chore(deps): update quay.io/konflux-ci/mobster docker tag to v2

[renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/konflux-ci/mobster	major	1.2.1-1782136886 → 2.1.0-1783939218

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:56 AM UTC · Completed 2:04 AM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

Review — approve

PR: #3462 — chore(deps): update quay.io/konflux-ci/mobster docker tag to v2
Author: renovate[bot]
Scope: 14 Tekton task YAML files — image reference update only

Summary

This is a Renovate-generated PR that bumps the quay.io/konflux-ci/mobster SBOM generation tool from 1.2.1-1782136886 to 2.1.0-1783939218 (major version v1 → v2) across all 14 active task files that reference it with a tagged image. Every change is identical: replacing the old image: reference (tag + digest) with the new one. No scripts, parameters, or task logic are modified.

Analysis

Correctness: All 14 files consistently update the same old image reference to the same new reference. The mobster CLI invocations in these tasks use subcommands (generate, oci-image, oci-index, oci-artifact) and flags that remain unchanged by this PR. Notably, task/package-operator-package-oci-ta and task/package-operator-package in the repo are already running mobster 2.1.0-1783939218, confirming that at least the pko-package subcommand is compatible with v2. The image is pinned by SHA256 digest (sha256:d050c892...), ensuring deterministic builds.

Security: The new image is from the same trusted registry (quay.io/konflux-ci/mobster). Image references remain digest-pinned. No changes to security contexts, RBAC, volume mounts, or credential handling. No new capabilities are added.

Intent & coherence: The change is appropriately scoped — Renovate's mobster group in renovate.json matches quay.io/konflux-ci/mobster across all task files, and all matching files are updated. Archived tasks are correctly excluded.

Style/conventions: The project's tekton.mdc notes that "meaningful dependency updates (e.g., bumping a key tool version)" should have version bumps and changelog updates, but also states "automated image digest bumps do not necessarily require a version bump or changelog entry." This PR straddles both guidelines — it's an automated update but also a major version change. The CI versioning check treats most violations as warnings, and the team has labeled this ready-for-merge, suggesting this pattern is accepted for mobster updates.

Documentation currency: No documentation files are affected. Changelog entries are not updated for the affected tasks. Per the analysis above, this appears to be acceptable for automated dependency updates in this project.

Cross-repo contracts: The SBOM output from mobster feeds into downstream upload-sbom and cosign attach sbom steps. If mobster v2 changes the SBOM format, downstream consumers could be affected. However, the existing v2 usage in package-operator-package* tasks suggests this has been validated.

Findings

#	Severity	Category	File	Description
1	low	completeness	task/ko-oci-ta/0.1/ko-oci-ta.yaml	This task references mobster with a digest-only image reference (quay.io/konflux-ci/mobster@sha256:ae9455b...) — no tag. The Renovate regex pattern requires :tag@digest format to match, so this task is not updated by Renovate and will remain on an older mobster version, creating version skew across the task catalog. Consider adding a tag to the reference so Renovate can manage it consistently.

Previous run

Review — approve

Summary

Automated Renovate PR updating the quay.io/konflux-ci/mobster image from 1.2.1-1782136886 to 2.1.0-1783939218 across 14 Tekton task YAML files. This is a major version bump (v1 → v2).

Analysis

Correctness

• All 14 active (non-archived) task files referencing mobster:1.2.1-1782136886 are consistently updated to the same new image tag and digest. No files are missed.
• Archived tasks under archived-tasks/ are correctly excluded — they use older versions and are not active.
• Two other active tasks (ko-oci-ta and package-operator-package*) reference mobster via separate Renovate groups (ko-builder and package-operator respectively) and are unaffected. The package-operator-package* tasks are already on v2.1.0, confirming that the v2 CLI interface is compatible with patterns used in this repo.
• The scripts invoking mobster are unchanged — only the image reference is updated. The CLI invocations (mobster generate ... oci-image ... and mobster generate ... oci-index ...) remain identical.

Security

• The new image reference includes both the tag and a sha256 digest pin (@sha256:d050c8923949e1cbfc1cc6aecba48e0e88a13b80c2df8de536d8ae71a8ce04ec), ensuring immutability. This is good practice.
• The image is sourced from the same trusted registry (quay.io/konflux-ci/) as before.

Scope & intent

• The change is narrowly scoped: 14 files, each with exactly one line changed (the image reference). No logic, scripts, parameters, or resource limits were modified.
• The PR was created by renovate[bot] and the Renovate configuration in renovate.json correctly groups mobster updates under the mobster group with matchFileNames: ["task/**"].

Major version risk

• The v1 → v2 major version bump typically signals potential breaking changes in the upstream tool. However, the package-operator-package and package-operator-package-oci-ta tasks are already running mobster:2.1.0 (a slightly earlier build), which confirms that mobster v2 is already deployed and functioning in this repository's task ecosystem.

No blocking findings identified. The change is safe to merge.

Previous run (2)

Review

Verdict: Approve

Summary

Automated Renovate dependency update of quay.io/konflux-ci/mobster from 1.2.1-1782136886 (v1) to 2.1.0-1783501746 (v2) across 14 Tekton task YAML files. All changes are identical image tag+digest substitutions with no modifications to task logic, scripts, parameters, or security contexts.

Analysis

Correctness

• All 14 active task/ files referencing mobster:1.2.1 are consistently updated to the same new image reference.
• Image digest pinning (@sha256:c76a484b...) is properly maintained for supply-chain integrity.
• The mobster CLI invocation patterns (mobster generate --output ... oci-image, oci-index, oci-artifact, etc.) are identical to those already running with v2.1.0 in task/package-operator-package/0.1/ and task/package-operator-package-oci-ta/0.1/, which were previously merged to main. This provides strong evidence of v2 CLI compatibility.
• task/ko-oci-ta/0.1/ko-oci-ta.yaml uses a digest-only mobster reference (no tag) managed by the separate ko-builder Renovate group — correctly excluded from this PR.

Security

• No new capabilities, privileges, volume mounts, or security contexts are introduced.
• All references remain digest-pinned, preventing tag-mutability attacks.
• The update is from the same trusted registry (quay.io/konflux-ci/).

Major version bump (v1 → v2)

• This is a major version upgrade, which warrants attention for breaking changes. However, the risk is mitigated by:
  1. Two tasks (package-operator-package*) already use mobster v2.1.0 on main with the same CLI interface.
  2. The PR's changes are purely image reference updates — no script or argument changes were needed, indicating backward-compatible CLI behavior.
  3. The Renovate mobster group in renovate.json is correctly configured to batch these updates.

Scope & intent

• The change is well-scoped to its stated purpose: a dependency version bump.
• No unrelated modifications are included.

Previous run (3)

Review — Approve

Summary

This is a Renovate-managed major version bump of quay.io/konflux-ci/mobster from 1.2.1 to 2.1.0 across 14 Tekton task YAML files. All changes are mechanical — every file replaces the same old image tag+digest with the same new image tag+digest. No script logic, CLI invocations, task parameters, or resource limits are modified.

Analysis

Correctness: All 14 files are updated consistently to quay.io/konflux-ci/mobster:2.1.0-1783413856@sha256:e22d4a5bc74842dde3ababf566cada3ccc561cbe9d75c84215e6c96a805f7b9c. The digest-pinned reference ensures reproducibility and tamper resistance. The tasks invoke mobster via several subcommands (generate oci-image, generate oci-index, generate oci-artifact, generate modelcar) with various CLI flags. No script changes accompany this major version bump, which implies the v2 CLI maintains backward compatibility for these subcommands and flags.

Prior v2 adoption: The package-operator-package and package-operator-package-oci-ta tasks already reference mobster 2.1.0 (an earlier build), confirming that v2 is already in use within this repository.

Coverage: The PR covers all active (non-archived) task files that reference mobster 1.2.1. One archived task (archived-tasks/buildah-min/0.10/buildah-min.yaml) retains the old version, which is expected for archived tasks.

Security: Image references remain digest-pinned (@sha256:...). The image source (quay.io/konflux-ci/) is the same organization's registry. No changes to security contexts, capabilities, volume mounts, or privilege levels.

Style/conventions: The image reference format is consistent with the project's conventions. The Renovate custom manager configuration in renovate.json correctly matches the mobster image pattern.

Documentation: No documentation updates are needed for a dependency image version bump.

Note

This is a major version bump (v1 → v2). While no script changes suggest backward compatibility is maintained, maintainers should verify that CI tests covering SBOM generation pass with this new version before merging — particularly for the oci-image, oci-index, oci-artifact, and modelcar subcommands.

