rhdh-konflux-tasks

Files (8)

• SKILL.md
• openai.yaml · agents/
• konflux-migration-urls.md · references/
• konflux-plugin-catalog.md · references/
• konflux-rhdh-midstream.md · references/
• konflux-trusted-tasks.md · references/
• check-trusted-tasks.sh · scripts/
• konflux-task-update.md · workflows/

SKILL.md (first lines)

# Konflux Tekton task updates

Keep builds working after a Konflux task tag bump: update the pinned
`tag@sha256` digests, apply what each task's `MIGRATION.md` documents, and
regenerate the PipelineRuns so they match the migrated templates.

## Route

Load `workflows/konflux-task-update.md`. It detects the repository layout and
sends you to the reference that matches:

- `references/konflux-plugin-catalog.md` — `rhdh-plugin-catalog`, marker
  `.tekton/updatePLRs.sh` (main / 2.1+). On 1.9 and 1.10 streams the generator
  is still named `.tekton/generatePipelineRunsForPlugins.sh` (deprecated;
  same layout).
- `references/konflux-rhdh-midstream.md` — RHDH midstream, variant A
  (`.tekton-templates/rhdh-pipeline.yaml`) and variant B
  (`.tekton-templates/rhdh-hub.yaml` with shared `build-pipeline-rhdh-*.yaml`).
- `references/konflux-migration-urls.md` — resolving a task name and tag to the
  live `MIGRATION.md`, since most tasks left `konflux-ci/build-definitions` and
  the versioned paths under it now 404.
- `references/konflux-trusted-tasks.md` — ECP / expired / untrusted pins;
  `scripts/check-trusted-tasks.sh` against `data-acceptable-bundles`.

After the digest/migration/trusted-task pass, invoke `/rhdh-base-images` **by
name** for the matching GitHub `main` or `release-*` line (see
[konflux-task-update.md](workflows/konflux-task-update.md) step 5). Do not run
that skill's scripts from here.

## Boundary with plugin midstream propagation

Two skills touch `.tekton`, and they touch it for different reasons.

- This skill owns Konflux task maintenance across a whole stream: digest bumps,
  migrations to templates and shared pipelines, and full PipelineRun
  regeneration for every component on the branch.
- `/rhdh-plugin-midstream-propagate` owns promoting one plugin workspace
  through overlays and into the catalog, including the surgical per-workspace
  PLR tag edit that goes with it — deliberately without a full regeneration.

If the request is "this plugin version needs to reach midstream", it is
`/rhdh-plugin-midstream-propagate`. If the request is "the Konflux tasks moved
and the pipelines need to catch up", it is this skill. Never run a full
regeneration to deliver a single workspace bump; it rewrites every component's
PLR.

## Boundary with base images

`/rhdh-base-images` owns `FROM` tags, `rpms.lock.yaml`, Node headers
(`.nvm/releases/node-v*-headers.tar.gz`), operator `go.mod`, plugin-catalog
`builder.Containerfile` / `.nvm/` / `konflux.additional-tags`, and overlays
`versions.json` `node`. This skill does not reconstruct that workflow. It maps
the Konflux stream to a GitHub branch selector, names the checkouts
(user-supplied, or `/rhdh-context`, including catalog and overlays), and
invokes `/rhdh-base-images`.

A Konflux log `could not find releases/node-v*-headers.tar.gz` is that handoff,
not a Tekton pin problem. Do not pin catalog FROM or copy `.nvm/` from this
skill.

| Konflux / catalog stream | `/rhdh-base-images` `-b` |
|--------------------------|--------------------------|
| `rhdh-1.9-rhel-9` | `release-1.9` |
| `rhdh-1.10-rhel-9` | `release-1.10` |
| `release-2.Y` | `release-2.Y` |
| `main` (2.1+) | `main` |
| other `rhdh-<ver>-rhel-<N>` | `release-<ver>` when that GitHub branch exists |

## Boundary with Mintmaker

Mintmaker's Tekton manager and this skill both touch task pins, and they do
different jobs.

- Weekly maintenance no longer runs `updateDigests.sh`. Mintmaker
  automerges same-tag digests and patch tags for `rhdh` and
  `rhdh-plugin-catalog` (`konflux/digests/<branch>`, one MR per branch).
- Mintmaker runs the upstream task migration scripts, so a minor or major
  bump can rewrite YAML (`BUILD_ARGS_FILE` → `BUILD_ARGS_FILES`,
  `CACHI2_ARTIFACT` → `PREFETCH_ARTIFACT`). Those MRs stay
  `konflux/migrations/<branch>` and do not automerge. Mintmaker does not
  run `generatePipelineRuns.sh`.
- Do not close a migration MR as redundant with a digest update. Remaining
  tag bumps (`prefetch-dependencies-oci-ta`, `buildah-oci-ta`,
  `source-build-oci-ta`, dropping `show-sbom` / `summary`) are this skill's
  `--minor` plus `MIGRATION.md` plus `generatePipelineRuns.sh` path.

## Prefer `-oci-ta` task variants

When the Konflux catalog ships both a workspace-based task and an
`<name>-oci-ta` variant, **prefer the `-oci-ta` bundle** in templates,
shared pipelines, and PLRs. OCI-TA tasks pass artifacts via
`SOURCE_ARTIFACT` / `CACHI2_ARTIFACT` and `ociStorage` params instead of
the `source` workspace.

**Operator-bundle exception:** do not migrate `rhdh-operator-bundle.yaml` or
`rhdh-operator-bundle-*` PLRs to `-oci-ta` tasks on a stream-wide pass unless
the user explicitly requests operator-bundle changes. Hub, operator,
must-gather, and bootc are in scope. `rhdh-rag-content-*` is 1.10-only
(deprecated; removed on main / 2.1). Per-variant file lists:
[konflux-rhdh-midstream.md](references/konflux-rhdh-midstream.md#oci-ta-file-scope).

| Legacy task | Preferred OCI-TA task |
|-------------|----------------------|
| `git-clone` | `git-clone-oci-ta` |
| `prefetch-dependencies` | `prefetch-dependencies-oci-ta` |
| `buildah` | `buildah-oci-ta` |
| `source-build` | `source-build-oci-ta` |
| `sast-snyk-check` | `sast-snyk-check-oci-ta` |
| `sast-shell-check` | `sast-shell-check-oci-ta` |
| `sast-unicode-check` | `sast-unicode-check-oci-ta` |
| `push-dockerfile` | `push-dockerfile-oci-ta` |

**`prefetch-dependencies` → `prefetch-dependencies-oci-ta`** (pipeline task
name may stay `prefetch-dependencies`): add `SOURCE_ARTIFACT`,
`ociStorage`, `ociArtifactExpiresAfter`, `enable-package-registry-proxy`;
drop `dev-package-managers` and the `source` workspace; keep
`git-basic-auth` and `netrc`; wire downstream tasks to prefetch
`SOURCE_ARTIFACT` / `CACHI2_ARTIFACT` results.

From redhat-developer/rhdh-skills, Apache-2.0.

More from redhat-developer/rhdh-skills