Update Konflux references 0.x

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	c2cda69 → 290c9ec
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.12.0 → 0.12.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.2 → 0.3.3
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	b961f8b → c07d2be
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	3bcd4c3 → 2e8fe30
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	5f68715 → 4be9343
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	patch	0.10.1 → 0.10.2
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	393b4d0 → ef00a86
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	digest	76ed85a → 97e2b2c
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	f110c53 → 9ef4dab
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	c06bee8 → afa8ba8
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	97231d2 → 67a409d
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	6a7fbfa → 69d5fca
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3.1

Changed

• Nothing. Started using semver specification for version labels.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.12.1

Changed

• Bump prepare-sboms step memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).
• Remove prepare-sboms CPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.3

Changed

• Skip downloading OCI layers whose manifest annotations name only unscannable
  model-weight files (.safetensors, .gguf, .ggml, .pt, .pth, .onnx,
  .onnx_data / .onnx_data_*), using org.opencontainers.image.title and
  olot.layer.content.inlayerpath. Any other annotated layer is skipped when
  the OCI descriptor size is at least 2000MiB (slightly under ClamAV's ~2GiB
  MaxFileSize), regardless of extension. Layers without those annotations are
  still listed with --dry-run as in 0.3.2. The --dry-run skip uses the
  same name list.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.2

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.1

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

v0.3.1

Changed

• Nothing. Started using semver specification for version labels.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d236acaa-3c9c-4973-801b-aa607b7f3ff2

📥 Commits

Reviewing files that changed from the base of the PR and between 58c0bf8 and 8e259b2.

📒 Files selected for processing (4)

• .tekton/hyperfleet-api-chart-push.yaml
• .tekton/hyperfleet-api-chart-tag.yaml
• .tekton/hyperfleet-api-push.yaml
• .tekton/hyperfleet-api-tag.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual) → reviewed against open PR #262 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #294 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the automated build, packaging, validation, and security-checking tooling to newer maintained versions.
  • Refreshed integrity references for pipeline tasks while preserving existing workflow sequencing and conditional execution.
  • No user-facing functionality or application behavior changed.

Walkthrough

Updated pinned Tekton task bundle digests in four pipeline definitions. Upgraded dependency prefetching, Buildah, source-build, ClamAV, and apply-tags task versions where specified. Pipeline wiring and conditional execution remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8e259

This updates pinned Tekton task bundle versions and digests without changing pipeline wiring or execution conditions. No current merge-blocking risk is identified.

Suggested reviewers: ciaranroche

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: updating Konflux references. It is concise and related to the bundle version and digest updates.
Description check	✅ Passed	The description directly documents the Konflux Tekton bundle version and digest updates, release notes, and merge configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: The pull request changes only four .tekton YAML files. The 40 added lines only replace Tekton bundle image tags and SHA256 digests. No added line contains slog, logr, zap, fmt.Print*, …
No Hardcoded Secrets	✅ Passed	No hardcoded secret was introduced. The parent-to-HEAD diff adds only OCI bundle references with 64-character hexadecimal sha256 digests. These are image integrity digests, not base64 secrets. Added…
No Weak Cryptography	✅ Passed	PASS: The revision changes only 40 Tekton bundle reference lines in four YAML files. Every added line is a pinned quay.io reference with a SHA-256 digest. No crypto/md5, DES, RC4, SHA-1 security u…
No Injection Vectors	✅ Passed	PASS. The PR changes only 40 Tekton bundle-value lines in four YAML files. Every addition is a hardcoded quay.io/konflux-ci/tekton-catalog/...@sha256:<64-hex-digest> reference. No added SQL construc…
No Privileged Containers	✅ Passed	PASS. The commit changes only pinned Tekton bundle references in four .tekton PipelineRun CI manifests. The diff introduces no privileged: true, host namespace settings, SYS_ADMIN, `allowPrivi…
No Pii Or Sensitive Data In Logs	✅ Passed	No logging statement was introduced. The pull request changes only 40 Tekton bundle-reference lines in four .tekton/*.yaml files. The added-line check found zero matches for slog, logr, zap, `…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	80 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}