Merge branch 'renovate/fedora-rawhide/fedora-rawhide-repos-image' into 'main'

Update Fedora Rawhide REPOS_IMAGE to Fedora-Rawhide-20260827.n.0

See merge request fedora/bootc/base-images!685

.gitlab-ci.yml

@@ -1,14 +1,35 @@
 ---
+# CI for fedora-bootc base images.
+#
+# All build and test logic lives in the Justfile so that CI flows
+# are easily replicable locally: just install `just` and run the
+# same targets that CI does.
+workflow:
+  rules:
+    # Skip CI if only non-build files changed
+    - changes:
+        - renovate.json
+        - README.md
+        - LICENSE
+        - .tekton/*
+      when: never
+    - when: always
+
 stages:
   - build
 
 variables:
-  PRIV_ARGS: "--security-opt=label=disable --cap-add=all --device /dev/fuse"
+  BUILDER: buildah
+  JUST_VERSION: "1.49.0"
 
 .build-image:
   stage: build
-  image: quay.io/buildah/stable:v1.40.1
+  image: quay.io/buildah/stable:v1.42.2
   needs: []
+  before_script:
+    # just is not packaged in the buildah image; grab a pinned static binary
+    - curl -sSfL -o /tmp/just.tar.gz "https://github.com/casey/just/releases/download/${JUST_VERSION}/just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+    - tar -xzf /tmp/just.tar.gz -C /usr/local/bin just
 
 basic-checks:
   stage: build
@@ -16,32 +37,24 @@ basic-checks:
   needs: []
   script: |
     set -xeuo pipefail
-    dnf install -y file jq python3-yaml ShellCheck
-    ./ci/find-whitespace
-    ./ci/shellcheck
-    ./ci/validate
+    dnf install -y file jq python3-yaml ShellCheck just
+    just validate
 
-build-minimal:
+# Test each tier against rawhide and the latest stable release
+build-and-test:
   extends: .build-image
-  script: |
-    set -xeuo pipefail
-    buildah build -f Containerfile --no-cache -t localhost/fedora-bootc:minimal ${PRIV_ARGS} --build-arg=manifest=fedora-minimal .
-    cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc:minimal
+  parallel:
+    matrix:
+      - FEDORA_VERSION: [rawhide, "44"]
+        TIER: [minimal, minimal-plus, standard]
+  script:
+    - just test
 
-build-minimal-plus:
+# Smoke-test older Fedora versions (standard tier, build only)
+build-fedora-version:
   extends: .build-image
-  script: |
-    set -xeuo pipefail
-    buildah build -f Containerfile --no-cache -t localhost/fedora-bootc:minimal-plus ${PRIV_ARGS} --build-arg=manifest=fedora-minimal-plus .
-    cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc:minimal-plus
-
-
-standard-build-and-test:
-  extends: .build-image
-  script: |
-    set -xeuo pipefail
-    buildah build --no-cache -t localhost/fedora-bootc ${PRIV_ARGS} .
-    (cd tests/rootfs && buildah build -t localhost/test --from localhost/fedora-bootc)
-    cd tests
-    buildah build -f Containerfile.test-derive --no-cache -t localhost/fedora-bootc-derived ${PRIV_ARGS} .
-    buildah build -f Containerfile.test-sysusers --no-cache -t localhost/fedora-bootc-derived ${PRIV_ARGS} .
+  parallel:
+    matrix:
+      - FEDORA_VERSION: ["43"]
+  script:
+    - just build

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: end-of-file-fixer
       - id: trailing-whitespace
@@ -22,6 +22,6 @@ repos:
       - id: check-json
       - id: check-yaml
   - repo: https://github.com/markdownlint/markdownlint
-    rev: v0.13.0
+    rev: v0.15.0
     hooks:
       - id: markdownlint

.tekton/fedora-bootc-42-minimal-renovate-push.yaml

@@ -1,63 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        (event == "push" && target_branch.startsWith("renovate/"))
-      ) && (
-        ".tekton/fedora-bootc-42-minimal-renovate-push.yaml".pathChanged() ||
-        "Containerfile".pathChanged() ||
-        "bootc-base-imagectl".pathChanged() ||
-        "install-manifests".pathChanged() ||
-        "fedora-includes/generic.yaml".pathChanged() ||
-        "minimal.yaml".pathChanged() ||
-        "minimal/***".pathChanged()
-      )
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal
-    pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-42-minimal-renovate-on-push
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: build-platforms
-    value:
-    - linux/amd64
-    - linux/arm64
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: .
-  - name: privileged-nested
-    value: true
-  - name: build-args
-    value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
-    - MANIFEST=fedora-minimal
-  - name: image-expires-after
-    value: 5d
-  - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal:{{revision}}
-  pipelineRef:
-    params:
-    - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
-    - name: name
-      value: buildah-build-bootc-multi-platform-oci-ta
-    - name: kind
-      value: pipeline
-    resolver: bundles
-  timeouts:
-    pipeline: 6h

.tekton/fedora-bootc-43-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-iot-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-iot-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-iot-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-iot-renovate-push.yaml

@@ -11,7 +11,7 @@ metadata:
       (
         (event == "push" && target_branch.startsWith("renovate/"))
       ) && (
-        ".tekton/fedora-bootc-43-standard-renovate-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-43-iot-renovate-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -20,16 +20,17 @@ metadata:
         "minimal/***".pathChanged() ||
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged() ||
-        "standard.yaml".pathChanged() ||
-        "standard/***".pathChanged()
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-43
-    appstudio.openshift.io/component: fedora-bootc-43-standard
+    appstudio.openshift.io/component: fedora-bootc-43-iot
     pipelines.appstudio.openshift.io/type: build
     release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-43-standard-renovate-on-push
+  name: fedora-bootc-43-iot-renovate-on-push
 spec:
   params:
   - name: git-url
@@ -48,19 +49,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-202508018.n.0@sha256:3d38d19271f189aef11c0b0642ed4105c8aafba34fdf790c373e5ec321ae260a
-    - MANIFEST=fedora-standard
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-iot
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-iot:{{revision}}
   - name: labels
     value:
-      - org.opencontainers.version=43
+      - org.opencontainers.image.version=43
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -68,3 +69,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-iot

.tekton/fedora-bootc-43-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus

.tekton/fedora-bootc-43-minimal-plus-push.yaml

@@ -0,0 +1,70 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-plus-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-plus-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal-plus
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal-plus

.tekton/fedora-bootc-43-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal

.tekton/fedora-bootc-43-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-43-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-43
+    appstudio.openshift.io/component: fedora-bootc-43-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-43-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=43
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-minimal

.tekton/fedora-bootc-43-standard-pull-request.yaml

@@ -24,6 +24,7 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-43
@@ -40,6 +41,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -48,7 +51,7 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-202508018.n.0@sha256:3d38d19271f189aef11c0b0642ed4105c8aafba34fdf790c373e5ec321ae260a
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
     - MANIFEST=fedora-standard
   - name: image-expires-after
     value: 5d
@@ -56,11 +59,11 @@ spec:
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:on-pr-{{revision}}
   - name: labels
     value:
-      - org.opencontainers.version=43
+      - org.opencontainers.image.version=43
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -68,3 +71,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-standard

.tekton/fedora-bootc-43-standard-push.yaml

@@ -23,6 +23,7 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-43
@@ -39,6 +40,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -47,17 +50,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-202508018.n.0@sha256:3d38d19271f189aef11c0b0642ed4105c8aafba34fdf790c373e5ec321ae260a
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-43-compose:Fedora-43-updates-20260727.0@sha256:af8e3cce0623d775670a68562f69e1050805cdd5ba8799c05088e9acf3f372c0
     - MANIFEST=fedora-standard
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-43-standard:{{revision}}
   - name: labels
     value:
-      - org.opencontainers.version=43
+      - org.opencontainers.image.version=43
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:8ff57394418faad7722c144f77494cf654007d60f63526357c007700bfc34edd
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +68,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-43-standard

.tekton/fedora-bootc-44-iot-pull-request.yaml

@@ -12,7 +12,7 @@ metadata:
       (
         (event == "pull_request" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-iot-pull-request.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-44-iot-pull-request.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -24,12 +24,13 @@ metadata:
         "iot.yaml".pathChanged() ||
         "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-iot
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-iot
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-iot-on-pull-request
+  name: fedora-bootc-44-iot-on-pull-request
 spec:
   params:
   - name: git-url
@@ -48,16 +49,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f
     - MANIFEST=fedora-iot
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-iot:on-pr-{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +69,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-iot

.tekton/fedora-bootc-44-iot-push.yaml

@@ -11,7 +11,7 @@ metadata:
       (
         (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-iot-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-44-iot-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -23,12 +23,13 @@ metadata:
         "iot.yaml".pathChanged() ||
         "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-iot
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-iot
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-iot-on-push
+  name: fedora-bootc-44-iot-on-push
 spec:
   params:
   - name: git-url
@@ -47,14 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-20260209.n.0@sha256:c947e0988e3f00078d3ff59eaff5ee18fe1d6fd39dc1fd15d268de0d074df45f
     - MANIFEST=fedora-iot
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-iot:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -62,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-iot

.tekton/fedora-bootc-44-minimal-plus-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-plus-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal-plus
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-plus-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
+    - MANIFEST=fedora-minimal-plus
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus

.tekton/fedora-bootc-44-minimal-plus-push.yaml

@@ -5,13 +5,13 @@ metadata:
     build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: |
       (
-        (event == "push" && target_branch.startsWith("renovate/"))
+        (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-minimal-plus-renovate-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-44-minimal-plus-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -21,13 +21,13 @@ metadata:
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal-plus
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal-plus
     pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-42-minimal-plus-renovate-on-push
+  name: fedora-bootc-44-minimal-plus-on-push
 spec:
   params:
   - name: git-url
@@ -38,6 +38,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -46,16 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
     - MANIFEST=fedora-minimal-plus
-  - name: image-expires-after
-    value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal-plus:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -63,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal-plus

.tekton/fedora-bootc-44-minimal-pull-request.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
+    - MANIFEST=fedora-minimal
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal

.tekton/fedora-bootc-44-minimal-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-minimal-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-minimal
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-minimal-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
+    - MANIFEST=fedora-minimal
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-minimal

.tekton/fedora-bootc-44-standard-pull-request.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-44-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-44-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
+    - MANIFEST=fedora-standard
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-standard

.tekton/fedora-bootc-44-standard-push.yaml

@@ -5,13 +5,13 @@ metadata:
     build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: |
       (
-        (event == "push" && target_branch.startsWith("renovate/"))
+        (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-standard-renovate-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-44-standard-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -23,13 +23,13 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-standard
+    appstudio.openshift.io/application: fedora-bootc-44
+    appstudio.openshift.io/component: fedora-bootc-44-standard
     pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-42-standard-renovate-on-push
+  name: fedora-bootc-44-standard-on-push
 spec:
   params:
   - name: git-url
@@ -40,6 +40,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -48,16 +50,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-44-compose:Fedora-44-updates-20260827.0@sha256:2f39b27325602d36383d0a320edad60de595e0bafd8983f0a2aeeeb87d7e3b9d
     - MANIFEST=fedora-standard
-  - name: image-expires-after
-    value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-standard:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-44-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=44
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +68,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-44-standard

