[jsell-rh]

Empty prefetch input currently creates a TaskRun whose only step is skipped. The deployed Conforma policy fails to read its already-true proxy parameter because the TaskRun has no status.results, causing five application-wide EC violations.

Skip the entire prefetch-dependencies PipelineTask when prefetch-input is empty for api-server, cli, control-plane, web-console, and fleet-dashboard, across push, pull-request, and merge-queue (15 files). Nonempty input still runs prefetch. The active policy already excludes tasks.required_tasks_found:prefetch-dependencies; builds have no downstream references to prefetch results, and Tekton continues ordering-only dependents after a skipped task.

This is an alternative to #800. It preserves the existing empty-input build behavior and requires no policy changes. The workaround addresses empty-input builds only; the upstream parameter-extraction bug remains relevant if prefetch is enabled later.

Validation:

• make check passed.
• All 15 YAML files parse, and structural comparison confirms the task condition is the only configuration change.
• Confirmed all affected pipelines retain empty prefetch input and have no references to prefetch task results.
• Replayed a simulated skipped-task attestation through Conforma v0.10.10 and the deployed policy bundle: the proxy violation disappears without introducing another violation.
• Live Konflux builds and EC validation are still required to confirm the newly generated attestations end to end.

Policy bug source: https://github.com/conforma/policy/blob/fb1d3a6b7d70a6c43e045f0b38c77349a94faba2/policy/lib/tekton/task.rego#L30-L60
Tekton skip semantics: https://tekton.dev/docs/pipelines/pipelines/#guarding-a-task-only

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: openshift-online/hypershell
• Branch: fix/konflux-skip-empty-prefetch
• File: .coderabbit.yaml
• Commit: 100e323
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 03c345df-a45b-47dd-b9f3-1f1500c0c366

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

HyperShell environment deploying

Deploying commit 100e323 to an ephemeral OpenShift environment. This comment will update in place once the environment is ready.

Track this deploy

Comment /pr-extend to keep this environment active. Otherwise it is destroyed once e2e testing concludes. If it has already been destroyed, /pr-extend redeploys it.

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.