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Review

Findings

Low

• [consumer-completeness] task/ko-oci-ta/0.1/ko-oci-ta.yaml:177 — The file references mobster via a digest-only image reference (quay.io/konflux-ci/mobster@sha256:ae9455b...) with no tag. The Renovate custom regex manager for mobster requires a :tag@digest pattern and will not match this digest-only reference, so Renovate cannot auto-update it. This is a pre-existing issue not introduced by this PR.
  Remediation: Add an explicit tag to the mobster image reference in ko-oci-ta.yaml (e.g., quay.io/konflux-ci/mobster:2.1.0-...@sha256:...) so that Renovate can track it alongside the other consumers.

---

Labels: Renovate bot dependency version bump PR.

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Review

Findings

Low

• [incomplete update] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — This file references mobster via a digest-only reference without a version tag, so Renovate cannot detect and update it. It is also in the 'ko-builder' Renovate group, not the 'mobster' group. This is a pre-existing configuration gap, not a defect introduced by this PR.
  Remediation: Consider reformatting the ko-oci-ta mobster reference to include a version tag so Renovate can manage it.

• [major-version-bump-risk] multiple — This PR performs a major version bump (1.x → 2.1.0). The repository already uses mobster 2.0.0 in the package-operator tasks without apparent issues, and the PR carries the 'ready-for-merge' label suggesting CI has passed.
  Remediation: Verify that mobster 2.x is compatible with all 15 affected tasks by checking CI results.

• [incomplete update] task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml:112 — Uses mobster 2.0.0 rather than 2.1.0; excluded from this PR because the 'package-operator' Renovate group manages it separately.

• [incomplete update] task/package-operator-package/0.1/package-operator-package.yaml:100 — Same as above: uses mobster 2.0.0, managed by a separate Renovate group.

• [scope-completeness] multiple — 18 active task files reference mobster but this PR updates 15. The 3 excluded files are in separate Renovate groups (ko-builder and package-operator), which is architecturally correct.

Info

• [implicit-authorization] renovate.json — No linked issue exists, but authorization is implicit: mechanical value-only change, explicit Renovate configuration for mobster updates, and established Renovate workflow in this repository.

Previous run (11)

Review

Findings

Low

• [version-inconsistency] task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml — The package-operator tasks use mobster:2.0.0-1781706475@sha256:7aa3f4a1... while this PR updates 15 files to mobster:2.0.0-1782112370@sha256:2aa746aa... These are different builds of v2.0.0 (different build timestamps and digests). The package-operator tasks are in a separate Renovate group, explaining the separate update cadence.

• [image-reference-format] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — The mobster image reference uses digest-only format without a version tag, differing from the tag+digest pattern used elsewhere. This pre-existing inconsistency may prevent Renovate from managing this reference (the regex manager requires a colon-separated version tag).

Info

• [automated-dependency-update] This is an automated Renovate dependency update for mobster (SBOM generator), following the project's configured dependency management strategy in renovate.json. The 'requires-manual-review' label correctly gates this major version bump for human validation.

Previous run (12)

Review

Findings

Medium

• [stale reference to old mobster version] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — This file references mobster with a tagless digest pin (quay.io/konflux-ci/mobster@sha256:ae9455b489...). The Renovate custom regex manager for mobster (renovate.json lines 345–351) requires a tag in the pattern :(?<currentValue>[^@]*)@, so this tagless reference will never be matched by Renovate. This file will permanently drift from the rest of the codebase unless manually updated or the image reference format is changed to include a tag.
  Remediation: Add a tag to the image reference (e.g., quay.io/konflux-ci/mobster:2.0.0-1781706475@sha256:...) so the Renovate regex manager can track it, or add a separate custom manager rule for tagless mobster references.

Low

• [scope-authorization] renovate.json — Major version bump (v1.x → v2.0.0) of mobster dependency via Renovate bot. The PR is correctly labeled requires-manual-review, which is the established authorization mechanism for major version bumps. Reviewers should check mobster v2.0.0 release notes for breaking changes to the CLI interface used in task scripts.

• [stale reference to old mobster version] task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml:112 — This file references mobster:1.2.0-1776352559 and is not updated by this PR. The Renovate configuration places task/package-operator-package*/** in the package-operator group, separate from the mobster group. A separate Renovate PR should handle this update.

• [stale reference to old mobster version] task/package-operator-package/0.1/package-operator-package.yaml:100 — Same as above — belongs to the package-operator Renovate group and will receive its own separate PR.

Info

• [major version bump risk] task/buildah/0.10/buildah.yaml:825 — This PR bumps mobster from v1.x to v2.0.0 (semver major). The PR is correctly labeled requires-manual-review.

