/update-konflux-tasks

name: update-konflux-tasks
description: Automatically update outdated Konflux Tekton tasks based on enterprise contract verification logs.

Automatically update outdated Konflux Tekton tasks based on enterprise contract verification logs or by detecting updates directly.

[Extended thinking: This command can either parse enterprise contract logs or use the update_trusted_task_bundles.py script to identify outdated Tekton tasks, uses skopeo to map digests to version tags, checks migration notes for breaking changes, and updates all pipeline YAML files in the .tekton/ directory with the latest versions.]

**Konflux Tekton Tasks Update**

Usage Examples:

1. **Update tasks from enterprise contract log**: `/update-konflux-tasks ../../hypershift-operator-enterprise-contract-lxgvw-verify.log`

2. **Detect and update tasks automatically (no log file)**: `/update-konflux-tasks`

Implementation Details:

• When a log file is provided: Parses Konflux enterprise contract verification logs for outdated task warnings
• When no log file is provided: Uses `hack/tools/scripts/update_trusted_task_bundles.py --dry-run --json` to detect updates
• Uses `skopeo inspect` to map SHA256 digests to proper version tags
• Checks migration documentation for version bumps
• Requires `skopeo` and `jq` to be installed

Process Flow:

1. **Detect Outdated Tasks**:

• If a log file is provided ({{args.0}}):
• Read the provided log file
• Extract all outdated Tekton task warnings that mention "newer version exists"
• Parse out task names, current digests, and latest digests
• If no log file is provided:
• Run `hack/tools/scripts/update_trusted_task_bundles.py $(find .tekton -name '*.yaml') --dry-run --json --upgrade-versions`
• Parse the JSON output to identify tasks needing updates
• The JSON output contains updates and available_upgrades per file with task_name, current_version, current_digest, latest_version, latest_digest, and is_version_bump fields

2. **Map Latest Digests to Version Tags**:

• For each outdated task, use the helper script `hack/tools/scripts/find_task_version_by_digest.sh <task-name> <digest>` to determine the proper version tag for the latest digest
• The helper script uses `skopeo list-tags` and `skopeo inspect` to find which semantic version tag (e.g., 0.2, 0.3) matches the given digest
• It filters out commit-hash style tags (e.g., "0.2-f788d9b...") and only returns clean semantic versions
• Create a mapping of: task-name → current-version@digest → latest-version@digest

3. **Check for Migration Notes**:

• For any tasks with version bumps (not just digest updates), check for migration notes
• If a task matches quay.io/redhat-appstudio-tekton-catalog/ rather than quay.io/konflux-ci/tekton-catalog, we should check if it is available in quay.io/konflux-ci/tekton-catalog and change to use the latter.
• Use URL pattern: `https://github.com/konflux-ci/build-definitions/blob/main/task/{task-name}/{version}/MIGRATION.md`
• If the migration notes reference a migration script, check their availability with the pattern: `https://github.com/konflux-ci/build-definitions/blob/main/task/{task-name}/{version}/migrations/{version}.sh`. If it is available:
• Run the migration script on the identified pipeline files
• Extract any breaking changes, new parameters, or manual steps required
• Ask the user for input in any manual steps are required
• Report if "No action required" or list specific migration steps

4. **Update Pipeline Files**:

• Discover all Tekton pipeline YAML files using the glob `.tekton/**/*.yaml`
• Replace old `quay.io/konflux-ci/tekton-catalog/task-{name}:{old-version}@{old-digest}` with new versions
• Use MultiEdit for efficiency when updating multiple tasks per file

5. **Provide Comprehensive Summary**:

• List all outdated tasks found and their update status
• Show current vs. latest version mappings
• Highlight any version bumps vs. digest-only updates
• Report any migration notes or manual steps required
• List all files updated
• Provide before/after examples for key changes

Expected Output Format:

## 🔄 Konflux Tekton Tasks Update Complete

### Tasks Updated:
- ✅ apply-tags: 0.2@old-digest → 0.2@new-digest (digest update)
- ✅ buildah-remote-oci-ta: 0.4@old-digest → 0.5@new-digest (VERSION BUMP - migration notes checked)
- ✅ init: 0.2@old-digest → 0.2@new-digest (digest update)
[... etc for all tasks]

### Files Updated:
- ✅ .tekton/hypershift-operator-main-push.yaml (8 tasks updated)
- ✅ .tekton/hypershift-operator-main-pull-request.yaml (8 tasks updated)
[... etc for all files]

### Migration Notes:
- buildah-remote-oci-ta v0.4→v0.5: ✅ No action required (bug fix for SBOM generation)

### Summary:
- Total tasks updated: X
- Version bumps: X (with migration notes checked)
- Digest updates: X
- Files updated: X
- Manual steps required: None / [list steps]

Error Handling:

• If log file is provided but doesn't exist, provide clear error message
• If no log file is provided and update_trusted_task_bundles.py fails, provide error details
• If skopeo is not installed, provide installation instructions
• If jq is not installed, provide installation instructions
• If yq is not installed, provide installation instructions
• If PyYAML is not installed (required for update_trusted_task_bundles.py), provide installation instructions: `pip install pyyaml`
• If no outdated tasks found, report success with no changes needed
• If migration notes URL returns 404, note that no migration documentation exists
• If migration notes include changes that to parameters, output or manual steps, prompt the user about them

Safety Features:

• ✅ Preserves version tags (e.g., keeps `0.2` in `task:0.2@sha256:...`)
• ✅ Checks migration notes for breaking changes before major version bumps
• ✅ Provides detailed summary of all changes made
• ✅ Use TodoWrite to track progre