update-konflux-tasks

Automatically update outdated Konflux Tekton tasks based on enterprise contract verification logs or by detecting updates directly.

[Extended thinking: This command can either parse enterprise contract logs or use the update_trusted_task_bundles.py script to identify outdated Tekton tasks, uses skopeo to map digests to version tags, checks migration notes for breaking changes, and updates all pipeline YAML files in the .tekton/ directory with the latest versions.]

Konflux Tekton Tasks Update

Usage Examples:

1. Update tasks from enterprise contract log: /update-konflux-tasks ../../hypershift-operator-enterprise-contract-lxgvw-verify.log
2. Detect and update tasks automatically (no log file): /update-konflux-tasks

Implementation Details:

• When a log file is provided: Parses Konflux enterprise contract verification logs for outdated task warnings
• When no log file is provided: Uses hack/tools/scripts/update_trusted_task_bundles.py --dry-run --json to detect updates
• Uses skopeo inspect to map SHA256 digests to proper version tags
• Checks migration documentation for version bumps
• Requires skopeo and jq to be installed

Process Flow:

1. Detect Outdated Tasks:
   • If a log file is provided ({{args.0}}):
     • Read the provided log file
     • Extract all outdated Tekton task warnings that mention "newer version exists"
     • Parse out task names, current digests, and latest digests
   • If no log file is provided:
     • Run hack/tools/scripts/update_trusted_task_bundles.py $(find .tekton -name '*.yaml') --dry-run --json --upgrade-versions
     • Parse the JSON output to identify tasks needing updates
     • The JSON output contains updates and available_upgrades per file with task_name, current_version, current_digest, latest_version, latest_digest, and is_version_bump fields
2. Map Latest Digests to Version Tags:
   • For each outdated task, use the helper script hack/tools/scripts/find_task_version_by_digest.sh <task-name> <digest> to determine the proper version tag for the latest digest
   • The helper script uses skopeo list-tags and skopeo inspect to find which semantic version tag (e.g., 0.2, 0.3) matches the given digest
   • It filters out commit-hash style tags (e.g., "0.2-f788d9b...") and only returns clean semantic versions
   • Create a mapping of: task-name → current-version@digest → latest-version@digest
3. Check for Migration Notes:
   • For any tasks with version bumps (not just digest updates), check for migration notes
   • If a task matches quay.io/redhat-appstudio-tekton-catalog/ rather than quay.io/konflux-ci/tekton-catalog, we should check if it is available in quay.io/konflux-ci/tekton-catalog and change to use the latter.
   • Use URL pattern: https://github.com/konflux-ci/build-definitions/blob/main/task/{task-name}/{version}/MIGRATION.md
   • If the migration notes reference a migration script, check their availability with the pattern: https://github.com/konflux-ci/build-definitions/blob/main/task/{task-name}/{version}/migrations/{version}.sh. If it is available:
     • Run the migration script on the identified pipeline files
   • Extract any breaking changes, new parameters, or manual steps required
   • Ask the user for input in any manual steps are required
   • Report if "No action required" or list specific migration steps
4. Update Pipeline Files:
   • Discover all Tekton pipeline YAML files using the glob .tekton/**/*.yaml
   • Replace old quay.io/konflux-ci/tekton-catalog/task-{name}:{old-version}@{old-digest} with new versions
   • Use MultiEdit for efficiency when updating multiple tasks per file
5. Provide Comprehensive Summary:
   • List all outdated tasks found and their update status
   • Show current vs. latest version mappings
   • Highlight any version bumps vs. digest-only updates
   • Report any migration notes or manual steps required
   • List all files updated
   • Provide before/after examples for key changes

Expected Output Format:

## 🔄 Konflux Tekton Tasks Update Complete

### Tasks Updated:
- ✅ apply-tags: 0.2@old-digest → 0.2@new-digest (digest update)
- ✅ buildah-remote-oci-ta: 0.4@old-digest → 0.5@new-digest (VERSION BUMP - migration notes checked)
- ✅ init: 0.2@old-digest → 0.2@new-digest (digest update)
[... etc for all tasks]

### Files Updated:
- ✅ .tekton/hypershift-operator-main-push.yaml (8 tasks updated)
- ✅ .tekton/hypershift-operator-main-pull-request.yaml (8 tasks updated)
[... etc for all files]

### Migration Notes:
- buildah-remote-oci-ta v0.4→v0.5: ✅ No action required (bug fix for SBOM generation)

### Summary:
- Total tasks updated: X
- Version bumps: X (with migration notes checked)
- Digest updates: X
- Files updated: X
- Manual steps required: None / [list steps]

Error Handling:

• If log file is provided but doesn't exist, provide clear error message
• If no log file is provided and update_trusted_task_bundles.py fails, provide error details
• If skopeo is not installed, provide installation instructions
• If jq is not installed, provide installation instructions
• If yq is not installed, provide installation instructions
• If PyYAML is not installed (required for update_trusted_task_bundles.py), provide installation instructions: pip install pyyaml
• If no outdated tasks found, report success with no changes needed
• If migration notes URL returns 404, note that no migration documentation exists
• If migration notes include changes that to parameters, output or manual steps, prompt the user about them

Safety Features:

• ✅ Preserves version tags (e.g., keeps 0.2 in task:0.2@sha256:...)
• ✅ Checks migration notes for breaking changes before major version bumps
• ✅ Provides detailed summary of all changes made
• ✅ Use TodoWrite to track progress through complex multi-file updates

Requirements:

• skopeo must be installed (for container image inspection)
• jq must be installed (for JSON parsing)
• yq must be installed (for YAML parsing and checking multi-platform builds)
• pyyaml Python package must be installed when running without a log file (for update_trusted_task_bundles.py)
• Internet connectivity (to check migration notes and inspect container images)

Arguments:

• {{args.0}}: Path to the enterprise contract verification log file that contains outdated task warnings (optional). When not provided, the skill uses hack/tools/scripts/update_trusted_task_bundles.py --dry-run --json to automatically detect outdated tasks.

The command will provide progress updates and automatically update all relevant Tekton pipeline files with the latest task versions.