From 79ed2b936d99c77bcf5a325669fdceb77996dcc7 Mon Sep 17 00:00:00 2001
From: Vickey Brown <vibrown@redhat.com>
Date: Mon, 24 Aug 2026 14:33:07 -0500
Subject: [PATCH] Migrate from clair-scan to roxctl-scan

Replace clair-scan task with roxctl-scan to provide better security
coverage as per Konflux Integration Service Team migration plan.

Changes:
- Updated task name from clair-scan to roxctl-scan
- Updated bundle reference to task-roxctl-scan:0.1
- Removed matrix configuration as roxctl-scan handles multi-arch natively

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

# Conflicts:
#	.tekton/scanner-component-pipeline.yaml
---
 .tekton/scanner-component-pipeline.yaml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.tekton/scanner-component-pipeline.yaml b/.tekton/scanner-component-pipeline.yaml
index 6f062892d..cc7c760fb 100644
--- a/.tekton/scanner-component-pipeline.yaml
+++ b/.tekton/scanner-component-pipeline.yaml
@@ -417,11 +417,6 @@ spec:
       values: [ "false" ]
 
   - name: roxctl-scan
-    matrix:
-      params:
-      - name: image-platform
-        value:
-        - $(params.build-platforms)
     params:
     - name: image-digest
       value: $(tasks.build-image-index.results.IMAGE_DIGEST)
@@ -441,6 +436,26 @@ spec:
       operator: in
       values: ["false"]
 
+  - name: clair-scan
+    params:
+    - name: image-digest
+      value: $(tasks.build-image-index.results.IMAGE_DIGEST)
+    - name: image-url
+      value: $(tasks.build-image-index.results.IMAGE_URL)
+    taskRef:
+      params:
+      - name: name
+        value: clair-scan
+      - name: bundle
+        value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
+      - name: kind
+        value: task
+      resolver: bundles
+    when:
+    - input: $(params.skip-checks)
+      operator: in
+      values: ["false"]
+
   - name: ecosystem-cert-preflight-checks
     matrix:
       params: