Update prefetch-dependencies-oci-ta to trusted version 0.9.0

[samanthajayasinghe]

Summary

• Update prefetch-dependencies-oci-ta task bundle from 0.4.1 to 0.9.0 in all 4 Tekton pipeline files
• The old 0.4.1 digest was removed from Konflux's trusted task catalog, causing Enterprise Contract checks to fail on all PRs (including ROSAENG-63302: Add toolchain go1.26.5 to remediate Go stdlib CVEs #613)

Files updated

• .tekton/managed-cluster-validating-webhooks-pull-request.yaml
• .tekton/managed-cluster-validating-webhooks-push.yaml
• .tekton/managed-cluster-validating-webhooks-e2e-pull-request.yaml
• .tekton/managed-cluster-validating-webhooks-e2e-push.yaml

Error this fixes

Required task "prefetch-dependencies-oci-ta" is required and present but not from a trusted task

Test plan

• Verify Konflux Enterprise Contract checks pass on this PR
• Verify Konflux build pipelines still complete successfully
• Confirm prefetch-dependencies task runs without parameter compatibility issues

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the dependency-prefetching task bundle used by validation workflows to version 0.9.0.
  • Refreshed the pinned integrity references for consistent and reliable workflow execution.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 15af5c6d-bd31-4ffd-b842-97105b7f91cf

📥 Commits

Reviewing files that changed from the base of the PR and between 3131b63 and bf3b22e.

📒 Files selected for processing (4)

• .tekton/managed-cluster-validating-webhooks-e2e-pull-request.yaml
• .tekton/managed-cluster-validating-webhooks-e2e-push.yaml
• .tekton/managed-cluster-validating-webhooks-pull-request.yaml
• .tekton/managed-cluster-validating-webhooks-push.yaml

---

Walkthrough

The four Tekton pipeline configurations update their pinned prefetch task bundle references from version 0.4.1 to 0.9.0 and replace the associated SHA-256 digests.

Changes

Tekton bundle update

Layer / File(s)	Summary
Update pinned prefetch bundle references .tekton/managed-cluster-validating-webhooks-*.yaml	The pull-request and push configurations now reference prefetch task bundle version 0.9.0 with updated SHA-256 digests.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to bf3b2

The change updates the dependency-prefetch task to the trusted version consistently across the four pipelines, with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: updating the prefetch-dependencies-oci-ta task bundle to trusted version 0.9.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The parent-to-HEAD diff changes only four Tekton bundle references; it adds no Ginkgo test declarations or test titles.
Test Structure And Quality	✅ Passed	The diff changes only four Tekton YAML bundle references; no Ginkgo test code or test behavior was added or modified, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The diff changes only four Tekton bundle references from 0.4.1 to 0.9.0; it adds no Ginkgo tests or MicroShift-incompatible API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only four Tekton YAML bundle references; it adds no Ginkgo tests or test code, so SNO compatibility criteria do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only four Tekton PipelineRun task-bundle references. It adds no deployment, operator, controller, replica, affinity, topology-spread, selector, toleration, or PDB scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The PR diff contains only four Tekton YAML bundle-reference changes; no OTE process code or process-level stdout writes were added or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only four Tekton bundle references; it adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The diff only updates four OCI task references to version 0.9.0 with SHA-256 digests. No added or changed content uses MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR only updates four pinned bundle references; all four manifests and both old/new task payloads contain no flagged privilege fields or SYS_ADMIN capability.
No-Sensitive-Data-In-Logs	✅ Passed	The diff changes only four pinned Tekton bundle references; it adds no logging, output, or sensitive-data handling that could expose secrets or personal data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@samanthajayasinghe: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[smarthall]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: samanthajayasinghe, smarthall

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [samanthajayasinghe,smarthall]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment