chore(deps): update konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	minor	0.3.1 → 0.4
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.12.1 → 0.12.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.3 → 0.3.4
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	c6c414a → 7854d7b
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	3e59d63 → 4c567d1
quay.io/konflux-ci/tekton-catalog/task-roxctl-scan (source, changelog)	tekton-bundle	digest	97e2b2c → 4d48db2
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	digest	d9df5d3 → 4b1856e
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.2

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.4

Added

• IMAGE_PLATFORM_MAP parameter: optional per-image platform mapping
  (imageRef=os/arch entries) passed to konflux-build-cli as
  --image-platform-map. This sets the platform on each index entry explicitly,
  which is required for OCI artifacts whose empty config carries no platform
  information (e.g. disk images), where the platform would otherwise be null.
  When empty (the default), behaviour is unchanged.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.12.2

Changed

• Version 0.12.2 only has relevant changes for the remote variants of this task.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.4

Added

• Pre-extract every nested archive into a loose file tree before scanning, so
  clamd scans each file directly instead of recursing through nested archive
  layers. This makes scanning of deeply nested archives faster. Extraction uses
  bsdtar, which detects archives (zip/jar/war/ear/tar
  and tar.gz/tar.bz2/tar.xz) by content rather than extension — important because
  the OCI dir: payload is an extension-less blob — and unpacks them
  unconditionally with no size/count/depth limits. It is defensive: a corrupt or
  partial archive is left in place for clamd rather than aborting the scan. No new
  parameters are introduced. Requires the clamav-db image to ship bsdtar
  (added in konflux-clamav).

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

v0.3.2

Fixed

• Cargo prefetched dependencies are now included in the source image. They are
  vendored as unpacked source trees rather than archives, so previously they
  were missed by the archive-type filter and left out of the source image.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[sourcery-ai]

Reviewer's Guide

This dependency-maintenance PR updates eight pinned Konflux Tekton bundles by replacing their OCI digests and, where applicable, version tags in four parallel operator and operator-bundle pipeline definitions. The notable upstream behavior changes are explicit platform mapping for image indexes, nested archive pre-extraction during ClamAV scans, and inclusion of Cargo-prefetched dependencies in source images; reviewers should verify the synchronized references and exercise affected pipeline paths.

File-Level Changes

Change	Details	Files
Refresh pinned Tekton bundle references across all 3.y.z pull-request and push pipelines.	Update eight Konflux task bundle digests, including the build-image-index, buildah-oci-ta, ClamAV, source-build, and scan tasks. Adopt the corresponding version tags for the semver-updated bundles while retaining existing tags for digest-only refreshes. Apply identical reference changes to operator and operator-bundle PR/push pipeline definitions.	.tekton/operator-3-y-z-pull-request.yaml .tekton/operator-3-y-z-push.yaml .tekton/operator-bundle-3-y-z-pull-request.yaml .tekton/operator-bundle-3-y-z-push.yaml
Bring pipeline behavior in line with upstream Konflux task releases.	Review build-image-index 0.4's optional IMAGE_PLATFORM_MAP support for OCI artifacts lacking platform metadata. Account for ClamAV 0.3.4's bsdtar-based nested archive extraction and its dependency on a clamav-db image containing bsdtar. Verify source-build-oci-ta 0.3.2 includes Cargo-prefetched dependencies in source images. Confirm the buildah-oci-ta patch release only affects remote task variants; the remaining digest-only updates have no documented release-note behavior changes.	.tekton/operator-3-y-z-pull-request.yaml .tekton/operator-3-y-z-push.yaml .tekton/operator-bundle-3-y-z-pull-request.yaml .tekton/operator-bundle-3-y-z-push.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. These digest and version changes replace the implementations used for image building, publishing, signing, and malware/security scans in the Tekton pipelines. If an updated task is wrong, a run could produce or publish an incorrect artifact or apply an incomplete scan; reverting restores the prior tasks, but artifacts already produced or published would need to be replaced or cleaned up.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook