chore(deps): update konflux references

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	tekton-bundle	digest	a291081 → 6387614
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-buildah (source, changelog)	tekton-bundle	patch	0.10 → 0.10.5
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.2
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	tekton-bundle	digest	e78d0d3 → 0ccc688
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	tekton-bundle	digest	3c4f60e → 27c9760
quay.io/konflux-ci/tekton-catalog/task-git-clone (source, changelog)	tekton-bundle	patch	0.2 → 0.2.5
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	tekton-bundle	patch	0.4 → 0.4.3
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies (source, changelog)	tekton-bundle	minor	0.3 → 0.6.0
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile (source, changelog)	tekton-bundle	patch	0.3 → 0.3.1
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	tekton-bundle	patch	0.2 → 0.2.1
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check (source, changelog)	tekton-bundle	digest	f0fb21c → b3df8ca
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check (source, changelog)	tekton-bundle	digest	5c0f322 → 73ddc5e
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check (source, changelog)	tekton-bundle	digest	633cf55 → cc79a84
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	tekton-bundle	digest	a7346ed → 8fe70a9
quay.io/konflux-ci/tekton-catalog/task-source-build (source, changelog)	tekton-bundle	digest	0659754 → d8e53d9
quay.io/konflux-ci/tekton-catalog/task-summary (source, changelog)	tekton-bundle	digest	a009e58 → 62c465f

---

Release Notes

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-build-image-index)

v0.3.1

Fixed

• Export SBOM_SKIP_VALIDATION into the step environment so the create-sbom step honors the parameter.
  The parameter did nothing before. Now it works as expected.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah)

v0.10.5

Added

• Added a new parameter RHSM_MOUNT_CA_CERTS to allow setting [konflux-build-cli]'s
  --rhsm-mount-ca-certs option.

konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)

v0.3.2

Changed

• Replaced quay.io/konflux-ci/oras:latest image with quay.io/konflux-ci/task-runner:1.5.0 in the oci-attach-report step.

Added

• set docker-config-dir in clair-action report command

v0.3.1

Added

• Declare DOCKER_CONFIG to get get credential to quay.io.
• Increase retry to 5

konflux-ci/build-pipeline-tasks (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies)

v0.6.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.59.0

v0.5.0

• Hermeto release - https://github.com/hermetoproject/hermeto/releases/tag/0.58.0

v0.4.1

Version 0.4.1 only changes the -oci-ta variant of this task.
Nothing changed in the base task (the one you're looking at).

v0.4.0

• Hermeto releases from 0.55.0 to 0.57.1 - hermetoproject/hermeto@0.55.0...0.57.1

v0.3.2

• Added enable-package-registry-proxy parameter to enable use of the package registry proxy when prefetching dependencies.
• Added SERVICE_CA_TRUST_CONFIG_MAP_NAME and SERVICE_CA_TRUST_CONFIG_MAP_KEY parameters to mount the OpenShift service CA for verifying TLS connections to in-cluster services such as the package registry proxy.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 05:00 AM and 11:59 PM, only on Saturday (* 5-23 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Walkthrough

This pull request adds reproducible build parameter support to both Tekton PipelineRun files and updates all task bundle digest references. Three new parameters (source-date-epoch, rewrite-timestamp, omit-history) are added and wired into the Buildah task step. All existing Tekton catalog task bundle references are pinned to new SHA-256 digests across both files.

Changes

Tekton Reproducible Build and Bundle Updates

Layer / File(s)	Summary
Reproducible build parameters and Buildah integration .tekton/bonfire-pull-request.yaml, .tekton/bonfire-push.yaml	Adds three new pipeline parameters for reproducible builds (source-date-epoch, rewrite-timestamp, omit-history) and wires them into the Buildah task as SOURCE_DATE_EPOCH, REWRITE_TIMESTAMP, and OMIT_HISTORY inputs in both PipelineRun files.
Task bundle digest updates .tekton/bonfire-pull-request.yaml, .tekton/bonfire-push.yaml	Updates SHA-256 digests for all 18 Tekton catalog task bundle references (show-sbom, show-summary, init, git-clone, prefetch-dependencies, buildah, build-image-index, rpms-signature-scan, source-build, deprecated-image-check, clair-scan, ecosystem-cert-preflight-checks, sast-snyk-check, clamav-scan, sast-shell-check, sast-unicode-check, apply-tags, push-dockerfile) across both files while preserving task versions and pipeline control flow.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the main change by describing Konflux reference updates.
Description check	✅ Passed	The description lists the same Tekton bundle digest and version updates shown in the changeset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/references/master

---

_{Comment @coderabbitai help to get the list of available commands.}