.tekton/fedora-bootc-45-iot-pull-request.yaml

@@ -0,0 +1,73 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-45-iot-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/generic.yaml".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "iot.yaml".pathChanged() ||
+        "iot/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-iot
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-45-iot-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
+    - MANIFEST=fedora-iot
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-iot

.tekton/fedora-bootc-45-iot-push.yaml

@@ -5,13 +5,13 @@ metadata:
     build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: |
       (
-        (event == "push" && target_branch.startsWith("renovate/"))
+        (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-iot-renovate-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-iot-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -23,13 +23,13 @@ metadata:
         "iot.yaml".pathChanged() ||
         "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-iot
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-iot
     pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-42-iot-renovate-on-push
+  name: fedora-bootc-45-iot-on-push
 spec:
   params:
   - name: git-url
@@ -48,16 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260821.n.0@sha256:55b3460339b8c7aa0a2511e33c623310e17b16118764011059b2e8f35c5bedaf
     - MANIFEST=fedora-iot
-  - name: image-expires-after
-    value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-iot:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-iot

.tekton/fedora-bootc-45-minimal-plus-pull-request.yaml

@@ -12,7 +12,7 @@ metadata:
       (
         (event == "pull_request" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-minimal-plus-pull-request.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-minimal-plus-pull-request.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -22,12 +22,13 @@ metadata:
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal-plus
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal-plus
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-minimal-plus-on-pull-request
+  name: fedora-bootc-45-minimal-plus-on-pull-request
 spec:
   params:
   - name: git-url
@@ -38,6 +39,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -46,16 +49,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-minimal-plus
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal-plus:on-pr-{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -63,3 +69,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus

.tekton/fedora-bootc-45-minimal-plus-push.yaml

@@ -11,7 +11,7 @@ metadata:
       (
         (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-minimal-plus-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-minimal-plus-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -21,12 +21,13 @@ metadata:
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal-plus
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal-plus
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-minimal-plus-on-push
+  name: fedora-bootc-45-minimal-plus-on-push
 spec:
   params:
   - name: git-url
@@ -37,6 +38,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -45,14 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-minimal-plus
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal-plus:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -60,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal-plus

.tekton/fedora-bootc-45-minimal-pull-request.yaml

@@ -12,7 +12,7 @@ metadata:
       (
         (event == "pull_request" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-minimal-pull-request.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-minimal-pull-request.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -20,12 +20,13 @@ metadata:
         "minimal.yaml".pathChanged() ||
         "minimal/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-minimal-on-pull-request
+  name: fedora-bootc-45-minimal-on-pull-request
 spec:
   params:
   - name: git-url
@@ -36,6 +37,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -44,16 +47,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-minimal
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal:on-pr-{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -61,3 +67,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal

.tekton/fedora-bootc-45-minimal-push.yaml

@@ -11,7 +11,7 @@ metadata:
       (
         (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-minimal-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-minimal-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -19,12 +19,13 @@ metadata:
         "minimal.yaml".pathChanged() ||
         "minimal/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-minimal
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-minimal
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-minimal-on-push
+  name: fedora-bootc-45-minimal-on-push
 spec:
   params:
   - name: git-url
@@ -35,6 +36,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -43,14 +46,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-minimal
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-minimal:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -58,3 +64,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-minimal

.tekton/fedora-bootc-45-standard-pull-request.yaml

@@ -12,7 +12,7 @@ metadata:
       (
         (event == "pull_request" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-standard-pull-request.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-standard-pull-request.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -24,12 +24,13 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-standard
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-standard
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-standard-on-pull-request
+  name: fedora-bootc-45-standard-on-pull-request
 spec:
   params:
   - name: git-url
@@ -40,6 +41,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -48,16 +51,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-standard
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-standard:on-pr-{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +71,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-standard

.tekton/fedora-bootc-45-standard-push.yaml

@@ -11,7 +11,7 @@ metadata:
       (
         (event == "push" && target_branch == "main")
       ) && (
-        ".tekton/fedora-bootc-42-standard-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-45-standard-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
@@ -23,12 +23,13 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-42
-    appstudio.openshift.io/component: fedora-bootc-42-standard
+    appstudio.openshift.io/application: fedora-bootc-45
+    appstudio.openshift.io/component: fedora-bootc-45-standard
     pipelines.appstudio.openshift.io/type: build
-  name: fedora-bootc-42-standard-on-push
+  name: fedora-bootc-45-standard-on-push
 spec:
   params:
   - name: git-url
@@ -39,6 +40,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -47,14 +50,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-42-compose:Fedora-42-updates-testing-20250817.0@sha256:eec85001fee8028510c8b71efdded4a2fb553ce9d99850c60ddd8154b94ac457
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-45-compose:Fedora-45-20260826.n.0@sha256:ae4bedc5740a4e3f984f879c66ca026aa94ce8aec641a804f4ede0bc4ddd2c19
     - MANIFEST=fedora-standard
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-42-standard:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-45-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=45
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -62,3 +68,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-45-standard

.tekton/fedora-bootc-eln-standard-pull-request.yaml

@@ -0,0 +1,77 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "pull_request" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-eln-standard-pull-request.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-eln-standard-on-pull-request
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
+  - name: image-expires-after
+    value: 5d
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-eln-standard-push.yaml

@@ -0,0 +1,74 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      (
+        (event == "push" && target_branch == "main")
+      ) && (
+        ".tekton/fedora-bootc-eln-standard-push.yaml".pathChanged() ||
+        "Containerfile".pathChanged() ||
+        "bootc-base-imagectl".pathChanged() ||
+        "install-manifests".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
+        "minimal-plus.hidden.yaml".pathChanged() ||
+        "minimal-plus/***".pathChanged() ||
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
+  creationTimestamp: null
+  labels:
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
+    pipelines.appstudio.openshift.io/type: build
+  name: fedora-bootc-eln-standard-on-push
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: build-platforms
+    value:
+    - linux/amd64
+    - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
+  - name: dockerfile
+    value: Containerfile
+  - name: path-context
+    value: .
+  - name: privileged-nested
+    value: true
+  - name: build-args
+    value:
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
+  - name: output-image
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
+  pipelineRef:
+    params:
+    - name: bundle
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
+    - name: name
+      value: buildah-build-bootc-multi-platform-oci-ta
+    - name: kind
+      value: pipeline
+    resolver: bundles
+  timeouts:
+    pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-eln-standard-renovate-push.yaml

@@ -11,25 +11,28 @@ metadata:
       (
         (event == "push" && target_branch.startsWith("renovate/"))
       ) && (
-        ".tekton/fedora-bootc-rawhide-standard-renovate-push.yaml".pathChanged() ||
+        ".tekton/fedora-bootc-eln-standard-renovate-push.yaml".pathChanged() ||
         "Containerfile".pathChanged() ||
         "bootc-base-imagectl".pathChanged() ||
         "install-manifests".pathChanged() ||
-        "fedora-includes/generic.yaml".pathChanged() ||
-        "minimal.yaml".pathChanged() ||
-        "minimal/***".pathChanged() ||
+        "fedora-includes/eln.yaml".pathChanged() ||
+        "fedora-eln.yaml".pathChanged() ||
+        "eln/***".pathChanged() ||
+        "standard.yaml".pathChanged() ||
+        "standard/***".pathChanged() ||
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged() ||
-        "standard.yaml".pathChanged() ||
-        "standard/***".pathChanged()
-      )
+        "minimal.yaml".pathChanged() ||
+        "minimal/***".pathChanged()
+      ) && true == false
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: fedora-bootc-rawhide
-    appstudio.openshift.io/component: fedora-bootc-rawhide-standard
+    appstudio.openshift.io/application: fedora-bootc-eln
+    appstudio.openshift.io/component: fedora-bootc-eln-standard
     pipelines.appstudio.openshift.io/type: build
     release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-rawhide-standard-renovate-on-push
+  name: fedora-bootc-eln-standard-renovate-on-push
 spec:
   params:
   - name: git-url
@@ -40,6 +43,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -48,16 +53,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
-    - MANIFEST=fedora-standard
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-eln-compose:Fedora-eln-20260802.n.0@sha256:12f9b31a07ea270b65d5869a904fd1509c56b470df6c8f2586492fc0f006f213
+    - MANIFEST=fedora-eln
   - name: image-expires-after
     value: 5d
   - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:{{revision}}
+    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-eln-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=eln
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:c587d9400c89e21225fee03a080dcb0816919d39770b6af0cd6f990c7f8404b8
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +73,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-eln-standard

.tekton/fedora-bootc-rawhide-iot-pull-request.yaml

@@ -24,6 +24,7 @@ metadata:
         "iot.yaml".pathChanged() ||
         "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -48,16 +49,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c
     - MANIFEST=fedora-iot
   - name: image-expires-after
     value: 5d
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +69,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot

.tekton/fedora-bootc-rawhide-iot-push.yaml

@@ -23,6 +23,7 @@ metadata:
         "iot.yaml".pathChanged() ||
         "iot/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -47,14 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260209.n.0@sha256:a46fca7ce98fd36b5edb6ef96867de573479af69c645801cdc8c53ad6708114c
     - MANIFEST=fedora-iot
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:44d0e8034a19a1ced7817c117c9c15230def1f3e7941666a72a3e47919951f51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -62,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-iot

.tekton/fedora-bootc-rawhide-iot-renovate-push.yaml

@@ -1,67 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        (event == "push" && target_branch.startsWith("renovate/"))
-      ) && (
-        ".tekton/fedora-bootc-rawhide-iot-renovate-push.yaml".pathChanged() ||
-        "Containerfile".pathChanged() ||
-        "bootc-base-imagectl".pathChanged() ||
-        "install-manifests".pathChanged() ||
-        "fedora-includes/generic.yaml".pathChanged() ||
-        "minimal.yaml".pathChanged() ||
-        "minimal/***".pathChanged() ||
-        "minimal-plus.hidden.yaml".pathChanged() ||
-        "minimal-plus/***".pathChanged() ||
-        "iot.yaml".pathChanged() ||
-        "iot/***".pathChanged()
-      )
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: fedora-bootc-rawhide
-    appstudio.openshift.io/component: fedora-bootc-rawhide-iot
-    pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-rawhide-iot-renovate-on-push
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: build-platforms
-    value:
-    - linux/amd64
-    - linux/arm64
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: .
-  - name: privileged-nested
-    value: true
-  - name: build-args
-    value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
-    - MANIFEST=fedora-iot
-  - name: image-expires-after
-    value: 5d
-  - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-iot:{{revision}}
-  pipelineRef:
-    params:
-    - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
-    - name: name
-      value: buildah-build-bootc-multi-platform-oci-ta
-    - name: kind
-      value: pipeline
-    resolver: bundles
-  timeouts:
-    pipeline: 6h

