chore(deps): update konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	digest	c2cda69 → 6ead03c
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	tekton-bundle	patch	0.12.0 → 0.12.1
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	patch	0.4.0 → 0.4.1
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3.1 → 0.3.3
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	4619769 → fa53ef4
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	tekton-bundle	digest	3bcd4c3 → 1d7ba56
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	digest	5f68715 → c6c414a
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	tekton-bundle	patch	0.10.1 → 0.10.3
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	tekton-bundle	digest	393b4d0 → 3e59d63
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2.1 → 0.2.2
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	tekton-bundle	digest	beb05ae → d9b0153
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	tekton-bundle	digest	b78e9c0 → a973b32
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	tekton-bundle	digest	d09f717 → 3817504
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1

---

Release Notes

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3.1

Changed

• Nothing. Started using semver specification for version labels.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.12.1

Changed

• Bump prepare-sboms step memory from 256Mi to 512Mi (requests = limits) to prevent OOM kills on large container images (GPU/ML, bootc, driver-toolkit).
• Remove prepare-sboms CPU limit (was 100m) to allow burst CPU and prevent throttling. CPU requests remain at 100m.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.4.1

Changed

Allign script and task version.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)

v0.3.3

Changed

• Skip downloading OCI layers whose manifest annotations name only unscannable
  model-weight files (.safetensors, .gguf, .ggml, .pt, .pth, .onnx,
  .onnx_data / .onnx_data_*), using org.opencontainers.image.title and
  olot.layer.content.inlayerpath. Any other annotated layer is skipped when
  the OCI descriptor size is at least 2000MiB (slightly under ClamAV's ~2GiB
  MaxFileSize), regardless of extension. Layers without those annotations are
  still listed with --dry-run as in 0.3.2. The --dry-run skip uses the
  same name list.

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)

v0.10.3

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.62.0

v0.10.2

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.1

konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)

v0.3.1

Changed

• Nothing. Started using semver specification for version labels.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d457492c-ef82-4d9c-bcaa-087b8adb7ff4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 6.78%. Comparing base (8d830ae) to head (68d0ba1).
⚠️ Report is 35 commits behind head on release-2.10.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-2.10   #2967    +/-   ##
=============================================
  Coverage          6.78%   6.78%            
=============================================
  Files              1014    1014            
  Lines             19586   19586            
  Branches           4073    4087    +14     
=============================================
  Hits               1328    1328            
+ Misses            18251   17483   -768     
- Partials              7     775   +768     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.