chore(deps): update quay.io/konflux-ci/task-runner docker tag to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/task-runner	tekton-step-image	major	1.4.1 → 2.1.0
quay.io/konflux-ci/task-runner	tekton-step-image	major	1.8.1 → 2.1.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

konflux-ci/task-runner (quay.io/konflux-ci/task-runner)

v2.1.0

Compare Source

Date: 2026-07-08

Installed Software

• git-lfs added (3.7.1-5.el10_2.5)
• cosign 3.0.5 => 3.1.1
• huggingface-hub 1.17.0 => 1.22.0
• oc 4.21.0 => 4.22.0
• syft 1.44.0 => 1.46.0
• awscli 1.45.18 => 1.45.40
• coreutils-single 9.5-7.el10 => 9.5-8.el10_2
• kubectl 1.36.1 => 1.36.2
• olot 0.1.17 => 0.1.18
• openssl 3.5.5-3.el10_2 => 3.5.5-4.el10_2
• rsync 3.4.1-6.el10_2 => 3.4.4-1.el10_2
• skopeo 1.22.2-1.el10_2 => 1.22.2-2.el10_2
• tkn 0.44.1 => 0.44.2
• yq 4.53.2 => 4.53.3

Added

• Added git-lfs to support cloning LFS-enabled repositories in the
  git-clone task and its derived production variants.

v2.0.0

Compare Source

Date: 2026-06-16

Major version upgrade of cosign

Installed Software

• cosign 2.6.3 => 3.0.5

v1.8.1

Compare Source

Date: 2026-06-05

Re-release of 1.8.0 with no changes. The 1.8.0 release did not trigger CI pipelines.

v1.7.0

Compare Source

Date: 2026-05-14

Installed Software

• openssh-clients added (9.9p1-14.el10_1)
• rsync added (3.4.1-2.el10_1.2)
• subscription-manager added (1.30.10.1-1.el10_1)
• awscli 1.44.49 => 1.45.2
• conftest 0.66.0 => 0.68.2
• crun 1.23.1-1.el10_0 => 1.27-1.el10_1
• huggingface-hub 1.7.1 => 1.13.0
• syft 1.42.1 => 1.44.0
• yq 4.52.2 => 4.53.2
• buildah 1.43.0 => 1.43.1
• cosign 2.6.2 => 2.6.3
• jq 1.7.1-11.el10 => 1.7.1-11.el10_1.0.2
• olot 0.1.16 => 0.1.17
• python3 3.12.12-3.el10_1.1 => 3.12.12-3.el10_1.3
• tkn 0.44.0 => 0.44.1

Added

• rsync, ssh and subscription-manager
• The container image now has a floating v1 tag pointing to the latest 1.x release:
  quay.io/konflux-ci/task-runner:v1

Fixed

• The version label in the container image is now correct
  (previously, this label was inherited from the UBI base image)

v1.6.0

Compare Source

Date: 2026-03-24

• huggingface-hub added (1.7.1)
• olot added (0.1.16)
• python3 3.12.12-3.el10_1 => 3.12.12-3.el10_1.1

v1.5.0

Compare Source

Date: 2026-03-13

• buildah 1.42.2 => 1.43.0
• tkn 0.43.0 => 0.44.0
• awscli 1.44.29 => 1.44.49
• skopeo 1.20.0-2.el10_1 => 1.20.0-3.el10_1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 9:14 PM UTC · Completed 9:23 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

Review — ✅ Approve

PR: #3623 — Update quay.io/konflux-ci/task-runner Docker tag to v2
Author: renovate[bot]
Scope: 6 files changed (23+/23−), all image tag + digest swaps

Summary

Mechanical Renovate dependency bump updating quay.io/konflux-ci/task-runner across the modelcar-oci-ta task and its 5 test files:

• Main task: 1.8.1 → 2.1.0 (3 step images: build-and-push, upload-sbom, report-sbom-url)
• Tests: 1.4.1 → 2.1.0 (4 step images per test file)

All images are properly pinned by SHA256 digest. The major version bump (v1→v2) includes a cosign upgrade from v2 to v3, which is the reason for the Renovate major classification. Other tasks in this repo (e.g., buildah-oci-ta/0.10) already run task-runner:2.0.0 with cosign attach sbom successfully, validating compatibility.

