Update Konflux references

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	3ab8441 → 6387614
quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta (source, changelog)	dcc40cc → 1de9b1c
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	62de839 → daa9a28
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	9ad20a0 → 2e79e47
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	7c5575a → 2dd5b3e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Tekton PipelineRuns now reference newer pinned OCI task bundle digests. The updates cover Helm chart building, container and source image builds, tag application, and RPM signature scanning across chart-push, push, and tag pipelines. Task names, resolvers, conditions, parameters, and pipeline wiring remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ciaranroche

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	Only Tekton YAML bundle digests changed; no slog/logr/zap/fmt.Print statements or secret/token/password/credential log fields in touched files. CWE-532 absent.
No Hardcoded Secrets	✅ Passed	Only Tekton OCI bundle digests changed; no apiKey/secret/token/password literals, embedded creds, or secret-like base64 strings found (CWE-798).
No Weak Cryptography	✅ Passed	Only Tekton bundle digest bumps changed; no md5/des/rc4/sha1-crypto, ECB, custom crypto, or secret-compare code found. CWE-327 not implicated.
No Injection Vectors	✅ Passed	Only Tekton bundle digest pins changed in YAML; no SQL/exec/template/yaml.Unmarshal sinks in changed files (CWE-89/78/79/502).
No Privileged Containers	✅ Passed	Only Tekton bundle digests changed; no privileged:true, host* flags, SYS_ADMIN, or explicit root settings appear in the patched manifests (CWE-250/CWE-269).
No Pii Or Sensitive Data In Logs	✅ Passed	Only Tekton bundle digests changed; no logging statements or PII-sensitive output paths were added. No CWE-532/200 exposure.
Title check	✅ Passed	The title matches the change set: Konflux Tekton task references were updated.
Description check	✅ Passed	The description directly lists the Konflux task digest updates made in the PR.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.tekton/hyperfleet-api-chart-push.yaml (1)

173-173: 🔒 Security & Privacy | 🔵 Trivial

Treat these Tekton bundles as supply-chain inputs (CWE-829). Digest pins stop tag drift, but they do not cover provenance, signatures, or task-contract compatibility. Keep those checks on every bundle refresh.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/hyperfleet-api-chart-push.yaml at line 173, For the Tekton bundle
references at .tekton/hyperfleet-api-chart-push.yaml:173,
.tekton/hyperfleet-api-push.yaml:234, 277, 469, and 509, and
.tekton/hyperfleet-api-tag.yaml:264, 307, 499, and 539, retain digest pinning
and document or enforce verification of each bundle’s provenance and signature
plus task-contract compatibility whenever references are refreshed. Apply the
same supply-chain checks consistently at every listed site.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.tekton/hyperfleet-api-chart-push.yaml:
- Line 173: For the Tekton bundle references at
.tekton/hyperfleet-api-chart-push.yaml:173,
.tekton/hyperfleet-api-push.yaml:234, 277, 469, and 509, and
.tekton/hyperfleet-api-tag.yaml:264, 307, 499, and 539, retain digest pinning
and document or enforce verification of each bundle’s provenance and signature
plus task-contract compatibility whenever references are refreshed. Apply the
same supply-chain checks consistently at every listed site.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f8fe9d07-f2c0-41f4-a24a-b4e5a49bce94

📥 Commits

Reviewing files that changed from the base of the PR and between 5aefe87 and e736813.

📒 Files selected for processing (3)

• .tekton/hyperfleet-api-chart-push.yaml
• .tekton/hyperfleet-api-push.yaml
• .tekton/hyperfleet-api-tag.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual) → reviewed against open PR #230 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-adapter (manual) → reviewed against open PR #256 konflux/references/main instead of the default branch
• openshift-hyperfleet/hyperfleet-broker (manual)

[hyperfleet-ci-bot]

Risk Score: 0 — risk/low

Signal	Detail	Points
PR size	18 lines	+0
Sensitive paths	none	+0

_{Computed by hyperfleet-risk-scorer}

[rafabene]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rafabene

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rafabene]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rafabene]

/ok-to-test