chore(deps): update konflux references - #224
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Amber reviewStatus: Complete VerdictThis is a Konflux/renovate-generated bump of the Tekton task-bundle references across all nine SummaryA low-risk, bot-generated dependency update touching only Konflux CI pipeline definitions. No Go/production code, pod specs, or API contracts are affected, so the usual HyperShell error-handling / security-context / reconcile conventions do not apply here. Findings[Minor] PR description does not match the actual scanner change — CI / Supply-chain clarity The PR body's update table lists Everything else (clamav-scan, ecosystem-cert-preflight-checks, rpms-signature-scan, sast-shell-check, sast-snyk-check, sast-unicode-check) is a straightforward digest/patch bump and looks fine. Cross-PR coordinationNo material cross-PR coordination issue requires maintainer action. Findings Summary (ordered by severity, highest first)
Convention Checklist
|
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict
This is a Konflux/renovate-generated bump of the Tekton task-bundle references across all nine .tekton/ pipelines, and the changes are applied consistently (no stale clair-scan references remain and every bundle is pinned by sha256 digest). One point deserves maintainer attention: the diff does more than the PR body's version table describes — it swaps the clair-scan vulnerability scanner out for roxctl-scan entirely, which is a functional CI change rather than the 0.4.0 → 0.4.1 update the description advertises.
Summary
A low-risk, bot-generated dependency update touching only Konflux CI pipeline definitions. No Go/production code, pod specs, or API contracts are affected, so the usual HyperShell error-handling / security-context / reconcile conventions do not apply here.
Findings
[Minor] PR description does not match the actual scanner change — CI / Supply-chain clarity
The PR body's update table lists task-clair-scan 0.4.0 → 0.4.1, but the diff replaces the clair-scan task (name, taskRef name, and bundle) with roxctl-scan:0.1 in all nine pipelines. Replacing the image vulnerability scanner is a meaningful supply-chain/CI behavior change, not a patch bump. Confirm this scanner migration is intended and that roxctl-scan is correctly wired (e.g., any required roxctl central-endpoint/token config or .tekton params it expects are in place) before merge, otherwise the vulnerability-scan gate could silently no-op or fail. Confidence: High that the swap occurred; Medium on whether it is intended vs. an unexpected mintmaker migration.
Everything else (clamav-scan, ecosystem-cert-preflight-checks, rpms-signature-scan, sast-shell-check, sast-snyk-check, sast-unicode-check) is a straightforward digest/patch bump and looks fine.
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Findings Summary (ordered by severity, highest first)
- [Minor] PR body advertises a
clair-scanpatch bump but the diff replaces it withroxctl-scanacross all pipelines; confirm the scanner migration is intended and fully configured - CI / Supply-chain (.tekton/*)
Convention Checklist
| Convention | Result |
|---|---|
| Image/bundle references consistent across manifests | Pass |
Bundle references pinned by digest (@sha256) |
Pass |
| Conventional commit message | Pass |
| Change matches PR description | Fail |
| value: roxctl-scan | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.0@sha256:dcc6ca58d3ec03d05ce21c03b4f51b58cac9878caa932ad06a9fdf4bc422aaab | ||
| value: quay.io/konflux-ci/tekton-catalog/task-roxctl-scan:0.1@sha256:76ed85aa05ce42d31341269837f104c3b766508313a68439085dcf9cc89d03f4 |
There was a problem hiding this comment.
This is not a clair-scan 0.4.0 → 0.4.1 bump as the PR body states — the clair-scan task is being replaced outright by roxctl-scan:0.1 (here and in the name/taskRef entries above), and the same swap is applied to all nine .tekton/ pipelines. Replacing the image vulnerability scanner is a functional supply-chain/CI change. Please confirm the migration to roxctl is intended and that any configuration roxctl-scan requires (e.g., ROX central endpoint / API token secret, expected params) is present, so the scan gate does not silently no-op or start failing. The remaining bundle bumps in this file are ordinary digest/patch updates and look correct.
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
65f37a2 to
4a3df8f
Compare
Amber reviewStatus: Complete |
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict
This is a Konflux/MintMaker automated update that bumps Tekton task bundle digests and versions across all nine .tekton pipeline files, applied uniformly and consistently. It is functionally low-risk, but the diff quietly replaces the clair-scan vulnerability scanner with roxctl-scan in every pipeline - a change the PR body does not describe - so I recommend a maintainer confirm the swap is intended and that ACS integration is configured before merge.