• [authorization-inference] — The requires-manual-review label is appropriate for a major version dependency bump. The Renovate configuration confirms automated dependency management is adopted for this project.

Previous run (13)

Review

Findings

Medium

• [incomplete update] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — This file references mobster by digest only (quay.io/konflux-ci/mobster@sha256:ae9455b489a96d...) with no version tag. The Renovate custom manager regex (renovate.json line 346) requires a :version@digest format, so this reference cannot be matched or updated by Renovate. The lack of a version tag makes it impossible to track which mobster version is deployed here.
  Remediation: Update the image reference to include a version tag (e.g., quay.io/konflux-ci/mobster:2.0.0-1781706475@sha256:...) so that Renovate can manage it going forward. This is a pre-existing issue outside the scope of this PR but should be tracked.

Low

• [incomplete update] task/package-operator-package/0.1/package-operator-package.yaml:100 — This file references mobster:1.2.0-1776352559 but was not updated by this PR. This is expected: renovate.json places package-operator files in a separate group (lines 269–275), so they will receive their own Renovate PR.

• [incomplete update] task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml:112 — Same as above — this file is in the package-operator Renovate group and will be updated separately.

• [scope-authorization] — Major version update (v1.x → v2.0.0) of mobster submitted by renovate[bot]. The requires-manual-review label confirms this was flagged for human review, which is the intended workflow. Reviewer should check mobster v2.0.0 release notes for breaking changes before approving.

Info

• [scope-coherence] — This is a major version bump (1.x → 2.0.0). Reviewers should verify compatibility with existing mobster CLI invocations in affected task files.

• [architectural-alignment] renovate.json — The mobster Renovate group does not specify automerge behavior (unlike other groups). Manual review is appropriate for major version updates of build infrastructure.

• [scope-consistency] — The PR updates 15 task files consistently to the same mobster v2.0.0 digest. All changes are single-line image reference updates with correct and consistent formatting.

Previous run (14)

Review

Findings

Medium

• [scope-authorization] — No linked issue for major version update (v1.x → v2.0.0). The PR updates mobster across 15 task YAML files. The requires-manual-review label is already applied, which is Renovate's standard mechanism for flagging major version updates for human review. Reviewer should verify mobster v2.0.0 CLI compatibility with existing task scripts before merging.

• [scope-completeness] — The PR updates critical SBOM generation tooling (mobster) to a major version. Before merging, verify: (1) mobster v2.0.0 CLI arguments used in task scripts (e.g., generate, oci-image, --skip-validation, --contextualize, --from-syft, --from-hermeto) remain compatible, (2) SBOM output format is unchanged or acceptably changed.

Low

• [incomplete update] task/package-operator-package/0.1/package-operator-package.yaml — References mobster:1.2.0-1776352559 but was not updated in this PR. The package-operator tasks are in a separate Renovate group and will receive their own update PR.

• [incomplete update] task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml — Same as above: separate Renovate group, will receive its own update PR.

• [image-reference-format-inconsistency] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — Pre-existing: mobster image reference uses digest-only format without a version tag, which prevents Renovate's custom regex manager from tracking it for automatic updates.

Info

• [scope-classification] — The requires-manual-review label is automatically applied by Renovate for major version bumps. This is standard behavior, not a human error.

Previous run (15)

Review

Findings

Medium

• [api-contract] task/buildah/0.10/buildah.yaml:825 — This PR bumps mobster from 1.x to 2.0.0, a semver-major version change. The 15 updated task files invoke mobster via shell scripts that rely on specific CLI arguments (generate, oci-image, oci-index, --skip-validation, --from-syft, --parsed-dockerfile-path, etc.). Major version bumps may include breaking changes to these subcommands, flags, or output format.
  Remediation: Verify mobster v2.0.0 changelog/release notes confirm backward compatibility for the generate oci-image, generate oci-index, and related subcommands and flags used in these scripts. Alternatively, run the integration test suite against the new image to confirm no regressions.

• [scope-authorization] Major version bump from mobster 1.x to 2.0.0 via Renovate bot. While Renovate is explicitly configured to manage mobster updates (renovate.json), the mobster group does not have automerge enabled, meaning this is designed to go through human review. The requires-manual-review label confirms the process is working as intended.
  Remediation: Verify that mobster 2.0.0 is backward compatible with 1.x by reviewing mobster's changelog/release notes for breaking changes and confirming all 15 affected tasks continue to function correctly.

