chore: bump konflux refs to unblock ecp

[gdbranco]

Description

Ref: KFLUXSPRT-8736

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD or tooling change

Testing

• Unit tests pass (make test)
• Integration tests pass (if applicable)
• Manual verification completed

Checklist

• My code follows the project's coding conventions
• I have updated documentation as needed
• I have added tests that prove my fix/feature works
• All new and existing tests pass

Summary by CodeRabbit

• Chores
  • Updated pinned build and validation task references used by automated pipelines.
  • Preserved existing task versions, parameters, ordering, and execution conditions.
  • Maintained consistent pipeline behavior across pull request and push workflows.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fad2c376-e4a5-48fb-b395-205db32f5f4b

📥 Commits

Reviewing files that changed from the base of the PR and between 7d0666b and 4ce01a4.

📒 Files selected for processing (4)

• .tekton/rosa-hyperfleet-api-pull-request.yaml
• .tekton/rosa-hyperfleet-api-push.yaml
• .tekton/rosa-hyperfleet-operator-pull-request.yaml
• .tekton/rosa-hyperfleet-operator-push.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d437df3b-070e-456b-a184-9e4cc34bd4e2

📥 Commits

Reviewing files that changed from the base of the PR and between c882180 and 7d0666b.

📒 Files selected for processing (4)

• .tekton/rosa-hyperfleet-api-pull-request.yaml
• .tekton/rosa-hyperfleet-api-push.yaml
• .tekton/rosa-hyperfleet-operator-pull-request.yaml
• .tekton/rosa-hyperfleet-operator-push.yaml

---

Walkthrough

The pull-request and push Tekton pipeline definitions for the API and operator now use updated pinned task bundle digests. Task names, versions, parameters, ordering, and conditions remain unchanged.

Changes

Tekton pipeline digest refresh

Layer / File(s)	Summary
Initialization and image build tasks .tekton/rosa-hyperfleet-*-pull-request.yaml, .tekton/rosa-hyperfleet-*-push.yaml	Updated digests for initialization, cloning, dependency prefetching, image building, image indexing, and source-image creation tasks.
Pipeline validation tasks .tekton/rosa-hyperfleet-*-pull-request.yaml, .tekton/rosa-hyperfleet-*-push.yaml	Updated digests for certification preflight and Snyk, shell, and Unicode checks.
Tagging and publishing tasks .tekton/rosa-hyperfleet-*-pull-request.yaml, .tekton/rosa-hyperfleet-*-push.yaml	Updated digests for tagging, Dockerfile publishing, and RPM signature scanning tasks.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to 7d066

This CI/CD reference update has no identified merge-blocking risk and is merge-ready after normal checks and review.

Possibly related issues

• openshift-online/rosa-trusted-actions#14 — Both changes update pinned Tekton task bundle dependencies in pipeline YAML files.

Suggested reviewers: cdoan1, mitalibhalla

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the Konflux reference updates and their purpose of unblocking ECP.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	The diff only replaces 52 OCI bundle references with 64-hex SHA256 digests; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or crypto comparison code changed.
Container-Privileges	✅ Passed	The PR changes only Tekton bundle digests. No listed privilege fields changed, and old/new bundle payload scans show no newly introduced privileged, host, SYS_ADMIN, or escalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR diff contains only 52 replacements of pinned quay.io Tekton bundle SHA256 digests; no logging statements or sensitive values were added.
No-Hardcoded-Secrets	✅ Passed	HEAD^..HEAD changes only 52 OCI bundle digest lines; all new values match @sha256:<64 hex>, with no credential assignments or embedded-credential URLs.
No-Injection-Vectors	✅ Passed	The PR changes only immutable @sha256 bundle values in four Tekton YAML files; no listed injection vector appears in the changed lines or files.
Ai-Attribution	✅ Passed	The authored PR description and exact PR commit do not mention AI tools; the current commit has no attribution trailer or Co-Authored-By line.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[gdbranco]

/ok-to-test

[cdoan1]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cdoan1, gdbranco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cdoan1]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cdoan1]

/honk

[openshift-ci]

@cdoan1:

Details

In response to this:

/honk

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.