Konflux Tekton updates

Goal

After a minor Konflux task tag bump, update .tekton pipelines and generators so builds keep working. Apply what each MIGRATION.md says; do not add drift tests that block future Konflux updates.

Prerequisites

skopeo, jq (>= 1.7), yq. Optional: gh for PR creation from scripts.

Commit locally; never push without human review

generatePipelineRuns.sh does not commit or push.

Do not run digest/generator scripts without --no-push / --nopush unless the user explicitly requests a push.

Detect repo layout

If both plugin-catalog and midstream markers exist, apply changes only for the repo/branch you are on.

Workflow

1. Bump digests

cd .tekton
./updateDigests.sh --minor --no-push

• Updates tag@sha256 in .tekton/*.yaml and .tekton-templates/*.yaml (via TEMPLATEPATH).
• On variant B, also updates .tekton/build-pipeline-rhdh-*.yaml.
• Tag changes list MIGRATION.md URLs under konflux-ci/build-definitions.
• Digest-only (no tag bump): ./updateDigests.sh --no-push -q

Review git diff for quay.io/konflux-ci/tekton-catalog/task-* changes.

2. Apply migrations

For each URL from updateDigests.sh (or from the diff):

1. Read MIGRATION.md.
2. Apply only documented user actions in templates and shared pipelines (see references/rhdh-midstream.md for per-variant file list).
3. Skip “no action required” sections.

If PLRs still contain removed params (e.g. dev-package-managers) but templates are fixed, migrations are incomplete until step 3.

3. Regenerate PipelineRuns

Always run after template or shared-pipeline migration edits (not optional when params changed):

cd .tekton
./generatePipelineRuns.sh -t <version>

• Variant A: also patch rhdh-rag-content-<N>-{push,pull}.yaml by hand (inline pipelineSpec, not generated).
• Variant B: hub/operator PLRs regenerate from rhdh-hub.yaml / rhdh-operator.yaml; build-pipeline-*.yaml is edited directly, not by the generator.

Commit migration + regen locally when ready; do not push until human review.

4. Human review and push

Human reviews the full diff (digest commit plus any migration/regen commits), then git push or opens a PR.

Known migration patterns

Use live MIGRATION.md as source of truth. Common cases:

Anti-patterns

• Pushing without --no-push / --nopush and human sign-off.
• Leaving removed task params (dev-package-managers, COMMIT_SHA on build-image-index).
• Skipping generatePipelineRuns.sh after fixing templates while PLRs still reference old params.
• Editing only PLRs when templates or build-pipeline-*.yaml are the source of truth.
• Adding verify_* guards that fail on the next Konflux bump.
• Dropping image-expires-after from PLRs only because build-image-index no longer uses it.
• Hardcoding 1- in generatePipelineRunsForPlugins.sh Containerfile comments; use ${RHDH_XY_VERSION} so 1.10.0 becomes 1-10, not 1.