ROX-36447: Migrate from clair-scan to roxctl-scan

[vickeybrown]

Replace clair-scan task with roxctl-scan to provide better security coverage as per Konflux Integration Service Team migration plan.

Changes:

• Updated task name from clair-scan to roxctl-scan
• Updated bundle reference to task-roxctl-scan:0.1
• Removed matrix configuration as roxctl-scan handles multi-arch natively

[coderabbitai]

Warning

Review limit reached

Next included review available in 45 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c0ebfb3c-cda7-470b-9729-0736b079438c

📥 Commits

Reviewing files that changed from the base of the PR and between 98d9761 and c8e3ba1.

📒 Files selected for processing (1)

• .tekton/collector-component-pipeline.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 56c96d51-4073-4e71-8234-24333f38716b

📥 Commits

Reviewing files that changed from the base of the PR and between 3b08b2e and 98d9761.

📒 Files selected for processing (1)

• .tekton/collector-component-pipeline.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Updated the security scanning step in the build pipeline to use the current scanning task.
  • Preserved existing image validation inputs and the option to skip checks.

Walkthrough

The Tekton collector pipeline replaces the matrix-based clair-scan task with a single roxctl-scan task. It preserves scan inputs and the skip-checks condition while updating the bundle version and digest.

Changes

Scan task migration

Layer / File(s)	Summary
Replace Clair scan task .tekton/collector-component-pipeline.yaml	The pipeline removes per-platform scan expansion and references the pinned roxctl-scan bundle version 0.1 instead of clair-scan bundle version 0.4.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 98d97

This PR switches the pipeline to roxctl-scan and removes the obsolete matrix configuration; the pinned task provides the required parameters, so no actionable merge-blocking risk remains.

Suggested reviewers: rhacs-bot

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description clearly explains the migration and lists the main changes, but it omits the required checklist and Testing Performed sections.	Add the checklist results and a Testing Performed section. State which tests were run or explain why testing was not required.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change from clair-scan to roxctl-scan.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 2

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch migrate-to-roxctl-scan

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch migrate-to-roxctl-scan

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.43%. Comparing base (3b08b2e) to head (c8e3ba1).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3867   +/-   ##
=======================================
  Coverage   27.43%   27.43%           
=======================================
  Files          94       94           
  Lines        5406     5406           
  Branches     2535     2535           
=======================================
  Hits         1483     1483           
  Misses       3198     3198           
  Partials      725      725           

Flag	Coverage Δ
collector-unit-tests	27.43% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.