UPSTREAM: <carry>: Update Konflux references

[red-hat-konflux-kflux-prd-rh03]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	a291081 → 6387614
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	0.10 → 0.10.7
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	e78d0d3 → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	3c4f60e → e438f31
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	0.2 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	0.4 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	0.3 → 0.6.0	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	0.2 → 0.2.1
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	fc685d6 → d33d800
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	fda2e51 → f4818f8
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	5807ffe → f31055c
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	0.1 → 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	d8115c7 → 5a30dfe

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.6.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

v0.4.1

Fixed

• Mount the trusted-ca volume in the use-trusted-artifact and create-trusted-artifact steps.
  Previously, the mount was missing, which means the task did not support container registries
  with certificates signed by a private/self-signed CA.

v0.4.0

• Hermeto releases from 0.55.0 to 0.57.1 - hermetoproject/hermeto@0.55.0...0.57.1

v0.3.2

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)

v0.3

Fixed

The migration script wasn't attached to the task bundle.

v0.2

Removed

The task show-sbom is deprecated. The migration script deletes it from the pipeline.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 5am on tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh03[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign davidesalerno for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[grzpiotrowski]

/ok-to-test

[openshift-ci]

@red-hat-konflux-kflux-prd-rh03[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gcs278]

/assign @grzpiotrowski