.tekton/fedora-bootc-rawhide-minimal-plus-pull-request.yaml

@@ -22,6 +22,7 @@ metadata:
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -38,6 +39,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -46,16 +49,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-minimal-plus
   - name: image-expires-after
     value: 5d
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -63,3 +69,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus

.tekton/fedora-bootc-rawhide-minimal-plus-push.yaml

@@ -21,6 +21,7 @@ metadata:
         "minimal-plus.hidden.yaml".pathChanged() ||
         "minimal-plus/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -37,6 +38,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -45,14 +48,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-minimal-plus
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -60,3 +66,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal-plus

.tekton/fedora-bootc-rawhide-minimal-plus-renovate-push.yaml

@@ -1,65 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        (event == "push" && target_branch.startsWith("renovate/"))
-      ) && (
-        ".tekton/fedora-bootc-rawhide-minimal-plus-renovate-push.yaml".pathChanged() ||
-        "Containerfile".pathChanged() ||
-        "bootc-base-imagectl".pathChanged() ||
-        "install-manifests".pathChanged() ||
-        "fedora-includes/generic.yaml".pathChanged() ||
-        "minimal.yaml".pathChanged() ||
-        "minimal/***".pathChanged() ||
-        "minimal-plus.hidden.yaml".pathChanged() ||
-        "minimal-plus/***".pathChanged()
-      )
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: fedora-bootc-rawhide
-    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal-plus
-    pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-rawhide-minimal-plus-renovate-on-push
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: build-platforms
-    value:
-    - linux/amd64
-    - linux/arm64
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: .
-  - name: privileged-nested
-    value: true
-  - name: build-args
-    value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
-    - MANIFEST=fedora-minimal-plus
-  - name: image-expires-after
-    value: 5d
-  - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal-plus:{{revision}}
-  pipelineRef:
-    params:
-    - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
-    - name: name
-      value: buildah-build-bootc-multi-platform-oci-ta
-    - name: kind
-      value: pipeline
-    resolver: bundles
-  timeouts:
-    pipeline: 6h

.tekton/fedora-bootc-rawhide-minimal-pull-request.yaml

@@ -20,6 +20,7 @@ metadata:
         "minimal.yaml".pathChanged() ||
         "minimal/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -36,6 +37,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -44,16 +47,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-minimal
   - name: image-expires-after
     value: 5d
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -61,3 +67,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal

.tekton/fedora-bootc-rawhide-minimal-push.yaml

@@ -19,6 +19,7 @@ metadata:
         "minimal.yaml".pathChanged() ||
         "minimal/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -35,6 +36,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -43,14 +46,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-minimal
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -58,3 +64,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-minimal

.tekton/fedora-bootc-rawhide-minimal-renovate-push.yaml

@@ -1,63 +0,0 @@
-apiVersion: tekton.dev/v1
-kind: PipelineRun
-metadata:
-  annotations:
-    build.appstudio.openshift.io/repo: https://gitlab.com/fedora/bootc/base-images/-/tree/{{revision}}
-    build.appstudio.redhat.com/commit_sha: '{{revision}}'
-    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
-    pipelinesascode.tekton.dev/cancel-in-progress: "true"
-    pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      (
-        (event == "push" && target_branch.startsWith("renovate/"))
-      ) && (
-        ".tekton/fedora-bootc-rawhide-minimal-renovate-push.yaml".pathChanged() ||
-        "Containerfile".pathChanged() ||
-        "bootc-base-imagectl".pathChanged() ||
-        "install-manifests".pathChanged() ||
-        "fedora-includes/generic.yaml".pathChanged() ||
-        "minimal.yaml".pathChanged() ||
-        "minimal/***".pathChanged()
-      )
-  creationTimestamp: null
-  labels:
-    appstudio.openshift.io/application: fedora-bootc-rawhide
-    appstudio.openshift.io/component: fedora-bootc-rawhide-minimal
-    pipelines.appstudio.openshift.io/type: build
-    release.appstudio.openshift.io/auto-release: "false"
-  name: fedora-bootc-rawhide-minimal-renovate-on-push
-spec:
-  params:
-  - name: git-url
-    value: '{{source_url}}'
-  - name: revision
-    value: '{{revision}}'
-  - name: build-platforms
-    value:
-    - linux/amd64
-    - linux/arm64
-  - name: dockerfile
-    value: Containerfile
-  - name: path-context
-    value: .
-  - name: privileged-nested
-    value: true
-  - name: build-args
-    value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
-    - MANIFEST=fedora-minimal
-  - name: image-expires-after
-    value: 5d
-  - name: output-image
-    value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-minimal:{{revision}}
-  pipelineRef:
-    params:
-    - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
-    - name: name
-      value: buildah-build-bootc-multi-platform-oci-ta
-    - name: kind
-      value: pipeline
-    resolver: bundles
-  timeouts:
-    pipeline: 6h

.tekton/fedora-bootc-rawhide-standard-pull-request.yaml

@@ -24,6 +24,7 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -40,6 +41,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -48,16 +51,19 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-standard
   - name: image-expires-after
     value: 5d
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:on-pr-{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -65,3 +71,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard

.tekton/fedora-bootc-rawhide-standard-push.yaml

@@ -23,6 +23,7 @@ metadata:
         "standard.yaml".pathChanged() ||
         "standard/***".pathChanged()
       )
+    test.appstudio.openshift.io/comment_strategy: "disable_all"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: fedora-bootc-rawhide
@@ -39,6 +40,8 @@ spec:
     value:
     - linux/amd64
     - linux/arm64
+    - linux/ppc64le
+    - linux/s390x
   - name: dockerfile
     value: Containerfile
   - name: path-context
@@ -47,14 +50,17 @@ spec:
     value: true
   - name: build-args
     value:
-    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20250812.n.0@sha256:a843b4d364f0784a99a7a09a9dd062cce312421f16ab12bdbf98078453ab7c62
+    - REPOS_IMAGE=quay.io/bootc-devel/fedora-bootc-rawhide-compose:Fedora-Rawhide-20260827.n.0@sha256:fcfd7db08ce2a2bf993fb11a15d21490b06017d879ece5d62e5d797107e3f9ab
     - MANIFEST=fedora-standard
   - name: output-image
     value: quay.io/konflux-fedora/bootc-tenant/fedora-bootc-rawhide-standard:{{revision}}
+  - name: labels
+    value:
+      - org.opencontainers.image.version=46
   pipelineRef:
     params:
     - name: bundle
-      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:e44129e1977e312ae5d0d080fe88a57ea094c9ebdbdcdb9eeef5dd4378c92c63
+      value: quay.io/bootc-devel/tekton-catalog/pipeline-buildah-build-bootc-multi-platform-oci-ta@sha256:9eb1decf91e0d678a613f7d4767091c05b37bec8a02163087254328f1e848c51
     - name: name
       value: buildah-build-bootc-multi-platform-oci-ta
     - name: kind
@@ -62,3 +68,5 @@ spec:
     resolver: bundles
   timeouts:
     pipeline: 6h
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-fedora-bootc-rawhide-standard

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing to fedora-bootc base images
+
+## Prerequisites
+
+Everything revolves around our Containerfile, but there's
+a high level wrapper in `Justfile` which you should use.
+So installing `podman` (or `buildah`) and `just` are strongly recommended.
+
+## Building and testing
+
+Run `just --list` to see available targets and `just show-config` to
+see current settings. The Justfile is also what CI invokes, so anything
+you run locally is the same as what runs in the pipeline.
+
+Configuration is via environment variables — see the comments at the
+top of the `Justfile` for the full list. For example:
+
+```bash
+just build                                    # defaults
+TIER=minimal just build                       # different tier
+FEDORA_VERSION=43 just test                   # different Fedora version
+BUILDER=podman just build                     # use podman instead of buildah
+just ci                                       # full CI run (validate + test all tiers)
+```
+
+## Building a split image
+
+The Containerfile supports building a split (content-based layered)
+image using [chunkah](https://github.com/coreos/chunkah) via the
+`chunked` build target:
+
+```bash
+just build --chunkah
+```
+
+Extra arguments can be passed to chunkah via the `CHUNKAH_ARGS` build
+arg (e.g. `BUILDER_EXTRA='--build-arg CHUNKAH_ARGS="--max-layers 128"' just build --chunkah`).

Containerfile

@@ -2,9 +2,11 @@
 # nested containerization, so you must build with e.g.
 # podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
 
-# NOTE: This container build will output a single giant layer. It is strongly recommended
-# to run the "rechunker" on the output of this build, see
-# https://coreos.github.io/rpm-ostree/experimental-build-chunked-oci/
+# NOTE: This container build will output a single giant layer. You can either
+# run the "rechunker" on the output of this build (see bootc-base-imagectl.md),
+# or build the split version directly with `just build --chunkah`
+# (or if using podman/buildah directly, add `--build-arg FINAL=chunked
+# --skip-unused-stages=false -v $PWD:/run/src`).
 
 # Override this repos container to control the base image package versions. For
 # example, podman build --from=quay.io/fedora/fedora:41 will get you a system
@@ -14,8 +16,10 @@
 # since konflux doesn't yet support --from.
 ARG REPOS_IMAGE=quay.io/fedora/fedora:rawhide
 ARG BUILDER_IMAGE=quay.io/fedora/fedora:rawhide
-FROM $REPOS_IMAGE as repos
+# Either 'unchunked' or 'chunked'. Determines whether we take the chunkah path.
+ARG FINAL=unchunked
 
+FROM $REPOS_IMAGE as repos
 # BOOTSTRAPPING: This can be any image that has rpm-ostree, selinux-policy-targeted
 #                and python3 (for bootc-base-imagectl).
 FROM $BUILDER_IMAGE as builder
@@ -26,6 +30,15 @@ ARG MANIFEST=fedora-standard
 # So copy the source, and delete the hardcoded ones in git, and use the container base
 # image ones.  We can drop the ones commited to git when we hard switch to Containerfile.
 COPY . /src
+# Avoid umask/permission leakage from the outer environment; ref e.g.
+# - https://github.com/coreos/coreos-assembler/pull/4277
+# - https://gitlab.com/fedora/bootc/base-images/-/merge_requests/254
+# This invocation preserves only the executable bit, and specifically we want to remove:
+# - setuid/setgid
+# - world writability
+# NOTE: This adds world-readability, which is what we intend here as all the content
+# is public; there's no secrets in our container build.
+RUN chmod -R a=rX,u+w /src
 WORKDIR /src
 RUN rm -vf /src/*.repo
 RUN --mount=type=cache,rw,id=bootc-base-image-cache,target=/cache \
@@ -45,12 +58,19 @@ install -m 0755 -t /usr/libexec ./bootc-base-imagectl
 EORUN
 