Dimension results

Dimension	Result
Correctness	✅ No regressions. cosign attach sbom still functional in cosign v3. Tests not weakened.
Security	✅ No findings. Images digest-pinned, no permission changes.
Intent & coherence	✅ Mechanical dependency bump, authorization implicit.
Style & conventions	✅ No findings. Value-only change follows existing patterns.

Low-severity follow-up

• cosign attach sbom deprecation tracking (task/modelcar-oci-ta/0.1/modelcar-oci-ta.yaml:477): The cosign attach sbom command is deprecated in cosign v3 and slated for removal in cosign v4. While it still functions correctly with task-runner v2.x, the team should plan migration to cosign attest before cosign v4 is released. This affects upload-sbom steps across multiple tasks in this repo.

Previous run

Review

Findings

Medium

• [API contract violation] task/modelcar-oci-ta/0.1/modelcar-oci-ta.yaml:477 — The upload-sbom step calls cosign attach sbom, which was deprecated in cosign v2. This PR bumps task-runner to v2.0.0, which ships cosign 3.0.5. Two other tasks in this repository (package-operator-package and package-operator-package-oci-ta) already use task-runner:2.0.0 with the same cosign attach sbom invocation, suggesting the command is still available (possibly via a compatibility shim). Nonetheless, human reviewers should confirm CI passes for this task to validate SBOM upload still works under cosign 3.x.
  Remediation: Verify that CI tests pass for this PR and confirm cosign attach sbom works in the task-runner:2.0.0 image. If the command has been removed, replace with the cosign 3.x equivalent.

Low

• [authorization-missing-linked-issue] This Renovate bot PR lacks a linked issue. The major version upgrade has already been adopted elsewhere in the repository (package-operator tasks are on task-runner:2.0.0), so authorization is inferred from the established precedent.

• [scope-coherence-incremental-rollout] This PR updates only the modelcar-oci-ta task to task-runner:2.0.0, while most other tasks remain on 1.x. This is consistent with Renovate's per-package-group phased update approach and does not indicate a problem.

---

Labels: Renovate bot dependency update PR matches the existing 'dependencies' label.

Previous run (2)

Review

Findings

High

• [api-contract] task/modelcar-oci-ta/0.1/modelcar-oci-ta.yaml:417 — The upload-sbom step invokes cosign attach sbom, which was deprecated in cosign v2. This PR bumps task-runner from 1.4.1 (cosign 2.6.3) to 2.0.0 (cosign 3.0.5). If cosign v3 has removed the attach sbom subcommand, this step will fail at runtime. The step uses set -e and an explicit exit 1 on failure, so the entire task would abort. The downstream report-sbom-url step also depends on SBOM attachment having succeeded.
  Remediation: Before merging, verify whether cosign 3.0.5 in the new task-runner:2.0.0 image still provides cosign attach sbom. If removed, migrate to cosign attest with the appropriate predicate type. A quick smoke test (e.g., podman run quay.io/konflux-ci/task-runner:2.0.0 cosign attach sbom --help) would confirm.

Low

• [stale-reference] task/build-paketo-builder-oci-ta/0.2/build-paketo-builder-oci-ta.yaml — Several non-archived task files outside this PR's diff still reference the old task-runner:1.4.1 image. These files are not broken by this PR since they retain the working v1.4.1 image, but they indicate an incomplete rollout if the intent is to update all task-runner references.

---

Labels: Renovate bot PR updating a container image dependency.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:43 PM UTC · Completed 12:52 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 2:11 PM UTC · Completed 2:20 PM UTC
Commit: 14477fe · View workflow run →