Update Konflux references

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	f89a59d → 2dae3c4
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	714a86d → c2cda69
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	digest	de5580c → cf32941
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	minor	0.3.2 → 0.4.0
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2.5 → 0.2.6
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	4dbbfed → 5f68715
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.9.0 → 0.10.1
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	ee041e2 → 393b4d0
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	cc51335 → 538a853
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	c7ecd1e → 6bb2697

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4

Changed

0.4 is a dummy version used to facilitate the migration from clair-scan 0.3 to roxctl-scan 0.1

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign aredenba-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8e3bf57c-62b1-46ee-af5c-eed095c6ed7c

📥 Commits

Reviewing files that changed from the base of the PR and between 3f746a5 and 473eec9.

📒 Files selected for processing (4)

• .tekton/hyperfleet-adapter-chart-push.yaml
• .tekton/hyperfleet-adapter-chart-tag.yaml
• .tekton/hyperfleet-adapter-push.yaml
• .tekton/hyperfleet-adapter-tag.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual) → reviewed against open PR #348 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-sentinel (manual) → reviewed against open PR #251 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated pipeline task bundles to newer versions and immutable references.
  • Improved the reliability and consistency of automated build and deployment workflows.

Walkthrough

Four Tekton pipeline configurations update pinned task bundle references. Git clone and dependency-prefetch tasks advance to newer versions. The Clair scan task advances from version 0.3.2 to 0.4.0. Other task references receive replacement immutable digests. Pipeline task ordering, parameters, conditions, and wiring remain unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 473ee

This PR updates pinned Tekton task references and versions in the build pipelines; no actionable merge-blocking risk remains beyond normal checks and owner review.

Suggested reviewers: jsell-rh, ruclo, ciaranroche

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	The PR changes only 26 Tekton YAML bundle-reference lines; no slog, log, logr, zap, or fmt.Print* statement or sensitive logging field was added. No CWE/CVE finding applies.
No Hardcoded Secrets	✅ Passed	The diff adds only public quay.io bundle references and 64-character hexadecimal SHA-256 digests; scans found no credential URLs, private keys, base64 payloads, or secret assignments.
No Weak Cryptography	✅ Passed	The PR diff only replaces Tekton bundle versions and SHA-256 image digests; no banned primitive, ECB mode, custom crypto, or secret comparison was added.
No Injection Vectors	✅ Passed	HEAD^..HEAD changes only 26 immutable Tekton bundle value lines; no added SQL concatenation, exec.Command*, template.HTML, or yaml.Unmarshal patterns (CWE-89/78/79/502).
No Privileged Containers	✅ Passed	PR changes only Tekton bundle references in four CI PipelineRuns. No prohibited security fields or Dockerfiles changed; the check excludes CI manifests not deployed to production.
No Pii Or Sensitive Data In Logs	✅ Passed	Diff changes only immutable Tekton bundle references in four YAML files. It adds no logging statements or logged PII, request bodies, session IDs, or credentialed hostnames.
Title check	✅ Passed	The title clearly identifies the main change: updating Konflux references.
Description check	✅ Passed	The description lists the updated Tekton bundles, versions, digests, release notes, and merge configuration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	52 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}