 # This pulls in the rootfs generated in the previous step
-FROM scratch
+FROM scratch AS unchunked
 COPY --from=builder /target-rootfs/ /
-# Note in practice this won't be right in a cross build, so we don't
-# set it here. This placeholder is just to note that it *should* be set
-# by the larger build system (e.g. Konflux).
-LABEL org.opencontainers.image.version 43
+
+FROM builder AS rechunker
+RUN dnf -y install chunkah
+ARG CHUNKAH_ARGS=""
+RUN --mount=from=unchunked,src=/,target=/chunkah,ro \
+    --mount=type=bind,target=/run/src,rw \
+    /usr/libexec/bootc-base-imagectl rechunk --chunkah ${CHUNKAH_ARGS} \
+    > /run/src/out.ociarchive
+FROM oci-archive:out.ociarchive AS chunked
+
+FROM $FINAL
 LABEL containers.bootc 1
 # This is an ad-hoc way for us to reference bootc-image-builder in
 # a way that in theory client tooling can inspect and find. Today

Justfile

@@ -0,0 +1,91 @@
+# Development entry point for fedora-bootc base images.
+# Run `just --list` to see available targets.
+# See CONTRIBUTING.md for more information.
+# --------------------------------------------------------------------
+
+# Content tier: standard (default), minimal, minimal-plus, iot
+tier := env("TIER", "standard")
+# Fedora version: rawhide (default), 43, 44, etc.
+fedora_version := env("FEDORA_VERSION", "rawhide")
+# Container build tool
+builder := env("BUILDER", "buildah")
+# Extra arguments for the builder
+builder_extra := env("BUILDER_EXTRA", "")
+# Output image name
+image := "localhost/fedora-bootc"
+
+# These are required for the nested containerization used by rpm-ostree
+# inside the Containerfile.
+priv_args := "--security-opt=label=disable --cap-add=all --device /dev/fuse"
+
+# Internal
+_build_cmd := builder + " build"
+_tag := image + if tier == "standard" { "" } else { ":" + tier }
+_base_image := "quay.io/fedora/fedora:" + fedora_version
+_version_args := if fedora_version == "rawhide" { "" } else { "--build-arg=REPOS_IMAGE=" + _base_image + " --build-arg=BUILDER_IMAGE=" + _base_image }
+_chunkah_args := "--build-arg FINAL=chunked --skip-unused-stages=false -v " + justfile_directory() + ":/run/src"
+
+# ============================================================================
+# Core targets
+# ============================================================================
+
+# Build the container image
+[group('core')]
+[arg("chunkah", long, value="true")]
+build chunkah="": _check-tier
+    {{_build_cmd}} -f Containerfile --no-cache \
+        -t {{_tag}} {{priv_args}} \
+        {{_version_args}} {{builder_extra}} \
+        {{if chunkah != "" { _chunkah_args } else { "" }}} \
+        --build-arg=MANIFEST=fedora-{{tier}} .
+
+# Build and test
+[group('core')]
+test: build
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    {{_build_cmd}} -f tests/rootfs/Dockerfile -t localhost/test --from {{_tag}} tests/rootfs
+    # The derive and sysusers tests only apply to the standard tier
+    if [ "{{tier}}" = "standard" ]; then
+        {{_build_cmd}} -f tests/Containerfile.test-derive --no-cache \
+            -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests
+        {{_build_cmd}} -f tests/Containerfile.test-sysusers --no-cache \
+            -t localhost/fedora-bootc-derived {{priv_args}} {{builder_extra}} tests
+    fi
+
+# Run validation checks (whitespace, shellcheck, YAML)
+[group('core')]
+validate:
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ./ci/find-whitespace
+    ./ci/shellcheck
+    ./ci/validate
+
+# Show current configuration
+[group('core')]
+show-config:
+    @echo "TIER={{tier}}"
+    @echo "FEDORA_VERSION={{fedora_version}}"
+    @echo "BUILDER={{builder}}"
+    @echo "image tag={{_tag}}"
+    @echo "base image={{_base_image}}"
+
+# ============================================================================
+# CI targets (used by .gitlab-ci.yml)
+# ============================================================================
+
+# Run all CI checks: validate + build and test all tiers
+[group('ci')]
+ci: validate
+    just tier=minimal test
+    just tier=minimal-plus test
+    just tier=standard test
+
+# ============================================================================
+# Internal
+# ============================================================================
+
+[private]
+_check-tier:
+    @test -f fedora-{{tier}}.yaml || { echo "error: unknown tier '{{tier}}' (valid: standard, minimal, minimal-plus, iot)"; exit 1; }

README.md

@@ -14,49 +14,28 @@ delivery format for base operating system updates.
 The current default user experience is to build *layered* images on top of the official
 binary base images produced and tested by this project. See the documentation[5] for more info.
 
-You can build custom base images by forking this repository; however,
-<https://gitlab.com/fedora/bootc/tracker/-/issues/32> tracks a more supportable
-mechanism that is not simply forking. For more information see[6].
+If you want total control over the image, you don't need to fork this repository.
+Instead, you can use the existing container as a "builder" to make new images.
+For more information, see the documentation[6].
 
-## Build process
+## Contributing
 
-Building the images in this repo can be done with `podman build`, but
-note the build process uses a special podman-ecosystem specific mechanism
-to create fully custom images while inside a `Containerfile`.
-You need to enable some privileges as nested containerization is required.
-
-```bash
-podman build --security-opt=label=disable --cap-add=all \
-  --device /dev/fuse -t localhost/fedora-bootc .
-```
-
-See the `Containerfile` for more details. This builds the default `standard` image.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the full development workflow.
 
 ## Fedora versions
 
 By default, the base images are built for Fedora rawhide. To build against a
-different Fedora version, you can override the `FROM` image used to obtain the
-Fedora repos and dnf variables. E.g.:
+different Fedora version:
 
 ```bash
-podman build --from quay.io/fedora/fedora:41 ...
+FEDORA_VERSION=43 just build
 ```
 
-### Deriving
+## Content sets/tiers
 
-You are of course also free to fork, customize, and build base images yourself.
-See this page[6] of the documentation for more information.
-
-## Tiers
-
-At the current time, there is just one reference base image published
-to the registry. Internally the content set is split up somewhat
-into "tiers", but this is an internal implementation detail and may change
-at any time.
-
-It is planned to rework and improve this in the future, especially
-to support smaller custom images. For more on this, see
-[this tracker issue](https://gitlab.com/fedora/bootc/tracker/-/issues/32).
+Documentation above referenced the scratch[6] flow,
+but there is also a `minimal-plus` that is not exposed as a stable
+interface, but may be used by other images in Fedora.
 
 - **standard**: This image is the default, what is published as
   <https://quay.io/repository/fedora/fedora-bootc>
@@ -68,6 +47,8 @@ to support smaller custom images. For more on this, see
 
 **standard** inherits from **minimal-plus** and **minimal-plus** in turn inherit from **minimal**.
 
+- **eln** (manifest `fedora-eln`): Standard base image for Enterprise Linux Next (ELN). Uses distro `fedora` and inherits from standard; built with ELN repos. The image produced by this manifest is published as **fedora-eln**.
+
 All non-trivial changes to **minimal** and **minimal-plus** should be ACKed by at least
 one stakeholder of each Fedora variant WGs.
 
@@ -77,8 +58,8 @@ one stakeholder of each Fedora variant WGs.
 
 | Version | standard | minimal | minimal-plus |
 | ------- | -------- | ------- | ------------ |
-| Rawhide | quay.io/fedora-testing/fedora-bootc:rawhide-standard | quay.io/fedora-testing/fedora-bootc:rawhide-minimal | quay.io/fedora-testing/fedora-bootc:rawhide-minimal-plus |
-| Fedora 42 | quay.io/fedora-testing/fedora-bootc:42-standard | quay.io/fedora-testing/fedora-bootc:42-minimal | quay.io/fedora-testing/fedora-bootc:42-minimal-plus |
+| Rawhide | quay.io/bootc-devel/fedora-bootc-rawhide-standard | quay.io/bootc-devel/fedora-bootc-rawhide-minimal | quay.io/bootc-devel/fedora-bootc-rawhide-minimal-plus |
+| Fedora 43 | quay.io/bootc-devel/fedora-bootc-43-standard | quay.io/bootc-devel/fedora-bootc-43-minimal | quay.io/bootc-devel/fedora-bootc-43-minimal-plus |
 
 ## More information
 
@@ -96,4 +77,4 @@ Documentation: <https://docs.fedoraproject.org/en-US/bootc/>
 [3]: https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit
 [4]: https://pre-commit.com/
 [5]: https://docs.fedoraproject.org/en-US/bootc/building-containers/
-[6]: https://docs.fedoraproject.org/en-US/bootc/building-custom-base/
+[6]: https://docs.fedoraproject.org/en-US/bootc/building-from-scratch/

