ROX-36447: Migrate from clair-scan to roxctl-scan

[vickeybrown]

Replace clair-scan task with roxctl-scan to provide better security coverage as per Konflux Integration Service Team migration plan.

Changes:

• Updated task name from clair-scan to roxctl-scan
• Updated bundle reference to task-roxctl-scan:0.1
• Removed matrix configuration as roxctl-scan handles multi-arch natively

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d07815c8-f024-4d9f-8134-44ecd4a8f3ac

📥 Commits

Reviewing files that changed from the base of the PR and between a42e2d5 and 542c65b.

📒 Files selected for processing (1)

• .tekton/scanner-component-pipeline.yaml

💤 Files with no reviewable changes (1)

• .tekton/scanner-component-pipeline.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Updated image scanning to run once against the combined multi-platform image digest and URL, improving scan consistency across supported platforms.

Walkthrough

The Tekton pipeline removes the roxctl-scan matrix. The scan now runs once with the multi-platform image digest and URL.

Changes

Scanner pipeline execution

Layer / File(s)	Summary
Use one multi-platform scan .tekton/scanner-component-pipeline.yaml	The roxctl-scan task no longer runs separately for each configured build platform. It runs once for the multi-platform image.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 542c6

This localized pipeline configuration change has no identified merge-blocking risk and is merge-ready after normal checks and review.

Suggested reviewers: rhacs-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the migration from clair-scan to roxctl-scan, which is the main change.
Description check	✅ Passed	The description directly explains the task migration, bundle update, and removal of the matrix configuration.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch migrate-to-roxctl-scan

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@vickeybrown: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/slim-e2e-tests	542c65b	link	false	/test slim-e2e-tests
ci/prow/e2e-tests	542c65b	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.