Update Konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	3ab8441 → 6387614
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	62de839 → daa9a28
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	421003a → 0680117
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	0.4.1 → 0.5.0	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	5a6cbeb → e19d134
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	9ad20a0 → 2e79e47
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	7c5575a → 2dd5b3e

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[sourcery-ai]

Reviewer's Guide

Updates Tekton pipeline task bundle references in operator-related .tekton YAMLs to newer Konflux images and digests, including a version bump for the prefetch-dependencies-oci-ta task.

Flow diagram for updated Tekton task bundles in operator pipelines

flowchart LR
    subgraph OperatorPipelines
      subgraph Operator3YZ
        OP_PR["operator-3-y-z-pull-request"]
        OP_PUSH["operator-3-y-z-push"]
      end
      subgraph OperatorBundle3YZ
        OB_PR["operator-bundle-3-y-z-pull-request"]
        OB_PUSH["operator-bundle-3-y-z-push"]
      end
    end

    subgraph KonfluxCatalog["quay.io/konflux-ci/tekton-catalog"]
      T_init["task-init:0.4.2@sha256:0680..."]
      T_prefetch["task-prefetch-dependencies-oci-ta:0.5.0@sha256:735f..."]
      T_buildah["task-buildah-oci-ta:0.10@sha256:daa9..."]
      T_source_build["task-source-build-oci-ta:0.3@sha256:2dd5..."]
      T_apply_tags["task-apply-tags:0.3@sha256:6387..."]
      T_push_dockerfile["task-push-dockerfile-oci-ta:0.3.1@sha256:e19d..."]
      T_rpms_scan["task-rpms-signature-scan:0.2@sha256:2e79..."]
    end

    OP_PR --> T_init
    OP_PR --> T_prefetch
    OP_PR --> T_buildah
    OP_PR --> T_source_build
    OP_PR --> T_apply_tags
    OP_PR --> T_push_dockerfile
    OP_PR --> T_rpms_scan

    OP_PUSH --> T_init
    OP_PUSH --> T_prefetch
    OP_PUSH --> T_buildah
    OP_PUSH --> T_source_build
    OP_PUSH --> T_apply_tags
    OP_PUSH --> T_push_dockerfile
    OP_PUSH --> T_rpms_scan

    OB_PR --> T_init
    OB_PR --> T_buildah
    OB_PR --> T_source_build
    OB_PR --> T_apply_tags
    OB_PR --> T_rpms_scan

    OB_PUSH --> T_init
    OB_PUSH --> T_buildah
    OB_PUSH --> T_source_build
    OB_PUSH --> T_apply_tags
    OB_PUSH --> T_rpms_scan

Loading

File-Level Changes

Change	Details	Files
Refresh Konflux Tekton task bundle references used by operator pipelines to point at newer images and SHA256 digests, including the prefetch-dependencies-oci-ta 0.5.0 migration release.	Update task-init bundle digest while keeping version 0.4.2 constant across pull-request and push pipelines. Update task-prefetch-dependencies-oci-ta bundle from version 0.4.1 to 0.5.0, aligning digests in pull-request and push pipelines with the Hermeto 0.58.0 release. Update task-buildah-oci-ta bundle digest at version 0.10 across operator and operator-bundle pipelines. Update task-source-build-oci-ta bundle digest at version 0.3 across all operator pipeline variants. Update task-apply-tags bundle digest at version 0.3 in pull and push pipelines. Update task-push-dockerfile-oci-ta bundle digest at version 0.3.1 in pull and push pipelines. Update task-rpms-signature-scan bundle digest at version 0.2 in all operator pipeline YAMLs.	.tekton/operator-3-y-z-pull-request.yaml .tekton/operator-3-y-z-push.yaml .tekton/operator-bundle-3-y-z-pull-request.yaml .tekton/operator-bundle-3-y-z-push.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Since prefetch-dependencies-oci-ta was bumped from 0.4.1 to 0.5.0 and has a migration guide, double-check that any new/changed params or workspaces required by 0.5.0 are accounted for in the pipeline specs using this task.
• The same task bundle references (including digests) are duplicated across multiple .tekton/*-pull-request.yaml and *-push.yaml files; consider centralizing these values (e.g., via a shared template or overlay) to reduce the chance of them drifting out of sync in future updates.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Since `prefetch-dependencies-oci-ta` was bumped from 0.4.1 to 0.5.0 and has a migration guide, double-check that any new/changed params or workspaces required by 0.5.0 are accounted for in the pipeline specs using this task.
- The same task bundle references (including digests) are duplicated across multiple `.tekton/*-pull-request.yaml` and `*-push.yaml` files; consider centralizing these values (e.g., via a shared template or overlay) to reduce the chance of them drifting out of sync in future updates.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}