RELEASE.md

@@ -0,0 +1,306 @@
+# Fedora Base Bootc Container Publishing
+
+## Overview
+
+The `fedora-base-bootc` image is published via **two parallel mechanisms**:
+
+1. **Pungi-IoT + cloud-image-uploader** → `quay.io/fedora/fedora-bootc` (Production)
+2. **Konflux** → `quay.io/bootc-devel/fedora-bootc-*` (Development)
+
+The goal is to move to Konflux and deprecate the Pungi-IoT mechanism.
+
+---
+
+## Part 1: Production Flow (Pungi-IoT)
+
+### Repositories
+
+| Repository | URL | Purpose |
+|------------|-----|---------|
+| base-images | https://pagure.io/fedora-iot/base-images | Image definition (treefiles, packages) |
+| pungi-iot | https://pagure.io/fedora-iot/pungi-iot | Compose configuration |
+| cloud-image-uploader | https://pagure.io/cloud-image-uploader | Uploads images to registries |
+| ansible | https://pagure.io/fedora-infra/ansible | Infrastructure deployment |
+
+### Compose Cadence
+
+| Compose | Schedule | Host |
+|---------|----------|------|
+| IoT Rawhide | **Nightly** | compose-iot01.rdu3.fedoraproject.org |
+
+### Flow
+
+```
+┌──────────────────────────────────────────────────────────────────┐
+│ 1. IoT COMPOSE (compose-iot01.rdu3.fedoraproject.org)            │
+│    Trigger: Daily cron                                           │
+│    Script: pungi-iot/nightly.sh                                  │
+│    Config: pungi-iot/fedora-iot.conf                             │
+│    Treefile: base-images/fedora-rawhide.yaml                     │
+│                                                                  │
+│    Output: /mnt/koji/compose/iot/<compose-id>/compose/           │
+│            └── <arch>/images/Fedora-base-bootc-<ver>.ociarchive  │
+└──────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼ (fedora-messaging)
+┌──────────────────────────────────────────────────────────────────┐
+│ 2. CLOUD-IMAGE-UPLOADER (OpenShift)                              │
+│                                                                  │
+│    Listens: org.fedoraproject.prod.pungi.compose.status.change   │
+│    Maps: subvariant "base" → repository "fedora-bootc"           │
+│    Pushes via skopeo to configured registries                    │
+└──────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────┐
+│ 3. CONTAINER REGISTRIES                                          │
+│                                                                  │
+│    - quay.io/fedora/fedora-bootc                                 │
+│    - registry.fedoraproject.org/fedora-bootc                     │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+### Key Configuration Files
+
+#### 1. Compose: Image Build Definition
+
+**File:** `pungi-iot/fedora-iot.conf` (lines 276-300)
+
+```python
+ostree_container = {
+    "^IoT$": [
+        {
+            "config_url": "https://pagure.io/fedora-iot/base-images",
+            "config_branch": "main",
+            "treefile": "fedora-rawhide.yaml",
+            "arches": ["x86_64", "aarch64", "ppc64le", "s390x"],
+            "subvariant": "base",           # <-- Used for mapping
+            "name": "Fedora-base-bootc",
+        },
+    ]
+}
+```
+
+#### 2. Uploader: Subvariant to Repository Mapping
+
+**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml`
+
+```toml
+[consumer_config.container.repos]
+base = "fedora-bootc"    # subvariant "base" → repo "fedora-bootc"
+IoT = "fedora-iot"
+```
+
+#### 3. Uploader: Target Registries
+
+**File:** `ansible/roles/openshift-apps/cloud-image-uploader/templates/config.toml`
+
+```toml
+[[consumer_config.container.registries]]
+url = "registry.fedoraproject.org"
+
+[[consumer_config.container.registries]]
+url = "quay.io/fedora"
+```
+
+### Tags Applied
+
+| Compose Type | Tags |
+|--------------|------|
+| Rawhide | `<version>`, `rawhide` |
+| Current Stable | `<version>`, `latest` |
+| Branched | `<version>` |
+
+### Common Changes (Production)
+
+| Task | Where to Change |
+|------|-----------------|
+| Add/remove packages from image | `base-images/` repo (manifest YAML files) |
+| Change architectures | `pungi-iot/fedora-iot.conf` → `ostree_container.arches` |
+| Add new registry | `ansible/.../cloud-image-uploader/templates/config.toml` → `registries` |
+| Change repository name | `ansible/.../cloud-image-uploader/templates/config.toml` → `repos` mapping |
+| Change tagging logic | `cloud-image-uploader/.../handler.py` |
+
+---
+
+## Part 2: Development Flow (Konflux)
+
+### Repositories
+
+| Repository | URL | Purpose |
+|------------|-----|---------|
+| compose-images | https://gitlab.com/fedora/bootc/compose-images | Generates images containing RPMs used by base-images |
+| base-images | https://gitlab.com/fedora/bootc/base-images | Image definitions + Tekton build pipelines |
+| tekton-catalog | https://gitlab.com/fedora/bootc/tekton-catalog | Release pipeline definitions |
+| tenants-config | https://gitlab.com/fedora/infrastructure/konflux/tenants-config | Konflux tenant configuration |
+
+### Flow
+
+```
+┌──────────────────────────────────────────────────────────────────────┐
+│ 0. COMPOSE IMAGES                                                    │
+│                                                                      │
+│    Source: gitlab.com/fedora/bootc/compose-images                    │
+│    Output: quay.io/bootc-devel/fedora-bootc-<version>-compose        │
+│                                                                      │
+│    These images contain the RPM repositories used by base-images.    │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│ 1. BUILD (triggered by git push or Renovate)                         │
+│                                                                      │
+│    Source: gitlab.com/fedora/bootc/base-images                       │
+│    Pipeline: .tekton/fedora-bootc-*-push.yaml                        │
+│    Input: REPOS_IMAGE from compose-images                            │
+│                                                                      │
+│    Output: quay.io/konflux-fedora/bootc-tenant/                      │
+│            fedora-bootc-<version>-<tier>:{{revision}}                │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼ (Konflux creates Snapshot)
+┌──────────────────────────────────────────────────────────────────────┐
+│ 2. RELEASE (auto-triggered by ReleasePlan)                           │
+│                                                                      │
+│    ReleasePlan: release-fedora-bootc-to-quay-io                      │
+│    Pipeline: push-to-external-registry                               │
+└──────────────────────────────────────────────────────────────────────┘
+                              │
+                              ▼
+┌──────────────────────────────────────────────────────────────────────┐
+│ 3. OUTPUT                                                            │
+│                                                                      │
+│    quay.io/bootc-devel/fedora-bootc-<version>-standard               │
+│    quay.io/bootc-devel/fedora-bootc-<version>-minimal                │
+│    quay.io/bootc-devel/fedora-bootc-<version>-minimal-plus           │
+│    quay.io/bootc-devel/fedora-bootc-<version>-iot                    │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### Image Tiers
+
+See the [README](README.md) for details on the different image tiers (minimal, minimal-plus, standard, iot).
+
+### Renovate Automation
+
+Renovate automatically updates dependencies. See the description comments in [renovate.json](renovate.json) for scheduling and configuration details.
+
+### Common Changes (Development)
+
+| Task | Where to Change |
+|------|-----------------|
+| Add new component | `tenants-config/.../components/` |
+| Change destination registry | `tenants-config/.../releaseplans/release-to-quay-io/` |
+| Modify release pipeline | `tekton-catalog/pipelines/push-to-external-registry/` |
+| Add new Fedora version | See [Adding a New Fedora Version](#adding-a-new-fedora-version-to-konflux) |
+| Remove EOL Fedora version | See [Removing an EOL Fedora Version](#removing-an-eol-fedora-version-from-konflux) |
+
+---
+
+## Part 3: Managing Fedora Versions in Konflux
+
+This section describes how to add a new Fedora version or remove an EOL version from Konflux.
+
+**Example scenario:** Fedora 42 is going EOL and needs to be removed. Rawhide (F45) is branching, so we need to add Fedora 44 as the new branched release.
+
+### Adding a New Fedora Version to Konflux
+
+#### Step 1: Add Release to compose-images Repo
+
+**Repository:** https://gitlab.com/fedora/bootc/compose-images
+
+Add the new release definition so that compose images are generated for the new version. This must be done first as base-images depends on these compose images.
+
+1. Create new Tekton pipelines in `.tekton/` for the new version (copy from existing version)
+2. Update `RELEASEVER`, `COMPOSE_BRANCHED`, and labels in the new pipelines
+3. Add a package rule for the new version in `renovate.json`
+
+See [MR !187](https://gitlab.com/fedora/bootc/compose-images/-/merge_requests/187) for reference (F44 addition).
+
+#### Step 2: Create Tekton Pipelines (base-images repo)
+
+**Repository:** https://gitlab.com/fedora/bootc/base-images
+
+Copy the current release pipelines to the new version and update rawhide for the next version.
+
+See the code snippets used for F44 in [MR !363 comment](https://gitlab.com/fedora/bootc/base-images/-/merge_requests/363#note_3071603283) for reference.
+
+#### Step 3: Update Renovate Configuration (base-images repo)
+
+Add package rules for the new version in `renovate.json`. See the existing rules for other versions as a template.
+
+#### Step 4: Create Tenant Configuration (tenants-config repo)
+
+**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config
+
+```bash
+cd clusters/kflux-fedora-01/tenants/bootc-tenant/applications/fedora-bootc/
+NEW_RELEASE=44
+
+# Copy from rawhide
+cp -r rawhide $NEW_RELEASE
+
+# Update version references
+sed -i "s/compose-rawhide-id/compose-branched-id/" $NEW_RELEASE/releaseplans/release-to-quay-io/kustomization.yaml
+find "${NEW_RELEASE}/" -type f | xargs sed -i "s/rawhide/$NEW_RELEASE/g"
+```
+
+
+Add the new version to `fedora-bootc/kustomization.yaml`:
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - "rawhide"
+  - "44"      # <-- Add new version
+  - "43"
+  - "42"
+```
+
+See [MR !237](https://gitlab.com/fedora/infrastructure/konflux/tenants-config/-/merge_requests/237) for reference (F45 addition).
+
+### Removing an EOL Fedora Version from Konflux
+
+When a Fedora version reaches EOL (e.g., F42), follow these steps:
+
+#### Step 1: Remove Tekton Pipelines (base-images repo)
+
+**Repository:** https://gitlab.com/fedora/bootc/base-images
+
+```bash
+cd .tekton/
+git rm fedora-bootc-42-*.yaml
+```
+
+#### Step 2: Remove Renovate Rules (base-images repo)
+
+Remove the package rules for F42 from `renovate.json` (the two blocks matching `fedora-bootc-42-*`).
+
+#### Step 3: Remove Tenant Configuration (tenants-config repo)
+
+**Repository:** https://gitlab.com/fedora/infrastructure/konflux/tenants-config
+
+Remove the version from `fedora-bootc/kustomization.yaml` and delete the directory:
+
+```bash
+cd cluster/kfluxfedorap01/bootc-tenant/applications/fedora-bootc/
+
+# Edit kustomization.yaml to remove "42" from resources
+
+# Delete the version directory
+rm -rf 42/
+```
+
+#### Step 4: Remove from compose-images Repo
+
+**Repository:** https://gitlab.com/fedora/bootc/compose-images
+
+Remove the EOL release pipelines and renovate rules:
+
+```bash
+cd .tekton/
+git rm fedora-bootc-42-compose-*.yaml
+```
+
+Also remove the package rule for F42 from `renovate.json` (the block matching `fedora-42-.*-compose`).

bootc-base-imagectl

@@ -11,6 +11,7 @@ import subprocess
 import sys
 import tempfile
 
+ARCH = os.uname().machine
 MANIFESTDIR = 'usr/share/doc/bootc-base-imagectl/manifests'
 
 def run_build_rootfs(args):
@@ -36,6 +37,10 @@ def run_build_rootfs(args):
         additional_pkgs = [shlex.quote(p) for p in set(args.install)]
         if len(additional_pkgs) > 0:
             override_manifest['packages'] = list(additional_pkgs)
+    if args.exclude:
+        exclude_pkgs = [shlex.quote(p) for p in set(args.exclude)]
+        if len(exclude_pkgs) > 0:
+            override_manifest['exclude-packages'] = list(exclude_pkgs)
     if args.add_dir:
         tmp_ostree_repo = tempfile.mkdtemp(dir='/var/tmp')
         subprocess.check_call(['ostree', 'init', '--repo', tmp_ostree_repo, '--mode=bare'])
@@ -43,14 +48,21 @@ def run_build_rootfs(args):
         override_manifest['ostree-override-layers'] = []
 
         for dir in args.add_dir:
+            print(f"Processing --add-dir for {dir}")
             base = os.path.basename(dir)
             abs = os.path.realpath(dir)
+            if not os.path.exists(abs):
+                raise Exception(f"add dir directory not found: {abs}")
             # capture output to hide commit digest printed
             subprocess.check_output(['ostree', 'commit', '--repo', tmp_ostree_repo, '-b', f'overlay/{base}', abs,
                                      '--owner-uid=0', '--owner-gid=0', '--no-xattrs', '--mode-ro-executables'])
             override_manifest['ostree-override-layers'].append(f'overlay/{base}')
     if args.no_docs:
         override_manifest['documentation'] = False
+    if args.recommends:
+        override_manifest['recommends'] = True
+    if args.no_initramfs:
+        override_manifest['no-initramfs'] = True
     if args.sysusers:
         override_manifest['sysusers'] = 'compose-forced'
         passwd_mode = 'nobody' if args.nobody_99 else 'none'
@@ -66,6 +78,21 @@ def run_build_rootfs(args):
         tmp_manifest.close()
         manifest_path = tmp_manifest.name
 
