ci(Konflux): re-enable hermetic builds

[romanblanco]

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

• Re-enabled hermetic Konflux builds with Bundler, RPM, and Cargo prefetch inputs.
• Updated the prefetch task bundle to 0.5.0, which includes Hermeto 0.58.0.
• Added conditional HERMETIC handling for dependency setup and Cargo configuration.
• Restored Bundler setup for non-hermetic builds and removed Bundler from the runtime stage.
• Synchronized Cargo dependencies with prometheus-client-mmap 1.5.0.
• Updated Konflux task bundle digests and build artifacts.
• Refreshed RPM lock metadata and repository artifacts.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The change enables hermetic inputs in pull-request and push Tekton PipelineRuns. The Dockerfile uses HERMETIC to select conditional build and final-stage operations. Hermetic builds copy a prebuilt Cargo configuration and skip selected repository, timezone, and RubyGems operations. Rust crate versions are downgraded for compatibility. RPM lock metadata and pinned Tekton task bundle digests are refreshed.

Estimated code review effort: 3 (Moderate) | ~20 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Security Checklist	❌ Error	The PR changes System Configuration and File Management through Tekton hermetic settings and Dockerfile package, directory, and file-copy operations; only General Coding Practices is checked.	Review the checklist and mark System Configuration and File Management, or document why these topics do not apply.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the primary change: re-enabling hermetic builds in Konflux CI.
Pr Name Check	✅ Passed	The title feat(Konflux): re-enable hermetic builds follows conventional commit format and accurately summarizes the hermetic build changes in the Dockerfile and Tekton pipelines.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[romanblanco]

CI probably needs prefetch-dependencies-oci-ta@0.5.0 in acceptable bundle to pass:

 d=$(mktemp -d) && skopeo copy docker://quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest dir:"$d" 2>/dev/null && (strings "$d"/* 2>/dev/null | grep -oP 'prefetch-dependencies-oci-ta:\K[0-9.]+' | sort -V | tail -1 | xargs -I{} echo "Latest trusted prefetch: {}") ; rm -rf "$d"

[RoamingNoMaD]

Also, please test the resulting image. Jenkins uses a different one, so you can't trust IQE results.

[RoamingNoMaD]

Can we get rid of the back-and-forth commits please?

[romanblanco]

Squashed and updated

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: afb538f3-a0fd-490b-912e-f68c11112527

📥 Commits

Reviewing files that changed from the base of the PR and between ff61702 and c6465b1.

⛔ Files ignored due to path filters (1)

• .hermetic_builds/cargo/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .hermetic_builds/cargo/Cargo.toml
• .tekton/compliance-backend-pull-request.yaml
• .tekton/compliance-backend-push.yaml
• Dockerfile
• rpms.lock.yaml

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0ea9c301-5262-4083-8b31-57a802882e1b

📥 Commits

Reviewing files that changed from the base of the PR and between c6465b1 and a601eab.

⛔ Files ignored due to path filters (1)

• .hermetic_builds/cargo/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .hermetic_builds/cargo/Cargo.toml
• .tekton/compliance-backend-pull-request.yaml
• .tekton/compliance-backend-push.yaml
• Dockerfile
• rpms.lock.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

• .tekton/compliance-backend-push.yaml
• .tekton/compliance-backend-pull-request.yaml
• rpms.lock.yaml
• Dockerfile