build-vm-image: add v0.3 with corrected qcow2 artifact type

[thozza]

The v0.2 task advertised application/vnd.diskimage.qcow2.gzip as the OCI artifact type for qcow2 images, but never actually gzip-compressed the payload. The qcow2 format uses its own internal compression, so consumers trusting the artifact type and attempting to gunzip would get an error.

This is a breaking change for anything matching on the old artifact type, so it goes into a new minor version (0.3) rather than a patch on 0.2. The MIGRATION.md documents what downstream consumers need to update.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:53 PM UTC · Completed 7:58 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

Review of PR #3710 — build-vm-image v0.3

Verdict: approve ✅

Summary

This PR adds a new v0.3 of the build-vm-image Tekton task, correcting the OCI artifact type for qcow2 disk images from application/vnd.diskimage.qcow2.gzip to application/vnd.diskimage.qcow2. The fix is correct — the v0.2 task never gzip-compressed the qcow2 payload (qcow2 uses its own internal compression), so the old artifact type was misleading and would cause consumers attempting to gunzip the payload to fail.

Change analysis

Comparing the v0.3 task definition against v0.2.2, the diff is minimal and well-scoped:

1. Version label: 0.2.2 → 0.3
2. qcow2 artifact type (the core fix): application/vnd.diskimage.qcow2.gzip → application/vnd.diskimage.qcow2
3. SBOM placeholder tool strings: konflux-ci/build-vm-image-0.2 → konflux-ci/build-vm-image-0.3

No other behavioral changes. Tests are identical copies from v0.2.

Dimension findings

Correctness

• ✅ The artifact type fix is correct and matches the comment already present in v0.2 ("don't zip qcow2 images, it is already compressed").
• ✅ New minor version for a breaking change follows ADR 0054.
• ✅ All 7 SBOM test scenarios are carried forward from v0.2, covering happy-path, fallback, multi-arch, CycloneDX, and skip flows.

Security

• ✅ All Tekton parameters are mapped to environment variables via stepTemplate.env — no direct $(params.*) usage in scripts (compliant with project conventions).
• ✅ Path traversal protections for BIB_CONFIG_FILE and CONFIG_TOML_FILE are in place (realpath -m + prefix check).
• ✅ Pullspec character validation is present for all image references.
• ✅ No new secrets, privileges, or attack surface introduced.

Style & conventions

• ✅ set -euo pipefail in all bash scripts.
• ✅ Shebangs present.
• ✅ CHANGELOG.md updated following Keep a Changelog format, with BREAKING annotation.
• ✅ MIGRATION.md clearly documents what changed and what consumers need to update.

Documentation

• ✅ MIGRATION.md is clear and actionable.
• ✅ README.md accurately reflects parameters and results.
• ✅ CHANGELOG entry is descriptive.

Intent & coherence

• ✅ The change is appropriately scoped — one focused fix in a new version directory.
• ✅ The approach of creating a new minor version (rather than patching v0.2) is correct for a breaking artifact type change.

Cross-repo contracts

• ⚠ Breaking change acknowledged: Consumers matching on application/vnd.diskimage.qcow2.gzip will need to update to application/vnd.diskimage.qcow2. This is documented in MIGRATION.md. Since this is a new version directory (0.3), existing consumers on 0.2 are unaffected until they opt in.

Minor observations (non-blocking)

• The core artifact type fix is not directly tested (the mock build step uses oras push which doesn't set OCI artifact types). This is understandable given the build runs on a remote VM via SSH, making it impractical to test the exact buildah manifest add command in a kind cluster.
• The [ ! -n "${CONFIG_TOML_FILE}" ] idiom (inherited from v0.2) is functionally correct but unconventional — [ -z "..." ] would be more idiomatic. Not worth changing in this PR.

---

Labels: PR adds a new task version with a breaking fix to an OCI artifact type