+    tmp_lockfile = None
+    if args.lock:
+        lockfile = {'packages': {}}
+        for nevra in args.lock:
+            # we support passing either a NEVRA or a NEVR
+            name, ev, r_or_ra = nevra.rsplit('-', 2)
+            evr_or_evra = f'{ev}-{r_or_ra}'
+            field = 'evra' if r_or_ra.endswith(('.noarch', f'.{ARCH}')) else 'evr'
+            lockfile['packages'][name] = {field: evr_or_evra}
+
+        tmp_lockfile = tempfile.NamedTemporaryFile(mode='w', encoding='utf-8', suffix='.json', delete=False)
+        json.dump(lockfile, tmp_lockfile)
+        tmp_lockfile.close()
+        rpmostree_argv.append(f"--lockfile={tmp_lockfile.name}")
+
     try:
         if args.cachedir != "":
             rpmostree_argv.append(f"--cachedir={args.cachedir}")
@@ -94,6 +121,8 @@ def run_build_rootfs(args):
         print(f"Error executing command: {e}")
         sys.exit(1)
     finally:
+        if tmp_lockfile is not None:
+            os.unlink(tmp_lockfile.name)
         if tmp_manifest is not None:
             os.unlink(tmp_manifest.name)
         if tmp_ostree_repo:
@@ -113,22 +142,40 @@ def run_build_rootfs(args):
             shutil.copy('/' + f, dst)
 
 def run_rechunk(args):
-    argv = [
-            'rpm-ostree',
-            'experimental',
-            'compose',
-            'build-chunked-oci']
-    if args.max_layers is not None:
-        argv.append(f"--max-layers={args.max_layers}")
-    argv.extend(['--bootc',
-            '--format-version=1',
-            f'--from={args.from_image}',
-            f'--output=containers-storage:{args.to_image}'])
-    try:
-        subprocess.run(argv, check=True)
-    except subprocess.CalledProcessError as e:
-        print(f"Error executing command: {e}")
-        sys.exit(1)
+    if args.chunkah:
+        argv = ['chunkah', 'build', '--rootfs=/chunkah']
+        if args.max_layers is not None:
+            argv.append(f"--max-layers={args.max_layers}")
+        # Strip OSTree data and labels for bootc compatibility; see
+        # https://github.com/coreos/chunkah#compatibility-with-bootable-bootc-images
+        argv.extend(['--prune', '/sysroot/',
+                '--label', 'ostree.commit-',
+                '--label', 'ostree.final-diffid-'])
+        try:
+            subprocess.run(argv, check=True)
+        except subprocess.CalledProcessError as e:
+            print(f"Error executing command: {e}", file=sys.stderr)
+            sys.exit(1)
+    else:
+        if not args.from_image or not args.to_image:
+            print("Error: from_image and to_image are required when not using --chunkah", file=sys.stderr)
+            sys.exit(1)
+        argv = [
+                'rpm-ostree',
+                'experimental',
+                'compose',
+                'build-chunked-oci']
+        if args.max_layers is not None:
+            argv.append(f"--max-layers={args.max_layers}")
+        argv.extend(['--bootc',
+                '--format-version=1',
+                f'--from={args.from_image}',
+                f'--output=containers-storage:{args.to_image}'])
+        try:
+            subprocess.run(argv, check=True)
+        except subprocess.CalledProcessError as e:
+            print(f"Error executing command: {e}")
+            sys.exit(1)
 
 def run_list(args):
     d = '/' + MANIFESTDIR
@@ -154,20 +201,25 @@ if __name__ == "__main__":
     build_rootfs.add_argument("--reinject", help="Also reinject the build configurations into the target", action='store_true')
     build_rootfs.add_argument("--manifest", help="Use the specified manifest", action='store', default='default')
     build_rootfs.add_argument("--install", help="Add a package", action='append', default=[], metavar='PACKAGE')
+    build_rootfs.add_argument("--exclude", help="Exclude a package", action='append', default=[], metavar='PACKAGE')
     build_rootfs.add_argument("--cachedir", help="Cache repo metadata and RPMs in specified directory", action='store', default='')
     build_rootfs.add_argument("--add-dir", help='Copy dir contents into the target', action='append', default=[], metavar='DIR')
     build_rootfs.add_argument("--no-docs", help="Don't install documentation", action='store_true')
+    build_rootfs.add_argument("--recommends", help="Whether to install recommended packages", action='store_true')
+    build_rootfs.add_argument("--no-initramfs", help="Whether to generate an initramfs for the roots", action='store_true')
     build_rootfs.add_argument("--sysusers", help="Run systemd-sysusers instead of injecting hardcoded passwd/group entries", action='store_true')
     build_rootfs.add_argument("--nobody-99", help=argparse.SUPPRESS, action='store_true')
     build_rootfs.add_argument("--repo", help="Enable specific repositories only", action='append', default=[], metavar='REPO')
+    build_rootfs.add_argument("--lock", help="Lock package to specific version; can be NEVRA or NEVR", action='append', default=[], metavar='NEVRA')
     build_rootfs.add_argument("source_root", help="Path to the source root directory used for dnf configuration (default=/)", nargs='?', default='/')
     build_rootfs.add_argument("target", help="Path to the target root directory that will be generated.")
     build_rootfs.set_defaults(func=run_build_rootfs)
 
     cmd_rechunk = subparsers.add_parser('rechunk', help="Generate a new container image with split, reproducible, chunked layers")
+    cmd_rechunk.add_argument("--chunkah", help="Use chunkah instead of rpm-ostree (reads rootfs from /chunkah, writes OCI archive to stdout)", action='store_true')
     cmd_rechunk.add_argument("--max-layers", help="Configure the number of output layers")
-    cmd_rechunk.add_argument("from_image", help="Operate on this image in the container storage")
-    cmd_rechunk.add_argument("to_image", help="Output a new image to the container storage")
+    cmd_rechunk.add_argument("from_image", help="Operate on this image in the container storage", nargs='?')
+    cmd_rechunk.add_argument("to_image", help="Output a new image to the container storage", nargs='?')
     cmd_rechunk.set_defaults(func=run_rechunk)
 
     cmd_list = subparsers.add_parser('list', help='List available manifests')

bootc-base-imagectl.md

@@ -47,6 +47,15 @@ This command takes just two arguments:
 - A path to the target root filesystem which will be generated as
   a directory. The target should not already exist (but its parent must exist).
 
+### Implementation
+
+The current implementation uses `rpm-ostree` on a manifest (treefile)
+embedded in the container image itself. These manifests are not intended
+to be editable directly.
+
+To emphasize: the implementation of this command (especially the configuration
+files that it reads) are subject to change.
+
 ## Using bootc-base-imagectl rechunk
 
 This operation is strongly related to `build-rootfs` but is also orthogonal;
@@ -95,6 +104,35 @@ tree (hence removed/overridden files are handled), and then splits it up
 Further, because bootc uses OSTree today, and OSTree canonializes all timestamps
 to zero on the client side, this tool does that at build time.
 
+### Using chunkah instead of rpm-ostree
+
+The `--chunkah` flag switches rechunk to use [chunkah] instead of
+rpm-ostree for layer splitting. In this mode, chunkah reads the rootfs
+from `/chunkah` (its default) and writes an OCI archive to stdout.
+The `from_image` and `to_image` positional arguments are not used.
+The `--max-layers` option is respected and passed through to chunkah.
+
+This mode automatically passes `--prune /sysroot/` to strip OSTree data
+and `--label ostree.commit-` / `--label ostree.final-diffid-` to remove
+OSTree-specific labels. In other words, this produces plain OCI bootc images
+without any OSTree content.
+
+To rechunk an existing image using chunkah:
+
+```
+IMG=quay.io/exampleos/exampleos:latest
+podman run --rm --mount=type=image,src=$IMG,dest=/chunkah \
+  -e CHUNKAH_CONFIG_STR="$(podman inspect $IMG)" \
+  quay.io/fedora/fedora-bootc:rawhide \
+  /usr/libexec/bootc-base-imagectl rechunk --chunkah | podman load
+```
+
+The `CHUNKAH_CONFIG_STR` environment variable passes the original
+image's metadata (labels, environment, command, etc.) to chunkah so
+that it is retained in the rechunked output.
+
+[chunkah]: https://github.com/coreos/chunkah
+
 ### Other options
 
 `bootc-base-imagectl list` will enumerate available configurations that
@@ -102,12 +140,9 @@ can be selected by passing `--manifest` to `build-rootfs`.
 
 ### Implementation
 
-The current implementation uses `rpm-ostree` on a manifest (treefile)
-embedded in the container image itself. These manifests are not intended
-to be editable directly.
-
-To emphasize: the implementation of this command (especially the configuration
-files that it reads) are subject to change.
+The default rechunking implementation also uses `rpm-ostree`. The `--chunkah`
+mode uses [chunkah] instead, which is content-agnostic and not tied to
+rpm-ostree.
 
