the
clamav-dbimage to shipbsdtar(added in konflux-clamav).
v0.3.3Changed
model-weight files (
.safetensors,.gguf,.ggml,.pt,.pth,.onnx,.onnx_data/.onnx_data_*), usingorg.opencontainers.image.titleandolot.layer.content.inlayerpath. Any other annotated layer is skipped whenthe OCI descriptor
sizeis at least 2000MiB (slightly under ClamAV's ~2GiBMaxFileSize), regardless of extension. Layers without those annotations are
still listed with
--dry-runas in 0.3.2. The--dry-runskip uses thesame name list.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.10.4v0.10.3v0.10.2konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)
v0.1.1Changed
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta)
v0.1.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta)
v0.5.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/konflux-sast-tasks (quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta)
v0.4.1Fixed
CACHI2_ARTIFACTparameterfrom user pipelines. The parameter was dropped from the task definition in an
earlier release, but pipelines kept passing it.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)
v0.3.2Fixed
vendored as unpacked source trees rather than archives, so previously they
were missed by the archive-type filter and left out of the source image.
v0.3.1Changed
Configuration
📅 Schedule: (UTC)
* * * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.