Info

• [incomplete-update] Three active (non-archived) task files still reference older mobster versions and were not included in this PR: task/ko-oci-ta/0.1/ko-oci-ta.yaml (digest-only reference), task/package-operator-package-oci-ta/0.1/package-operator-package-oci-ta.yaml (1.2.0-1776352559), and task/package-operator-package/0.1/package-operator-package.yaml (1.2.0-1776352559). This may be intentional due to different Renovate grouping rules or reference patterns.

Previous run (16)

Review

Findings

Medium

• [API contract violation] task/buildah/0.10/buildah.yaml:825 — This PR bumps mobster from v1.x to v2.0.0 (major version). The tasks invoke mobster with specific CLI subcommands (generate oci-image, generate oci-index, generate oci-artifact, generate modelcar) and numerous flags (--from-syft, --from-hermeto, --contextualize, --arch, --skip-validation, --dockerfile-target, --additional-base-image, etc.). If any of these were renamed, removed, or had their semantics changed in v2, all affected tasks will fail at runtime.
  Remediation: Verify the mobster v2.0.0 release notes or changelog to confirm all used CLI subcommands and flags remain compatible. Alternatively, run the affected tasks in a test environment before merging.

Low

• [missing-authorization] PR-wide — This PR updates mobster from v1.x to v2.0.0 (major version bump) across 15 Tekton task files via Renovate bot without a linked issue. While Renovate is configured to manage these updates, a major version bump warrants reviewing the changelog before merging.
  Remediation: Review mobster v2.0.0 changelog before merging to confirm backward compatibility of used CLI interfaces.

• [consumer completeness] task/package-operator-package/0.1/package-operator-package.yaml:100 — Two task files still reference mobster v1.2.0 and are not included in this PR (package-operator-package and package-operator-package-oci-ta). These files are in a separate Renovate group ('package-operator') and will receive their own PR. The version skew is temporary and by design.

• [consumer completeness] task/ko-oci-ta/0.1/ko-oci-ta.yaml:176 — This file references mobster using a digest-only format with no tag. The Renovate regex pattern requires :currentValue@currentDigest format, so this file will not be automatically updated.
  Remediation: Add a tag to the image reference so Renovate can detect and update it.

Info

• [scope-tier-mismatch] PR-wide — The PR title 'Update mobster to v2' understates the scope of a major version bump affecting 15 task files.

• [architectural-coherence] renovate.json — The Renovate configuration does not distinguish between major/minor/patch updates for mobster. Consider adding a packageRule to require manual approval for major version updates of critical dependencies.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:18 AM UTC · Completed 9:33 AM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:36 AM UTC · Completed 10:42 AM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:43 PM UTC · Completed 12:49 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:02 PM UTC · Completed 7:09 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:29 AM UTC · Completed 10:34 AM UTC
Commit: 14477fe · View workflow run →

[Allda]

A v2 is not compatible with the v1 CLI interface. The renovate bot PR can't be merge without manual update.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:45 AM UTC · Completed 9:50 AM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:33 PM UTC · Completed 12:37 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:02 AM UTC · Completed 10:08 AM UTC
Commit: 14477fe · View workflow run →

[konflux-ci-qe-bot]

**Scenario: **
@renovate[bot]: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name	Status	Rerun command	Build Log	Test Log
build-definitions-pull-request-jf88d	Failed	/retest	View Pipeline Log	View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

1. Install ORAS (see the ORAS installation guide).
2. Download artifacts with the following commands:

mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/konflux-team/build-definitions:be4b25d320235f0bc9a712beb2499c5989f0ba30

Test results analysis

🚨 Error occurred while running the E2E tests, list of failed Spec(s):

➡️ [failed] [It] [build-service-suite Build templates E2E test] HACBS pipelines scenario sample-python-basic-docker triggers PipelineRun for component with source URL https://github.com/konflux-qe-bd/devfile-sample-python-basic-clone and Pipeline docker-build [build, build-templates, HACBS, pipeline-service, pipeline, build-templates-e2e, source-build-e2e]

Click to view logs

Timed out after 1200.003s.
timed out when waiting for the PipelineRun to start for the Component build-templates-e2e/test-comp-mzul
Expected success, but got an error:
    <*errors.errorString | 0xc0009ca140>: 
    no pipelinerun found for component test-comp-mzul
    {
        s: "no pipelinerun found for component test-comp-mzul",
    }

---

OCI Artifact Browser URL

<not enabled>