 ### Cross builds and the builder image
 

eln.yaml

@@ -0,0 +1 @@
+fedora-eln.yaml

eln/20-rhel.toml

@@ -0,0 +1,2 @@
+[install]
+root-fs-type = "xfs"

eln/bootc-install.yaml

@@ -0,0 +1,3 @@
+add-files:
+  - - 20-rhel.toml
+    - /usr/lib/bootc/install/20-rhel.toml

eln/manifest.yaml

@@ -0,0 +1,9 @@
+metadata:
+  summary: |
+    Standard bootc base image for Enterprise Linux Next (ELN).
+    This manifest is the source for the image published as fedora-eln.
+    ELN is the Fedora package set (rawhide sources, ELN buildroot/compose).
+
+include:
+  - ../standard/manifest.yaml
+  - bootc-install.yaml

fedora-43.yaml

@@ -2,5 +2,6 @@
 # will be removed in the future.
 releasever: 43
 repos:
-  - fedora-devel
+  - fedora
+  - fedora-updates
 include: fedora-bootc.yaml

fedora-44.yaml

@@ -1,6 +1,6 @@
 # NB: This treefile is used by the legacy pungi path only to build tier-1. It
 # will be removed in the future.
-releasever: 42
+releasever: 44
 repos:
   - fedora
   - fedora-updates

fedora-45.yaml

@@ -0,0 +1,6 @@
+# NB: This treefile is used by the legacy pungi path only to build tier-1. It
+# will be removed in the future.
+releasever: 45
+repos:
+  - fedora-devel
+include: fedora-bootc.yaml

fedora-eln.yaml

@@ -0,0 +1,6 @@
+repos:
+  - eln-baseos
+  - eln-appstream
+include:
+  - fedora-includes/eln.yaml
+  - eln/manifest.yaml

fedora-includes/eln.yaml

@@ -0,0 +1,7 @@
+# ELN uses the same distro variable as Fedora: ELN is a compose of Fedora
+# Rawhide sources (see docs.fedoraproject.org/en-US/eln/). Repos come from
+# REPOS_IMAGE at build time; we do not add fedora-repos-archive here.
+variables:
+  distro: "fedora"
+
+packages: []

install-manifests

@@ -16,6 +16,12 @@ for image in minimal standard minimal-plus iot; do
     # And the legacy `fedora-` prefixed names
     cp -a fedora-$image.yaml $manifestdir/
 done
+# ELN is rawhide-only and should be removed when stable branches are created
+# (manually remove eln/ directory and fedora-eln.yaml when branching for new releases)
+if [ -d eln ]; then
+    cp -a eln $manifestdir/
+    cp -a fedora-eln.yaml $manifestdir/
+fi
 # Set the default
 ln -s fedora-standard.yaml $manifestdir/default.yaml
 # And install dependency manifests

minimal/bootc.yaml

@@ -1,13 +1,11 @@
 # The bootc components.
 packages:
- - systemd
+ # systemd. Also name systemd-pam because it was dropped to a recommends
+ # but we still want it for handling user logins/sessions.
+ # dbus is required per https://bugzilla.redhat.com/show_bug.cgi?id=2507313
+ - systemd systemd-pam dbus
+ # bootc itself.
  - bootc
  # Required by bootc install, sgdisk has been replaced by Rust crate
  # in bootc https://github.com/containers/bootc/pull/775
  - xfsprogs e2fsprogs dosfstools
-
-exclude-packages:
-  # Exclude kernel-debug-core to make sure that it doesn't somehow get
-  # chosen as the package to satisfy the `kernel-core` dependency from
-  # the kernel package.
-  - kernel-debug-core

minimal/initramfs.yaml

@@ -10,7 +10,7 @@ postprocess:
     # Dracut will always fail to set security.selinux xattrs at build time
     # https://github.com/dracut-ng/dracut-ng/issues/1561
     export DRACUT_NO_XATTR=1
-    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree bootc "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel

minimal/kernel-install.yaml

@@ -4,10 +4,11 @@ postprocess:
     #!/usr/bin/env bash
     set -xeuo pipefail
     source /usr/lib/os-release
+    mkdir -p /usr/lib/kernel/install.conf.d
     echo -e "# kernel-install will not try to run dracut and allow rpm-ostree to\n\
     # take over. Rpm-ostree will use this to know that it is responsible\n\
     # to run dracut and ensure that there is only one kernel in the image\n\
-    layout=ostree" | tee /usr/lib/kernel/install.conf > /dev/null
+    layout=ostree" | tee /usr/lib/kernel/install.conf /usr/lib/kernel/install.conf.d/00-bootc-kernel-layout.conf > /dev/null
     # By default dnf keeps multiple versions of the kernel, with this
     # configuration we tell dnf to treat the kernel as everything else.
     # https://dnf.readthedocs.io/en/latest/conf_ref.html#main-options

minimal/kernel.yaml

@@ -4,3 +4,9 @@ packages:
 
 exclude-packages:
   - kernel-debug
+  - kernel-debug-core
+  - kernel-debug-modules
+  - kernel-debug-modules-core
+  - kernel-debug-modules-extra
+  - kernel-debug-uki-virt
+  - kernel-debug-uki-virt-addons

minimal/manifest.yaml

@@ -16,9 +16,6 @@ container-cmd:
 remove-from-packages:
   # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
   - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
-  # We don't want auto-generated mount units. See also
-  # https://github.com/systemd/systemd/issues/13099
-  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
 
 include:
   - kernel.yaml

minimal/postprocess-conf.yaml

@@ -22,6 +22,7 @@ etc-group-members:
   - wheel
   - systemd-journal
   - tss # https://issues.redhat.com/browse/BIFROST-618
+  - kvm # https://issues.redhat.com/browse/RHEL-115278
   - adm
 
 conditional-include:

minimal/systemd-presets.yaml

@@ -9,16 +9,29 @@ postprocess:
     # https://github.com/coreos/fedora-coreos-tracker/issues/1896#issuecomment-2848251507
     disable dnf-makecache.timer
     EOF
-  # Enable bootloader-update.service on F43+.
+  # Enable bootloader-update.service on F43+ and CentOS9+
   # https://github.com/coreos/fedora-coreos-tracker/issues/1468#issuecomment-2996654547
   # https://fedoraproject.org/wiki/Changes/AutomaticBootloaderUpdatesBootc
   - |
     #!/bin/bash
     set -xeuo pipefail
     source /usr/lib/os-release
-    if [ $ID == "fedora" ] && [ ${VERSION_ID} -ge 43 ]; then
-      echo "enable bootloader-update.service" >> /usr/lib/systemd/system-preset/85-bootc.preset
-    fi
+
+    preset_file_name=/usr/lib/systemd/system-preset/85-bootc-bootloader-update.preset
+
+    case "$ID" in
+        fedora)
+            if [ "$VERSION_ID" -ge 43 ]; then
+                echo "enable bootloader-update.service" >> "$preset_file_name"
+            fi
+            ;;
+        centos)
+            if [ "$VERSION_ID" -ge 9 ]; then
+                echo "enable bootloader-update.service" >> "$preset_file_name"
+            fi
+            ;;
+        *) ;;
+    esac
   # Undo RPM scripts enabling units; we want the presets to be canonical
   # https://github.com/projectatomic/rpm-ostree/issues/1803
   - |

minimal/tmpfiles.yaml

@@ -6,3 +6,13 @@ postprocess:
     # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
     d /var/lib/rpm-state 0755 - - -
     EOF
+    cat > /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf <<'EOF'
+    # Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+    d /var/roothome/buildinfo 0755 - - -
+    d /var/roothome/buildinfo/content_manifests 0755 - - -
+    # Note we don't actually try to recreate the content; this just makes the linter ignore it
+    f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - -
+    f /var/roothome/buildinfo/labels.json 0644 - - -
+    EOF
+    # Workaround for https://issues.redhat.com/browse/RHEL-106203
+    rm -f /usr/lib/tmpfiles.d/home.conf

renovate.json

@@ -1,10 +1,39 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": [
+    "Renovate configuration for bootc-base-image repository.",
+    "",
+    "This configuration separates updates into different PRs per release (e.g., Fedora 44, Rawhide)",
+    "to prevent blocking all releases if tests fail on one.",
+    "",
+    "Update schedules:",
+    "- Fedora 43 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 43 REPOS_IMAGE: at any time",
+    "- Fedora 44 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 44 REPOS_IMAGE: at any time",
+    "- Fedora 45 bootc-pipeline: 2-5 AM UTC daily",
+    "- Fedora 45 REPOS_IMAGE: at any time",
+    "- Rawhide bootc-pipeline: 2-5 AM UTC daily",
+    "- Rawhide REPOS_IMAGE: at any time",
+    "",
+    "Each update type (bootc-pipeline, REPOS_IMAGE) also has its own PR",
+    "for independent review and merge.",
+    "",
+    "rebaseWhen is set to 'never' for REPOS_IMAGE PRs because as different PRs",
+    "for each release are merged to main, automatic rebasing would reset pipelines",
+    "and cause tests to rerun multiple times. The operator can manually rebase if needed.",
+    "",
+    "Automerge is enabled for all PRs - they will be merged automatically when all checks pass."
+  ],
   "extends": [
     "github>platform-engineering-org/.github"
   ],
   "dependencyDashboard": true,
-  "automergeType": "branch",
+  "automergeType": "pr",
+  "enabledManagers": [
+    "custom.regex",
+    "tekton"
+  ],
   "tekton": {
     "additionalBranchPrefix": "",
     "includePaths": [
@@ -12,115 +41,163 @@
     ],
     "managerFilePatterns": [
       "/\\.ya?ml$/"
-    ],
-    "packageRules": [
-      {
-        "matchPackageNames": [
-          "/^quay.io/bootc-devel/tekton-catalog//"
-        ],
-        "enabled": true,
-        "groupName": "Konflux references",
-        "branchPrefix": "renovate/konflux/references/",
-        "group": {
-          "branchTopic": "{{{baseBranch}}}",
-          "commitMessageTopic": "{{{groupName}}}"
-        },
-        "commitMessageTopic": "Konflux references",
-        "prBodyColumns": [
-          "Package",
-          "Change",
-          "Notes"
-        ],
-        "prBodyTemplate": "{{{header}}}{{{table}}}{{{notes}}}{{{changelogs}}}{{{configDescription}}}{{{controls}}}{{{footer}}}",
-        "recreateWhen": "always",
-        "rebaseWhen": "behind-base-branch"
-      }
     ]
   },
+  "baseBranchPatterns": [
+    "main"
+  ],
   "customManagers": [
     {
       "customType": "regex",
       "description": [
-        "Update 'REPOS_IMAGE' and 'BUILDER_IMAGE' in tekton files"
+        "Update 'REPOS_IMAGE' in tekton files"
       ],
       "managerFilePatterns": [
         "/.tekton/.*\\.ya?ml$/"
       ],
       "matchStrings": [
-        "REPOS_IMAGE=(?<depName>.*):(?<currentValue>.*)@(?<currentDigest>.*)\\n",
-        "BUILDER_IMAGE=(?<depName>.*):(?<currentValue>.*)@(?<currentDigest>.*)\\n"
+        "REPOS_IMAGE=(?<depName>.*):(?<currentValue>.*)@(?<currentDigest>.*)\\n"
       ],
       "versioningTemplate": "regex:(?<compatibility>.*)-(?<patch>\\d{8})(\\.n)?\\.(?<build>\\d)",
       "datasourceTemplate": "docker"
     }
   ],
-  "baseBranchPatterns": [
-    "main",
-    "f40",
-    "f41"
-  ],
   "packageRules": [
     {
-      "matchPackageNames": [
-        "/quay.io/bootc-devel/fedora-bootc-rawhide-compose/"
-      ],
-      "groupName": "Fedora rawhide compose dependencies",
-      "groupSlug": "fedora-rawhide-compose-dependencies",
-      "schedule": [
-        "at any time"
+      "description": [
+        "Disable REPOS_IMAGE updates for 44-iot, 45-iot and rawhide-iot tekton files",
+        "until we fix https://gitlab.com/fedora/bootc/base-images/-/issues/74"
       ],
+      "matchManagers": ["custom.regex", "tekton"],
+      "matchFileNames": [".tekton/*-44-iot-*", ".tekton/*-45-iot-*", ".tekton/*-rawhide-iot-*"],
+      "enabled": false
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-43-*"],
+      "groupName": "Fedora 43 bootc-pipeline",
+      "groupSlug": "fedora-43-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-43/",
+      "commitMessageTopic": "Fedora 43 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-43-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-43-*"],
+      "groupName": "Fedora 43 REPOS_IMAGE",
+      "groupSlug": "fedora-43-repos-image",
+      "branchPrefix": "renovate/fedora-43/",
+      "commitMessageTopic": "Fedora 43 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-44-*"],
+      "groupName": "Fedora 44 bootc-pipeline",
+      "groupSlug": "fedora-44-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-44/",
+      "commitMessageTopic": "Fedora 44 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-44-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-44-*"],
+      "groupName": "Fedora 44 REPOS_IMAGE",
+      "groupSlug": "fedora-44-repos-image",
+      "branchPrefix": "renovate/fedora-44/",
+      "commitMessageTopic": "Fedora 44 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-45-*"],
+      "groupName": "Fedora 45 bootc-pipeline",
+      "groupSlug": "fedora-45-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-45/",
+      "commitMessageTopic": "Fedora 45 bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-45-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-45-*"],
+      "groupName": "Fedora 45 REPOS_IMAGE",
+      "groupSlug": "fedora-45-repos-image",
+      "branchPrefix": "renovate/fedora-45/",
+      "commitMessageTopic": "Fedora 45 REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["tekton"],
+      "matchPackageNames": ["/quay.io/bootc-devel/tekton-catalog/"],
+      "matchFileNames": [".tekton/fedora-bootc-rawhide-*"],
+      "groupName": "Fedora Rawhide bootc-pipeline",
+      "groupSlug": "fedora-rawhide-bootc-pipeline",
+      "branchPrefix": "renovate/fedora-rawhide/",
+      "commitMessageTopic": "Fedora Rawhide bootc build pipeline",
+      "schedule": ["after 2am and before 5am"],
+      "timezone": "UTC",
+      "recreateWhen": "always",
+      "rebaseWhen": "always",
+      "additionalBranchPrefix": "",
+      "automerge": true
+    },
+    {
+      "matchManagers": ["custom.regex"],
+      "matchPackageNames": ["/quay.io/bootc-devel/fedora-bootc-rawhide-compose/"],
+      "matchFileNames": [".tekton/fedora-bootc-rawhide-*"],
+      "groupName": "Fedora Rawhide REPOS_IMAGE",
+      "groupSlug": "fedora-rawhide-repos-image",
+      "branchPrefix": "renovate/fedora-rawhide/",
+      "commitMessageTopic": "Fedora Rawhide REPOS_IMAGE",
+      "schedule": ["at any time"],
+      "recreateWhen": "always",
+      "rebaseWhen": "never",
+      "additionalBranchPrefix": "",
       "automerge": true
     },
     {
       "matchPackageNames": [
-        "/quay.io/bootc-devel/fedora-bootc-42-compose/"
+        "/quay.io/bootc-devel/fedora-bootc-eln-compose/"
       ],
-      "groupName": "Fedora 42 compose dependencies",
-      "groupSlug": "fedora-42-compose-dependencies",
+      "groupName": "Fedora ELN compose dependencies",
+      "groupSlug": "fedora-eln-compose-dependencies",
       "schedule": [
         "at any time"
       ],
       "automerge": true
-    },
-    {
-      "matchPackageNames": [
-        "/quay.io/bootc-devel/fedora-bootc-41-compose/"
-      ],
-      "groupName": "Fedora 41 compose dependencies",
-      "groupSlug": "fedora-41-compose-dependencies",
-      "schedule": [
-        "at any time"
-      ],
-      "automerge": true
-    },
-    {
-      "matchPackageNames": [
-        "/quay.io/bootc-devel/fedora-bootc-40-compose/"
-      ],
-      "groupName": "Fedora 40 compose dependencies",
-      "groupSlug": "fedora-40-compose-dependencies",
-      "schedule": [
-        "at any time"
-      ],
-      "automerge": true
-    },
-    {
-      "matchPackageNames": [
-        "quay.io/fedora/fedora"
-      ],
-      "allowedVersions": "=40",
-      "matchBaseBranches": [
-        "f40"
-      ]
-    },
-    {
-      "matchPackageNames": [
-        "quay.io/fedora/fedora"
-      ],
-      "allowedVersions": "=41",
-      "matchBaseBranches": [
-        "f41"
-      ]
     }
   ]
 }

