chore(deps): update quay.io/konflux-ci/task-runner docker tag to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/task-runner	tekton-step-image	major	1.5.0 → 2.1.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/task-runner (quay.io/konflux-ci/task-runner)

v2.1.0

Compare Source

Date: 2026-07-08

Installed Software

• git-lfs added (3.7.1-5.el10_2.5)
• cosign 3.0.5 => 3.1.1
• huggingface-hub 1.17.0 => 1.22.0
• oc 4.21.0 => 4.22.0
• syft 1.44.0 => 1.46.0
• awscli 1.45.18 => 1.45.40
• coreutils-single 9.5-7.el10 => 9.5-8.el10_2
• kubectl 1.36.1 => 1.36.2
• olot 0.1.17 => 0.1.18
• openssl 3.5.5-3.el10_2 => 3.5.5-4.el10_2
• rsync 3.4.1-6.el10_2 => 3.4.4-1.el10_2
• skopeo 1.22.2-1.el10_2 => 1.22.2-2.el10_2
• tkn 0.44.1 => 0.44.2
• yq 4.53.2 => 4.53.3

Added

• Added git-lfs to support cloning LFS-enabled repositories in the
  git-clone task and its derived production variants.

v2.0.0

Compare Source

Date: 2026-06-16

Major version upgrade of cosign

Installed Software

• cosign 2.6.3 => 3.0.5

v1.8.1

Compare Source

Date: 2026-06-05

Re-release of 1.8.0 with no changes. The 1.8.0 release did not trigger CI pipelines.

v1.7.0

Compare Source

Date: 2026-05-14

Installed Software

• openssh-clients added (9.9p1-14.el10_1)
• rsync added (3.4.1-2.el10_1.2)
• subscription-manager added (1.30.10.1-1.el10_1)
• awscli 1.44.49 => 1.45.2
• conftest 0.66.0 => 0.68.2
• crun 1.23.1-1.el10_0 => 1.27-1.el10_1
• huggingface-hub 1.7.1 => 1.13.0
• syft 1.42.1 => 1.44.0
• yq 4.52.2 => 4.53.2
• buildah 1.43.0 => 1.43.1
• cosign 2.6.2 => 2.6.3
• jq 1.7.1-11.el10 => 1.7.1-11.el10_1.0.2
• olot 0.1.16 => 0.1.17
• python3 3.12.12-3.el10_1.1 => 3.12.12-3.el10_1.3
• tkn 0.44.0 => 0.44.1

Added

• rsync, ssh and subscription-manager
• The container image now has a floating v1 tag pointing to the latest 1.x release:
  quay.io/konflux-ci/task-runner:v1

Fixed

• The version label in the container image is now correct
  (previously, this label was inherited from the UBI base image)

v1.6.0

Compare Source

Date: 2026-03-24

• huggingface-hub added (1.7.1)
• olot added (0.1.16)
• python3 3.12.12-3.el10_1 => 3.12.12-3.el10_1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 4:33 PM UTC · Completed 4:41 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Review — Approve

This Renovate PR bumps quay.io/konflux-ci/task-runner from 1.5.0 to 2.1.0 across the two maven-zip task definitions (build-maven-zip and build-maven-zip-oci-ta). The major version increment is driven by the cosign upgrade from 2.6.3 → 3.1.1 inside the task-runner image.

Verification

• cosign compatibility: Both tasks invoke cosign attach sbom. Multiple other tasks in this repo (e.g. buildah-oci-ta/0.10, buildah/0.10, build-image-index/0.2, buildah-remote/0.10, buildah-remote-oci-ta/0.10, buildah-oci-ta-min/0.10) already use task-runner:2.0.0 with cosign attach sbom — confirming the CLI surface used here is compatible with cosign 3.x.
• Digest pins: All six image references are consistently updated to the same tag (2.1.0) and digest (sha256:c34c933c269e2401bb042fe69e2999cf288331b6586d4f4eca9c845270d9b1f9), ensuring reproducible builds and supply-chain integrity.
• Scope: The PR is correctly scoped to the maven Renovate group defined in renovate.json, which covers exactly task/build-maven-zip/** and task/build-maven-zip-oci-ta/**. Other files still referencing task-runner:1.5.0 (stepactions, tkn-bundle) belong to separate Renovate groups and are intentionally not updated here.
• Task API: No parameters, results, or steps are added or removed — this is purely an image version bump, so no new task version is required per project conventions.
• Scripts unchanged: The bash scripts in the prepare, build, and upload-sbom steps are not modified. They already follow project conventions (set -euo pipefail, shebang, env-variable usage for params).

No correctness, security, or breaking-change concerns identified. The change is safe to merge.

---

Labels: Automated dependency update via Renovate for task-runner image

Previous run

Review

Findings

Medium

• [API contract violation] task/build-maven-zip/0.1/build-maven-zip.yaml:220 — The upload-sbom step invokes cosign attach sbom, which was deprecated in cosign v2.x. This PR bumps task-runner to 2.0.0, which ships cosign 3.0.5. While cosign attach sbom was not removed in cosign 3.0.0 (only cosign attach signature and cosign attach attestation were removed), it remains deprecated and may be removed in a future cosign release. The same pattern exists in build-maven-zip-oci-ta.yaml:255 and across ~55 other task files in this repository.
  Remediation: Consider planning a migration from cosign attach sbom to the recommended replacement (oras attach or equivalent) in a follow-up effort. This is not a blocker for the current image bump.

---

Labels: Renovate bot dependency version bump for task-runner image

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:11 PM UTC · Completed 2:15 PM UTC
Commit: 14477fe · View workflow run →