Red Hat Konflux update cli-v09

[red-hat-konflux]

Pipelines as Code configuration proposal

To start the PipelineRun, add a new comment with content /ok-to-test

For more detailed information about running a PipelineRun, please refer to Pipelines as Code documentation Running the PipelineRun

To customize the proposed PipelineRuns after merge, please refer to Build Pipeline customization

Please follow the block sequence indentation style introduced by the proprosed PipelineRuns YAMLs, or keep using consistent indentation level through your customized PipelineRuns. When different levels are mixed, it will be changed to the proposed style.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:04 PM UTC · Completed 5:21 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.30

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (-0.01%)	⬇️
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored CI pipeline onboarding PR with 2 new Tekton files totaling 1097 lines; high change-size composite from raw line count offset by zero protected paths, zero security-sensitive files, no dependency changes, and bot authorship.

[fullsend-ai-review]

Review

Findings

Low

• [build-integrity] .tekton/cli-v09-pull-request.yaml — The hermetic build parameter defaults to "false" and is not overridden in spec.params, unlike the main-branch pipelines which explicitly set hermetic: "true". Non-hermetic builds allow network access during the build step. The same applies to cli-v09-push.yaml. This is standard behavior for bot-generated Konflux onboarding PRs — hermetic configuration is a post-onboarding customization typically applied by maintainers. Consider adding hermetic: "true" and prefetch-input configuration as a follow-up after merging.

[simonbaird]

Konflux UI is not showing it for me right now, but I pulled this out of the Konflux logs:

Notice this part: GOCACHE: unbound variable.

I think this will likely go away once our usual Konflux pipeline customizations are applied.

...
[build-container : build] time="2026-09-01T17:04:43Z" level=info msg="buildah [stdout] [1/2] STEP 12/13: COPY . ."
[build-container : build] time="2026-09-01T17:04:45Z" level=info msg="buildah [stdout] [1/2] STEP 13/13: RUN /build/build.sh \"${BUILD_LIST}\" \"${BUILD_SUFFIX}\""
[build-container : build] time="2026-09-01T17:04:45Z" level=info msg="buildah [stdout] Platform linux/amd64: Building all cross-compiled binaries for download"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stdout] EC_FULL_VERSION=v0.9.0-ci-6d591f4f+redhat"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stdout] BUILDS=darwin_amd64 darwin_arm64 linux_amd64 linux_arm64 linux_ppc64le linux_s390x windows_amd64"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stdout] Building ec_darwin_amd64 for v0.9.0-ci-6d591f4f+redhat"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stderr] /build/build.sh: line 60: GOCACHE: unbound variable"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stderr] subprocess exited with status 1"
[build-container : build] time="2026-09-01T17:04:46Z" level=info msg="buildah [stderr] subprocess exited with status 1"
[build-container : build] time="2026-09-01T17:04:50Z" level=info msg="buildah [stderr] Error: building at STEP \"RUN /build/build.sh \"${BUILD_LIST}\" \"${BUILD_SUFFIX}\"\": exit status 1"
[build-container : build] time="2026-09-01T17:04:50Z" level=error msg="buildah build failed: exit status 1" logger=BuildahCli
[build-container : build] time="2026-09-01T17:04:50Z" level=fatal msg="exit status 1"