standard.yaml

@@ -5,3 +5,7 @@ include:
 packages:
   # Make Ansible "package" builtin work by default
   - python3-libdnf5
+  # Content-based container layer splitting for rechunking
+  # Note we should be able to move this back to the base standard/manifest.yaml
+  # once chunkah is in CentOS Stream and RHEL.
+  - chunkah

standard/initramfs-full.yaml

@@ -7,3 +7,14 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/30-bootc-standard.conf << 'EOF'
     add_dracutmodules+=" lvm crypt fips "
     EOF
+    # Clevis in initramfs for LUKS auto-unlock.
+    # clevis-pin-tpm2 is only on x86_64/aarch64 (TPM2 hardware arches).
+    if test -x /usr/bin/clevis-pin-tpm2; then
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis clevis-pin-tpm2 "
+    EOF
+    else
+      cat > /usr/lib/dracut/dracut.conf.d/50-bootc-clevis.conf << 'EOF'
+      add_dracutmodules+=" clevis "
+    EOF
+    fi

standard/manifest.yaml

@@ -24,7 +24,6 @@ packages:
   # Additional firewall support; we aren't including these in RHCOS or they
   # don't exist in RHEL
   - iptables-services
-  - WALinuxAgent-udev
   # Allow communication between sudo and SSSD
   # for caching sudo rules by SSSD.
   # https://github.com/coreos/fedora-coreos-tracker/issues/445
@@ -44,10 +43,17 @@ packages:
   - sos
   # Make Ansible "package_facts" builtin work by default
   - python3-rpm
+  # Initramfs Clevis for LUKS auto-unlock (dracut modules wired in initramfs-full.yaml)
+  - clevis-dracut
+  # Used by admins interactively
+  - man-db
 
 # These are random architecture-specific packages
 packages-x86_64:
   - irqbalance
+  - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 packages-ppc64le:
   - irqbalance
   - librtas
@@ -55,17 +61,9 @@ packages-ppc64le:
   - ppc64-diag-rtas
 packages-aarch64:
   - irqbalance
-
-postprocess:
-  # See: https://github.com/coreos/fedora-coreos-tracker/issues/1253
-  #      https://bugzilla.redhat.com/show_bug.cgi?id=2112857
-  #      https://github.com/coreos/rpm-ostree/issues/3918
-  # Temporary workaround to remove the SetGID binary from liblockfile that is
-  # pulled by the s390utils but not needed for /usr/sbin/zipl.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    rm -f /usr/bin/dotlockfile
+  - WALinuxAgent-udev
+  # TPM2 pin for Clevis LUKS auto-unlock
+  - clevis-pin-tpm2
 
 # Things we don't expect to ship on the host.  We currently
 # have recommends: false so these could only come in via
@@ -75,7 +73,7 @@ exclude-packages:
   - perl-interpreter
   - nodejs
   - grubby
-  - cowsay  # Just in case
+  - cowsay # Just in case
   # Let's make sure initscripts doesn't get pulled back in
   # https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
   - initscripts

tests/Containerfile.test-derive

@@ -1,13 +1,12 @@
-# This test case exercises using the fedora-bootc image as a builder
-# to generate a minimal target image derived from CentOS Stream 10 content,
-# and then further extends it in a secondary phase.
-FROM quay.io/fedora/fedora-bootc:rawhide as repos
+# This test case exercises using the fedora-bootc image as a builder to
+# generate a minimal target image, and then further extends it in a secondary
+# phase.
 
 # This is intentionally a locally built image
 FROM localhost/fedora-bootc as builder
-RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw <<EORUN
+RUN <<EORUN
 echo -e '--install\nltrace' > args.txt
-/usr/libexec/bootc-base-imagectl --args-file args.txt build-rootfs --manifest=standard/manifest /repos /target-rootfs
+/usr/libexec/bootc-base-imagectl --args-file args.txt build-rootfs --manifest=standard/manifest /target-rootfs
 EORUN
 
 # This pulls in the rootfs generated in the previous step

tests/Containerfile.test-sysusers

@@ -1,15 +1,14 @@
 # This test case exercises --sysusers.
-FROM quay.io/fedora/fedora-bootc:rawhide as repos
 
 # This is intentionally a locally built image
 FROM localhost/fedora-bootc as builder
-RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw <<EORUN
+RUN <<EORUN
 mkdir -p overlay/usr/lib/sysusers.d
 cat > overlay/usr/lib/sysusers.d/00-chrony.conf <<EOF
 g chrony 888
 u chrony 888:888 - - -
 EOF
-/usr/libexec/bootc-base-imagectl build-rootfs --manifest=standard/manifest /repos /target-rootfs --sysusers --add-dir overlay
+/usr/libexec/bootc-base-imagectl build-rootfs --manifest=standard/manifest /target-rootfs --sysusers --add-dir overlay
 EORUN
 
 # This pulls in the rootfs generated in the previous step

tests/rootfs/cases/bootupd

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -xeuo pipefail
+# Verify the bootupd EFI has both grub2 and shim components installed.
+# (Note we don't use jq here because that's not available in minimal.)
+grep -q 'grub2-.*,shim-' /usr/lib/bootupd/updates/EFI.json

tests/rootfs/cases/etc-group

@@ -1,6 +1,9 @@
 #!/bin/bash
 set -xeuo pipefail
 # Verify group members
-getent group tss >/dev/null
-# This one needs to be in /etc
-grep -q tss /etc/group
+for grp in kvm tss; do
+  # Verify we can find through NSS
+  getent group $grp >/dev/null
+  # and these need to be directly in /etc
+  grep -q $grp /etc/group
+done

tests/rootfs/cases/tmpfiles-konflux-buildinfo

@@ -0,0 +1,18 @@
+#!/bin/bash
+set -xeuo pipefail
+# Verify our custom tmpfiles.d configs by actually running systemd-tmpfiles
+# against a temporary root and checking the expected paths are created.
+# Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+
+tmproot=$(mktemp -d)
+trap 'rm -rf "${tmproot}"' EXIT
+
+systemd-tmpfiles --create --root="${tmproot}" \
+    /usr/lib/tmpfiles.d/bootc-base-rpmstate.conf \
+    /usr/lib/tmpfiles.d/konflux-buildinfo-contentsets.conf
+
+test -d "${tmproot}/var/lib/rpm-state"
+test -d "${tmproot}/var/roothome/buildinfo"
+test -d "${tmproot}/var/roothome/buildinfo/content_manifests"
+test -f "${tmproot}/var/roothome/buildinfo/content_manifests/content-sets.json"
+test -f "${tmproot}/var/roothome/buildinfo/labels.json"