Findings
[Major] Undocumented security-scanner swap: clair-scan -> roxctl-scan - Security / CI
All nine pipeline files replace the clair-scan task with roxctl-scan (task-roxctl-scan:0.1). The PR body only lists a clair-scan patch bump (0.4.0 -> 0.4.1) and does not mention removing Clair or adopting roxctl/ACS. This is a material change to how container images are scanned for vulnerabilities:
roxctl-scanscans against Red Hat Advanced Cluster Security (StackRox) and requires an ACS integration secret and central endpoint in the build namespace to function. If that integration is not configured, the task may fail the pipeline or produce no meaningful scan coverage.- The task is added with only
image-digestandimage-urlparams; confirm the Konflux tenant provides the defaultroxsecret so the scan actually runs.
Recommendation: a maintainer should confirm the migration off Clair is intended and that ACS integration exists, and the swap should be called out in the PR description rather than merged as an unlisted side effect of a digest bump. Confidence: High (the swap is present in the diff); Medium (impact depends on tenant ACS configuration I cannot see).
[Minor] PR description does not match the diff - Process
The Renovate/MintMaker summary table understates the change set (it frames the clair change as a patch update). Reviewers relying on the body alone would miss the scanner replacement. Confidence: High.
Positive notes
- Task bundle digests are consistent across all nine files (verified
task-init,task-buildah,task-roxctl-scanresolve to a single digest each). No image-reference drift. - Conventional commit message (
chore(deps): update konflux references). - No Go/production-code, pod-spec, secret, or API changes; the standard error-handling, SecurityContext, and reconcile conventions are not applicable to this diff.
Cross-PR coordination
No material cross-PR coordination issue requires maintainer action.
Findings Summary (ordered by severity, highest first):
- [Major] Undocumented replacement of
clair-scanwithroxctl-scanacross all nine pipelines; confirm intent and ACS integration - Security / CI - [Minor] PR body/summary does not reflect the scanner swap - Process
Convention Checklist (only rows applicable to this diff):
| Convention | Result |
|---|---|
| Image/bundle references consistent across manifests | Pass |
| Conventional commit message | Pass |
| Change described accurately in PR body | Fail |
| values: | ||
| - "false" | ||
| - name: clair-scan | ||
| - name: roxctl-scan |
There was a problem hiding this comment.
This hunk replaces the clair-scan task with roxctl-scan in every pipeline, which is not mentioned in the PR description (it lists only a clair-scan patch bump). roxctl-scan scans via Red Hat ACS/StackRox and needs an ACS integration secret + central endpoint in the build namespace to work; the task is wired with only image-digest/image-url. Please confirm the move off Clair is intended and that ACS integration is configured, and note the swap in the PR body.
1 participant
This PR contains the following updates:
0.3→0.3.1c2cda69→290c9ec0.12.0→0.12.10.4.0→0.4.10.3.1→0.3.34619769→c07d2be7d5d1ae→0d3092d5f68715→4be93430.10.1→0.10.21c404be→b15e2280.2.1→0.2.2f3e8337→f40df2d2dc0d6d→691d805ca39124→d03eee40.3→0.3.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)
v0.3.1Changed
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah)
v0.12.1Changed
prepare-sbomsstep memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).prepare-sbomsCPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.4.1Changed
Allign script and task version.
konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)
v0.3.3Changed
model-weight files (
.safetensors,.gguf,.ggml,.pt,.pth,.onnx,.onnx_data/.onnx_data_*), usingorg.opencontainers.image.titleandolot.layer.content.inlayerpath. Any other annotated layer is skipped whenthe OCI descriptor
sizeis at least 2000MiB (slightly under ClamAV's ~2GiBMaxFileSize), regardless of extension. Layers without those annotations are
still listed with
--dry-runas in 0.3.2. The--dry-runskip uses thesame name list.
v0.3.2Added
(
.safetensors,.gguf,.ggml). Other layers are still extracted andscanned. If layer listing fails, the task falls back to extracting the
full image.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies)
v0.10.2konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build)
v0.3.1Changed
Configuration
📅 Schedule: (in timezone America/New_York)
* 5-23 * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.