This PR contains the following updates:

Release Notes

v0.12.0

Changed

• Parameter CONTEXTUALIZE_SBOM is now set to false by default. The SBOM
  contextualization received an overhaul, enabling the support for builder
  content contextualization in SBOMs. To get involved in UAT, set this value
  to true and report issues
  to Mobster maintainers.
• When CONTEXTUALIZE_SBOM is set to true, the built image will contain
  new labels, io.buildah.stage.name and io.buildah.stage.base.

v0.11.2

Fixed

• Per-arch RPM filtering for the prefetch SBOM.
  • With buildah task versions >= 0.10.0, < 0.11.2, the final SBOM would always
    include the x86_64 RPMs (and no other arches) from the prefetch SBOM,
    even for images built on other arches.
  • Now, the SBOM will contain the RPMs for the corresponding arch.

v0.11.1

Changed

• Set a 5 minute I/O timeout for rsync transfers to and from the build VMs.
  The build will fail if the connection goes 5 minutes without transfering
  a single byte of data.

Fixed

• Stopped rsyncing /var/workdir from build VMs back to the cluster.
  This directory contains the git repository and prefetched dependencies,
  which can be a lot of data. The rsync back was an unfortunate side effect
  of how tooling generates the remote-oci-ta task variant from the base task,
  and was completely unnecessary.

v0.11.0

Changed

• When scanning the built image with Syft, scans the image filesystem as
  a directory instead of scanning the the image as an OCI archive. This improves
  the scanning time, disk usage and may improve memory usage. More details in
  konflux-build-cli/docs/design/syft-image-scanning.md.
• The remote variants of this task now push the built image to the registry directly
  from the build VM instead of rsyncing the image back to the cluster first.
  For large images, this significantly reduces the time spent on network transfers.

Removed

• BREAKING: Removed the sbom-syft-generate step, SBOM generation now happens
  in the build step.
• BREAKING: Removed the push step, the push now happens in the build step.
• If you have step overrides configured for either of the two removed steps,
  the pipeline will fail with invalid StepOverride. See the migration guidance below.

Migration guidance

Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:

1. Your PipelineRun references an external Pipeline. In this case, the migration
   script will never get a chance to run on the PipelineRun.
2. Your PipelineRun is multi-platform, SBOM generation needs more resources
   than the build itself and the remote VMs do not have sufficient resources.

If the migration script doesn't solve the problem, please follow the procedure below.

Manual procedure

If you have sbom-syft-generate or push step overrides in the .spec.taskRunSpecs
section in your PipelineRun, please remove them. In most cases, this should be all.

However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.

For example:

 spec:
   taskRunSpecs:
     - pipelineTaskName: build-container
       stepSpecs:
-        - name: sbom-syft-generate
+        - name: build
           computeResources:
             requests:
               memory: 16Gi
             limits:
               memory: 16Gi

This will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.

For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).

For example:

 spec:
   params:
     - name: build-platforms
       value:
         - localhost
-        - linux/arm64
+        - linux-mxlarge/arm64

v0.4.1

Changed

Allign script and task version.

v0.4

Changed

0.4 is a dummy version used to facilitate the migration from clair-scan 0.3 to roxctl-scan 0.1

v0.3.2

Added

• Skip extracting OCI layers that contain only unscannable model-weight files
  (.safetensors, .gguf, .ggml). Other layers are still extracted and
  scanned. If layer listing fails, the task falls back to extracting the
  full image.

v0.10.1

Changed

• When input is empty, only run the skip-ta step and skip other steps
• Use quay.io/konflux-ci/task-runner for the skip-ta step instead of ubi-minimal

v0.10.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.61.0

v0.9.0

Added

• Added optional pip-index-url parameter to pass PIP_INDEX_URL to Hermeto for pip dependency prefetch.
  When set, this URL is used as a fallback package index when requirements.txt does not specify --index-url.
  To use this parameter, add pip-index-url (type: string, default: "") to your pipeline params
  and pass it to the prefetch-dependencies task.

v0.8.0

• Add Bundler and Cargo package registry proxy support - konflux-ci/konflux-build-cli#229

v0.7.1

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.1
• Fixes GHSA-rfhj-wcpf-9jcx
• Fixes GHSA-rpww-j58f-22xr
• Fixes GHSA-pxcg-wp85-mcrg
• Fixes GHSA-wx26-fvpq-v9rp

v0.7.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.60.0
• The .repo file for RPM dependencies is now named hermeto.repo instead of cachi2.repo

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 02:00 AM and 08:59 AM, only on Sunday (* 2-8 * * 0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

• If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.