Update Konflux references

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta (source, changelog)	tekton-bundle	digest	1de9b1c → 1957c12
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.10 → 0.10.5
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	e78d0d3 → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	2e5ebe0 → 27c9760
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	patch	0.2 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	patch	0.4 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.3 → 0.6.0
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2 → 0.2.1
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	f6a115e → 5e4586b
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	918327b → eba24f5
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	4961c44 → eb9d539

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.10.5

Added

• Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
  --rhsm-mount-ca-certs option.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.6.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

v0.4.1

Fixed

• Mount the trusted-ca volume in the use-trusted-artifact and create-trusted-artifact steps.
  Previously, the mount was missing, which means the task did not support container registries
  with certificates signed by a private/self-signed CA.

v0.4.0

• Hermeto releases from 0.55.0 to 0.57.1 - hermetoproject/hermeto@0.55.0...0.57.1

v0.3.2

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ma-hill for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

The Tekton chart-push, push, and tag PipelineRuns update pinned catalog task bundle versions and digests. The push and tag pipelines add source-date-epoch, rewrite-timestamp, and omit-history parameters, forwarding them to buildah-oci-ta for image construction.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PipelineRun
  participant buildah_oci_ta
  participant BuiltImage
  PipelineRun->>buildah_oci_ta: Forwards reproducibility parameters
  buildah_oci_ta->>BuiltImage: Builds image with configured timestamps and history

Loading

Suggested reviewers: ciaranroche

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	No slog/logr/zap/fmt.Print* calls or secret-bearing log fields in the changed files; the lone printf writes a version result, not logs. No CWE-532 issue.
No Hardcoded Secrets	✅ Passed	No CWE-798 hardcoded credentials: only templated git_auth_secret placeholders and Tekton bundle digests/URLs; no apiKey/secret/token/password literals or user:pass@ URLs.
No Weak Cryptography	✅ Passed	No banned primitives or secret compares appear in the changed Tekton YAML; only bundle pins and build params. CWE-327/328/916 not implicated.
No Injection Vectors	✅ Passed	Only Tekton YAML bundle/param updates; no SQL, exec.Command, template.HTML, or yaml.Unmarshal on untrusted input. No CWE-89/78/79/502 vector.
No Privileged Containers	✅ Passed	No privileged settings in the changed Tekton manifests; no privileged:true, hostNetwork/PID/IPC, allowPrivilegeEscalation, runAsUser:0, or SYS_ADMIN found (CWE-250/284).
No Pii Or Sensitive Data In Logs	✅ Passed	No CWE-532 finding: the PR only updates Tekton bundle refs and params; no slog/logr/zap/fmt.Print logging or PII-bearing outputs were added. No sensitive data exposure.
Title check	✅ Passed	The title matches the main change: updating Konflux Tekton bundle references.
Description check	✅ Passed	The description covers the Konflux bundle/version and digest updates reflected in the PR.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	104 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}