OCM-00000 | ci: Update Konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Change
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	2e79e47 → 53678a1
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	f6a115e → 2e8a61a
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	918327b → b865be5
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	4961c44 → 924deef

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by CodeRabbit

• Chores
  • Updated security and compliance checks to reference newer Tekton Pipeline task bundle digests for sast and rpms-signature-scan.
  • No changes to pipeline behavior, configuration, or task processing.

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated the Tekton release pipeline to use newer bundle digests for the Snyk, shell, Unicode, and RPM signature scan tasks. No pipeline parameters, task wiring, conditions, or task logic changed.

Possibly related PRs

• openshift/rosa#3379: Updates the rpms-signature-scan Tekton task bundle digest.

Suggested reviewers: robpblake, gdbranco

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description lists updated packages, but it omits most required template sections like PR summary, issue context, testing, and verification.	Fill in the template sections: PR Summary, issue context, related issues, change type, previous/after behavior, test steps/results, proof, and checklist items.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes .tekton/rosa-github-release.yaml bundle digests; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	Diff only updates .tekton/rosa-github-release.yaml bundle digests; no Ginkgo test code or assertions were changed.
Microshift Test Compatibility	✅ Passed	PR only updates Tekton bundle digests in a YAML pipeline; no new Ginkgo tests or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates Tekton bundle digests in .tekton/rosa-github-release.yaml; no Ginkgo/e2e tests were added or modified.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only updates Tekton task bundle digests in a PipelineRun; no affinity, node selectors, spread constraints, PDBs, or replica logic were introduced.
Ote Binary Stdout Contract	✅ Passed	PR only updates Tekton bundle digests in .tekton/rosa-github-release.yaml; no main/init/TestMain/suite code or stdout writes changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only .tekton/rosa-github-release.yaml changed; no new Ginkgo/e2e tests or network code were added.
No-Weak-Crypto	✅ Passed	Diff only updates Tekton bundle references to SHA-256 digests; no MD5/SHA1/DES/RC4/ECB, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	The PR only updates Tekton bundle digests; the changed YAML contains no privileged, host*, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The only change updates Tekton bundle digests in a YAML pipeline; no logging statements or sensitive data exposure were added.
Title check	✅ Passed	The title is concise and accurately reflects the CI-related Konflux reference update.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/master

---

_{Comment @coderabbitai help to get the list of available commands.}

[amandahla]

/approve
/lgtm

[openshift-ci]

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[olucasfreitas]

/approve
/lgtm
/override "Red Hat Konflux / rh-rosa-cli-enterprise-contract / rosa"
/override "Red Hat Konflux / rosa-on-pull-request"

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amandahla, olucasfreitas, red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [amandahla,olucasfreitas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@olucasfreitas: Overrode contexts on behalf of olucasfreitas: Red Hat Konflux / rh-rosa-cli-enterprise-contract / rosa, Red Hat Konflux / rosa-on-pull-request

Details

In response to this:

/approve
/lgtm
/override "Red Hat Konflux / rh-rosa-cli-enterprise-contract / rosa"
/override "Red Hat Konflux / rosa-on-pull-request"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.