Update Konflux references - #35
Open
red-hat-konflux-kflux-prd-rh03[bot] wants to merge 1 commit into
Open
Conversation
Reviewer's GuideUpdates Konflux Tekton task bundle references in the pull-request and push pipelines and wires new reproducible-image parameters through to the build task. Flow diagram for new reproducible-image parameters in Konflux Tekton pipelinesflowchart TD
PipelineParams[[dfd-pull-request / dfd-push Pipeline params]]
SourceDateEpoch[source-date-epoch]
RewriteTimestamp[rewrite-timestamp]
OmitHistory[omit-history]
BuildTask[[buildah-oci-ta task]]
EnvVars[[Task env vars
SOURCE_DATE_EPOCH
REWRITE_TIMESTAMP
OMIT_HISTORY]]
Image[Built container image]
PipelineParams --> SourceDateEpoch
PipelineParams --> RewriteTimestamp
PipelineParams --> OmitHistory
SourceDateEpoch --> BuildTask
RewriteTimestamp --> BuildTask
OmitHistory --> BuildTask
BuildTask --> EnvVars
EnvVars --> Image
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- For the new
rewrite-timestampandomit-historyparameters, consider using Tektonbooleanparameter types instead of strings to avoid potential misconfiguration (e.g., "True" vs "true"). - Double-check that the new image reproducibility parameters (
source-date-epoch,rewrite-timestamp,omit-history) are wired through wherever these pipelines are triggered (e.g., default values or CI config), so builds don’t unexpectedly change behavior when the defaults are overridden.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- For the new `rewrite-timestamp` and `omit-history` parameters, consider using Tekton `boolean` parameter types instead of strings to avoid potential misconfiguration (e.g., "True" vs "true").
- Double-check that the new image reproducibility parameters (`source-date-epoch`, `rewrite-timestamp`, `omit-history`) are wired through wherever these pipelines are triggered (e.g., default values or CI config), so builds don’t unexpectedly change behavior when the defaults are overridden.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Signed-off-by: red-hat-konflux-kflux-prd-rh03 <206760901+red-hat-konflux-kflux-prd-rh03[bot]@users.noreply.github.com>
red-hat-konflux-kflux-prd-rh03
Bot
force-pushed
the
konflux/references/main
branch
from
August 8, 2026 08:03
20692d3 to
1d8cff2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3ab8441→da0cff20.3→0.3.10.10→0.11.00.3→0.3.20.3→0.3.1e78d0d3→0ccc6882e5ebe0→e438f310.2→0.2.50.4→0.4.30.3→0.7.10.3→0.3.10.2→0.2.1f6a115e→d33d800918327b→f4818f84961c44→f31055c7c5575a→93f1df1Release Notes
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)
v0.3.1Fixed
SBOM_SKIP_VALIDATIONinto the step environment so the create-sbom step honors the parameter.The parameter did nothing before. Now it works as expected.
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)
v0.11.0Changed
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.
Removed
sbom-syft-generatestep, SBOM generation now happensin the
buildstep.pushstep, the push now happens in thebuildstep.the pipeline will fail with
invalid StepOverride. See the migration guidance below.Migration guidance
Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:
script will never get a chance to run on the PipelineRun.
than the build itself and the remote VMs do not have sufficient resources.
If the migration script doesn't solve the problem, please follow the procedure below.
Manual procedure
If you have
sbom-syft-generateorpushstep overrides in the.spec.taskRunSpecssection in your PipelineRun, please remove them. In most cases, this should be all.
However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.
For example:
spec: taskRunSpecs: - pipelineTaskName: build-container stepSpecs: - - name: sbom-syft-generate + - name: build computeResources: requests: memory: 16Gi limits: memory: 16GiThis will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.
For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).
For example:
spec: params: - name: build-platforms value: - localhost - - linux/arm64 + - linux-mxlarge/arm64v0.10.7Fixed
ignore files, same as buildah itself.
.containerignoreand.dockerignorefilesin the root of the context directory, but not the
<containerfile>.containerignoreand
<containerfile>.dockerignorefiles.v0.10.6Fixed
versions 0.10.4 and 0.10.5, when the upload-sbom step upgraded cosign to v3.
service URLs directly as CLI flags. The konflux-ci/konflux-ci deployment
of Konflux doesn't provide the config file in the TUF mirror. Fixed
by setting
--use-signing-config=falseto still allow direct URLs.Changed
Previously, if keyless signing was enabled, the task would sign the image
in the push step and then the SBOM in upload-sbom step. Now, it will sign both
in the upload-sbom step. This has no practical impact, but enables a larger
rework of the push step in the future.
v0.10.5Added
--rhsm-mount-ca-certsoption.konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.3.2Changed
quay.io/konflux-ci/oras:latestimage withquay.io/konflux-ci/task-runner:1.5.0in the oci-attach-report step.Added
v0.3.1Added
konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.7.1v0.7.0.repofile for RPM dependencies is now namedhermeto.repoinstead ofcachi2.repov0.6.0v0.5.0v0.4.1Fixed
trusted-cavolume in theuse-trusted-artifactandcreate-trusted-artifactsteps.Previously, the mount was missing, which means the task did not support container registries
with certificates signed by a private/self-signed CA.
v0.4.0v0.3.2enable-package-registry-proxyparameter to enable use of the package registry proxy when prefetching dependencies.SERVICE_CA_TRUST_CONFIG_MAP_NAMEandSERVICE_CA_TRUST_CONFIG_MAP_KEYparameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.Configuration
📅 Schedule: (UTC)
* 5-23 * * 6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.