Update Konflux references (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	4765f20 → f89a59d
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	354696b → 714a86d
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	tekton-bundle	minor	0.11.2 → 0.12.0
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	e438f31 → 4619769
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	0ea91d9 → 437e4a2
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	0e30ff3 → 4dbbfed
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	minor	0.7.1 → 0.9.0
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	4dfb620 → ee041e2
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	f53e60d → cc51335
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	digest	1f64ec6 → c7ecd1e

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.12.0

Changed

• Parameter CONTEXTUALIZE_SBOM is now set to false by default. The SBOM
  contextualization received an overhaul, enabling the support for builder
  content contextualization in SBOMs. To get involved in UAT, set this value
  to true and report issues
  to Mobster maintainers.
• When CONTEXTUALIZE_SBOM is set to true, the built image will contain
  new labels, io.buildah.stage.name and io.buildah.stage.base.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.9.0

Added

• Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
  When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
  To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
  and pass it to the prefetch-dependencies task.

v0.8.0

• Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:44 AM UTC · Completed 5:51 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Looks good to me

---

Labels: PR modifies .tekton/ CI pipeline definitions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.38% <ø> (ø)
generative	12.28% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.20% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:29 PM UTC · Completed 9:39 PM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3497 — Update Konflux references (main)

Workflow went well. This was a mechanical Renovate/Konflux bot PR updating Tekton CI pipeline image digests across 2 .tekton/ files (20 additions, 20 deletions). The review agent correctly classified the change as mechanical/value-only, dispatched minimal sub-agents (correctness + style-conventions), found no issues, and approved in ~7 minutes. Human reviewer (simonbaird) approved without comments 3 days later and merged. Zero rework iterations.

Known issues observed (already tracked)

• Model resolution error (evidence for Review sub-agents should fall back to an available model when the primary model is unavailable fullsend-ai/fullsend#1771, Format PipelineRun files and upload SAST results #1795): The style-conventions sub-agent failed because the sonnet model alias resolved to the stale claude-sonnet-4-5@20250929 (unavailable) instead of the intended claude-sonnet-4-6@default. Impact was negligible — the sub-agent's early-exit criteria would have applied for this mechanical change regardless. This is the same failure pattern described in chore(deps): update konflux references (main) #1771 (model fallback) and Format PipelineRun files and upload SAST results #1795 (qualifying verdicts when sub-agents fail). The stale alias mapping continues to occur as of 2026-08-15.

• Bot PR processing overhead (18+ existing issues): This retro and the review agent both consumed tokens analyzing a trivial bot PR. Issues #5360, #5295, #5067, #4989, #4975, #4825, #4293, #4177, #4154, #4006, #3951, #3833, Refactor: migrate from deprecated in-toto-golang types to in-toto/attestation module #3347, Refresh RPM lockfiles (main) [SECURITY] #3317, Dep bump v0.7 #3221 (and others) in fullsend-ai/fullsend already propose skipping or fast-pathing agent dispatch for bot-authored dependency update PRs.

• Reduced sub-agent dispatch for mechanical changes (pr-review skill: reduce sub-agent dispatch for mechanical/value-only changes like dependency bumps fullsend-ai/fullsend#4060): The style-conventions sub-agent was dispatched despite early-exit criteria that would have skipped analysis. Issue #4060 already proposes reducing sub-agent dispatch for mechanical/value-only changes.

No new proposals

All improvement opportunities identified are already covered by existing open issues. The workflow executed correctly for this change class.