Expected Analysis: modelcar-oci-ta vs ADR-0046

ADR-0046 requirement

All Tekton task steps should use the common task runner image (quay.io/konflux-ci/task-runner) unless they have a legitimate exemption. The ADR explicitly carves out an exception for use-case-oriented images like build-trusted-artifacts.

Step-by-step analysis

use-trusted-artifact — EXEMPT

Image: quay.io/konflux-ci/build-trusted-artifacts

ADR-0046 states: "The Task Runner image does not replace the more specialized use-case-oriented images." The build-trusted-artifacts image is a use-case-oriented image (Trusted Artifacts), not a tool-oriented one. Additionally, the ADR notes that "Trusted Artifacts variants of Tasks would still use separate steps to create/use the artifacts." This step is legitimately exempt.

download-model-files — VIOLATION

Image: quay.io/konflux-ci/oras

This step uses the oras tool-oriented container image. ADR-0046 calls for gradually deprecating "all the current tool-oriented container images" in favor of the task runner. The step uses oras and retry, both of which are available in the task runner image.

Fix: Replace the image reference with the task runner image. No other changes needed — oras and retry are already installed.

create-modelcar-base-image — VIOLATION

Image: quay.io/konflux-ci/release-service-utils

This step uses get-image-architectures, oras, and jq. While oras and jq are in the task runner, get-image-architectures is not.

Fix: The get-image-architectures tool needs to be added to the task runner image first. Once added, replace the image reference with the task runner image.

copy-model-files — VIOLATION

Image: registry.access.redhat.com/ubi9/python-311

This step uses python3 and pip install olot. The task runner has python3 but olot is a Python package installed at runtime via pip, not a standalone tool baked into any image.

Fix: This is a gray area. olot is installed via pip at runtime, so swapping to the task runner image would work if pip is available. However, olot may not meet the ADR's inclusion criteria for the task runner ("be an actual standalone tool", "follow a versioning scheme") since it's a Python library. The image swap may be possible without adding olot to the task runner — just use the task runner's python3 and keep the pip install in the script. Alternatively, if olot qualifies as a tool, propose adding it to the task runner.

push-image — VIOLATION

Image: quay.io/konflux-ci/oras

Same as download-model-files. Uses oras, select-oci-auth, and retry, all available in the task runner.

Fix: Replace the image reference with the task runner image. No other changes needed.

sbom-generate — VIOLATION

Image: quay.io/konflux-ci/mobster

This step uses mobster, which is not in the task runner image.

Fix: mobster needs to be added to the task runner image first. It appears to meet the ADR's inclusion criteria (standalone tool with versioned releases). Once added, replace the image reference.

upload-sbom — VIOLATION

Image: quay.io/konflux-ci/appstudio-utils

This step uses cosign, select-oci-auth, and retry, all available in the task runner. ADR-0046 specifically calls out appstudio-utils as problematic ("breaks good secure supply chain practices").

Fix: Replace the image reference with the task runner image. No other changes needed.

report-sbom-url — VIOLATION

Image: quay.io/konflux-ci/yq

This step uses the yq tool-oriented container image, but the script itself only uses basic shell utilities (sha256sum, awk, bash string manipulation) — it does not actually invoke the yq binary. All tools used are available in the task runner.

Fix: Replace the image reference with the task runner image. No other changes needed — the step doesn't even use yq.

Summary

• 1 step exempt (use-trusted-artifact)
• 7 steps in violation
• 4 violations fixable today by swapping the image (download-model-files, push-image, upload-sbom, report-sbom-url)
• 2 violations require adding tools to the task runner first (create-modelcar-base-image needs get-image-architectures, sbom-generate needs mobster)
• 1 violation is a gray area (copy-model-files — may work with a simple image swap if pip is available, or may need olot added)