chore(deps): update konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	a291081 → 3ab8441
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	b33bfa8 → 70c52e8
quay.io/konflux-ci/tekton-catalog/task-buildah (source, changelog)	0.9 → 0.10	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	8fad4c2 → 9ff424d
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	567cb66 → 53a0232
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	88f4fd6 → 2e5ebe0
quay.io/konflux-ci/tekton-catalog/task-git-clone (source, changelog)	0.1 → 0.2	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	0.1 → 0.2	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies (source, changelog)	d127e05 → d0b4afa
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile (source, changelog)	3591992 → 3246385
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	237c54b → 9ad20a0
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check (source, changelog)	ffc6d57 → a13743a
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check (source, changelog)	0.4 → 0.5	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check (source, changelog)	7631757 → 9185328
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	a7346ed → 8fe70a9
quay.io/konflux-ci/tekton-catalog/task-source-build (source, changelog)	2f846d3 → e1e6252
quay.io/konflux-ci/tekton-catalog/task-summary (source, changelog)	e1b8e42 → 62c465f

---

Release Notes

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah)

v0.10

Fixed

• Restores the /cachi2/cachi2.env mount that version 0.10.3 removed.
  Despite being an undocumented implementation detail, some builds use
  the presence of this file as an indicator that the build is hermetic.
  Enable them to do so for the time being.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-git-clone)

v0.2

• Fix SSH setup failing when mounted secrets contain symlinks to directories konflux-build-cli#165

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta)

v0.2

• Fix SSH setup failing when mounted secrets contain symlinks to directories konflux-build-cli#165

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Walkthrough

The Tekton PipelineRun manifest was updated to use new SHA256 digests for two task bundle images: quay.io/konflux-ci/tekton-catalog/task-buildah (buildah task) and quay.io/konflux-ci/tekton-catalog/task-summary (finally/show-summary). No other pipeline wiring or parameters changed.

Changes

Pipeline task bundle updates

Layer / File(s)	Summary
Buildah task bundle digest update .tekton/quickstarts-pull-request.yaml	The buildah task's taskRef.bundle for quay.io/konflux-ci/tekton-catalog/task-buildah:0.10 was updated to a new SHA256 digest.
Show-summary task bundle digest update .tekton/quickstarts-pull-request.yaml	The finally/show-summary task's taskRef.bundle for quay.io/konflux-ci/tekton-catalog/task-summary:0.2 was updated to a new SHA256 digest.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR body lacks the required template sections like Description, How to test locally, Checklist, and AI disclosure.	Reformat the PR body to match the template, add the summary, issue link, testing steps, reviewer notes, checklist, and AI disclosure.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the dependency/reference update and matches the main change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/main

---

_{Comment @coderabbitai help to get the list of available commands.}

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.