hack: replace appstudio-utils image w/ task-runner

[sadlerap]

The quay.io/konflux-ci/appstudio-utils image is being deprecated in favor of quay.io/konflux-ci/task-runner, so let's use that instead.

Fixes: KFLUXINFRA-3808

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sadlerap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [sadlerap]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-redhat-appstudio]

Review Summary by Qodo

Replace appstudio-utils image with task-runner

✨ Enhancement

Walkthroughs

Description

• Replace deprecated appstudio-utils image with task-runner
• Update image references in variables and deployment configs
• Align with Konflux infrastructure deprecation plan

Diagram

flowchart LR
  old["quay.io/konflux-ci/appstudio-utils"]
  new["quay.io/konflux-ci/task-runner"]
  vars["variables.yaml"]
  template["configure-oauth-proxy-secret.yaml"]
  old -->|deprecated| new
  new -->|updated in| vars
  new -->|updated in| template

Loading

File Changes

1. hack/new-cluster/tasks/variables.yaml ⚙️ Configuration changes +1/-1

Update repository to task-runner image

• Updated quay.io repository reference from konflux-ci/appstudio-utils to konflux-ci/task-runner
• Maintains same tag and digest lookup mechanism for the new image

hack/new-cluster/tasks/variables.yaml

---

2. hack/new-cluster/templates/konflux-ui/configure-oauth-proxy-secret.yaml ⚙️ Configuration changes +1/-1

Update OAuth proxy secret generation image

• Replaced container image from quay.io/konflux-ci/appstudio-utils to
 quay.io/konflux-ci/task-runner
• Preserves commit ID and digest references for reproducible deployments

hack/new-cluster/templates/konflux-ui/configure-oauth-proxy-secret.yaml

---

[qodo-for-redhat-appstudio]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0)

Context used

✅ Tickets: KFLUXINFRA-3808

✅ Compliance rules (platform): 2 rules

1. Migration left old image 🐞 Bug ☼ Reliability

Description

The PR migrates only the hack/new-cluster konflux-ui secret-generation job to task-runner, but
hack/new-cluster also deploys other components (e.g., image-rbac-proxy and pipeline-service) whose
manifests still pin quay.io/konflux-ci/appstudio-utils, so newly generated clusters will still
depend on the old image.

Code

hack/new-cluster/templates/konflux-ui/configure-oauth-proxy-secret.yaml[106]

Relevance

⭐⭐ Medium

No clear precedent requiring repo-wide image migration; recent PRs changed only konflux-ui image
(#11966/#11975).

PR-#11966
PR-#11975

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new-cluster playbook templates/deploys image-rbac-proxy and pipeline-service, and those
component manifests still reference quay.io/konflux-ci/appstudio-utils, so switching only the
konflux-ui job to task-runner does not eliminate dependency on the old image for new clusters.

hack/new-cluster/playbook.yaml[57-81]
components/image-rbac-proxy/base/oauth/oauth-secret.yaml[47-106]
components/pipeline-service/development/main-pipeline-service-configuration.yaml[1712-1750]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`hack/new-cluster` now uses `quay.io/konflux-ci/task-runner` for the konflux-ui oauth secret generation job, but other components that the same playbook deploys still reference `quay.io/konflux-ci/appstudio-utils`. This leaves new clusters with a mixed state and continued dependency on the old image.

## Issue Context
The `hack/new-cluster/playbook.yaml` templates and deploys multiple components, including `image-rbac-proxy` and `pipeline-service`. Their component manifests currently pin `appstudio-utils` for jobs that run `kubectl/openssl/cosign`.

## Fix Focus Areas
- components/image-rbac-proxy/base/oauth/oauth-secret.yaml[47-106]
- components/pipeline-service/development/main-pipeline-service-configuration.yaml[1712-1750]
- hack/new-cluster/playbook.yaml[57-81]

## What to change
- Replace `quay.io/konflux-ci/appstudio-utils:...@sha256:...` with the corresponding `quay.io/konflux-ci/task-runner:...@sha256:...` in the component manifests that are deployed by new-cluster.
- Ensure the new image still provides the required CLIs used in those jobs (`kubectl`, `openssl`, and `cosign` where applicable).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Misnamed digest variable 🐞 Bug ⚙ Maintainability

Description

hack/new-cluster/tasks/variables.yaml now looks up the digest for konflux-ci/task-runner but
still stores it in quay_digest_build_definitions, which is misleading and increases the chance of
future incorrect reuse/updates.

Code

hack/new-cluster/tasks/variables.yaml[R35-38]

Relevance

⭐⭐⭐ High

Team accepts fixes for misleading/incorrect naming/typos; e.g., corrected misnamed values in PR
#10712/#7684.

PR-#10712
PR-#7684
PR-#10664

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The repo being queried is now konflux-ci/task-runner, but the stored digest variable name still
references build_definitions, which no longer matches the image repo being resolved.

hack/new-cluster/tasks/variables.yaml[31-38]
hack/new-cluster/templates/konflux-ui/configure-oauth-proxy-secret.yaml[54-109]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
After switching the Quay digest lookup from `konflux-ci/appstudio-utils` to `konflux-ci/task-runner`, the fact name `quay_digest_build_definitions` no longer reflects what it contains (it now holds the task-runner digest).

## Issue Context
This digest is consumed by the konflux-ui oauth-proxy secret generation job template via `@{{ quay_digest_build_definitions }}`.

## Fix Focus Areas
- hack/new-cluster/tasks/variables.yaml[31-38]
- hack/new-cluster/templates/konflux-ui/configure-oauth-proxy-secret.yaml[106-106]

## What to change
- Rename `quay_digest_build_definitions` to something repo-accurate (e.g., `quay_digest_task_runner`).
- Update the template reference accordingly.
- If any external varfiles/documentation refer to the old variable name, update them too.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[github-actions]

Kustomize Render Diff

Comparing a169b9c2f → 34123480f

No render differences detected.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 52.37%. Comparing base (a169b9c) to head (497fac2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #12029   +/-   ##
=======================================
  Coverage   52.37%   52.37%           
=======================================
  Files          19       19           
  Lines        1283     1283           
=======================================
  Hits          672      672           
  Misses        539      539           
  Partials       72       72           

Flag	Coverage Δ
go	52.37% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.