Success: true
Result: WARNING
Violations: 0, Warnings: 24, Successes: 435

Components:
- Name: -sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb-arm64
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Violations: 0, Warnings: 8, Successes: 145

- Name: 
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Violations: 0, Warnings: 8, Successes: 145

- Name: -sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65-amd64
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Violations: 0, Warnings: 8, Successes: 145

Results:
› [Warning] base_image_registries.allowed_registries_provided
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: allowed_registry_prefixes is configured without signing_identities. Migrate to signature-based verification by setting
  signing_identities in rule data.
  Title: Allowed base image registry prefixes list or signing identity was provided
  Description: Confirm that either the `allowed_registry_prefixes` or a `signing_identities` entry was provided, since at least
  one is required by the policy rules in this package.
  Solution: Make sure to configure either a signing identity under the `rh-release` key in the `signing_identities`
  https://conforma.dev/docs/cli/configuration.html#_data_sources or a list of trusted registry prefixes in
  `allowed_registry_prefixes`.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "buildah-remote-oci-ta" is used by pipeline task "build-container" is or will be unsupported as of
  2026-08-22T00:00:00Z. Upgrade to a newer version of the Task.
  Term: buildah-remote-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "git-clone-oci-ta" is used by pipeline task "clone-repository" is or will be unsupported as of
  2026-08-20T00:00:00Z. Upgrade to a newer version of the Task.
  Term: git-clone-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] test.no_failed_informative_tests
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: The Task "ecosystem-cert-preflight-checks" from the build Pipeline reports a failed informative test
  Term: ecosystem-cert-preflight-checks
  Title: No informative tests failed
  Description: Produce a warning if any informative tests have their result set to "FAILED". The result type is configurable by
  the "failed_tests_results" key, and the list of informative tests is configurable by the "informative_tests" key in the rule
  data.
  Solution: There is a test that failed. Make sure that any task in the build pipeline with a result named 'TEST_OUTPUT' does not
  fail. More information about the test should be available in the logs for the build Pipeline.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "build-container" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: buildah-remote-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "clone-repository" will be denied by rule pattern "oci://quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
  starting on 2026-09-05T00:00:00Z.
  Term: git-clone-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "rpms-signature-scan" will be denied by rule pattern "oci://quay.io/konflux-ci/konflux-vanguard/*" starting on
  2026-09-24T00:00:00Z.
  Term: rpms-signature-scan
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:ef5ab8d75ed0717b1c9000ee8dab8ae927c4c8663b0fe33247792ca3cd7c4adb
  Reason: Task "sast-snyk-check" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: sast-snyk-check-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] base_image_registries.allowed_registries_provided
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: allowed_registry_prefixes is configured without signing_identities. Migrate to signature-based verification by setting
  signing_identities in rule data.
  Title: Allowed base image registry prefixes list or signing identity was provided
  Description: Confirm that either the `allowed_registry_prefixes` or a `signing_identities` entry was provided, since at least
  one is required by the policy rules in this package.
  Solution: Make sure to configure either a signing identity under the `rh-release` key in the `signing_identities`
  https://conforma.dev/docs/cli/configuration.html#_data_sources or a list of trusted registry prefixes in
  `allowed_registry_prefixes`.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "buildah-remote-oci-ta" is used by pipeline task "build-container" is or will be unsupported as of
  2026-08-22T00:00:00Z. Upgrade to a newer version of the Task.
  Term: buildah-remote-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "git-clone-oci-ta" is used by pipeline task "clone-repository" is or will be unsupported as of
  2026-08-20T00:00:00Z. Upgrade to a newer version of the Task.
  Term: git-clone-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] test.no_failed_informative_tests
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: The Task "ecosystem-cert-preflight-checks" from the build Pipeline reports a failed informative test
  Term: ecosystem-cert-preflight-checks
  Title: No informative tests failed
  Description: Produce a warning if any informative tests have their result set to "FAILED". The result type is configurable by
  the "failed_tests_results" key, and the list of informative tests is configurable by the "informative_tests" key in the rule
  data.
  Solution: There is a test that failed. Make sure that any task in the build pipeline with a result named 'TEST_OUTPUT' does not
  fail. More information about the test should be available in the logs for the build Pipeline.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "build-container" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: buildah-remote-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "clone-repository" will be denied by rule pattern "oci://quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
  starting on 2026-09-05T00:00:00Z.
  Term: git-clone-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "rpms-signature-scan" will be denied by rule pattern "oci://quay.io/konflux-ci/konflux-vanguard/*" starting on
  2026-09-24T00:00:00Z.
  Term: rpms-signature-scan
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:d6162d4d6e9a810c5d94c7b00d8a093576a5d4e5d11bc536450843e422d3f7d3
  Reason: Task "sast-snyk-check" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: sast-snyk-check-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] base_image_registries.allowed_registries_provided
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: allowed_registry_prefixes is configured without signing_identities. Migrate to signature-based verification by setting
  signing_identities in rule data.
  Title: Allowed base image registry prefixes list or signing identity was provided
  Description: Confirm that either the `allowed_registry_prefixes` or a `signing_identities` entry was provided, since at least
  one is required by the policy rules in this package.
  Solution: Make sure to configure either a signing identity under the `rh-release` key in the `signing_identities`
  https://conforma.dev/docs/cli/configuration.html#_data_sources or a list of trusted registry prefixes in
  `allowed_registry_prefixes`.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "buildah-remote-oci-ta" is used by pipeline task "build-container" is or will be unsupported as of
  2026-08-22T00:00:00Z. Upgrade to a newer version of the Task.
  Term: buildah-remote-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] tasks.unsupported
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "git-clone-oci-ta" is used by pipeline task "clone-repository" is or will be unsupported as of
  2026-08-20T00:00:00Z. Upgrade to a newer version of the Task.
  Term: git-clone-oci-ta
  Title: Task version unsupported
  Description: The Tekton Task used is or will be unsupported. The Task is annotated with `build.appstudio.redhat.com/expires-on`
  annotation marking it as unsupported after a certain date.

› [Warning] test.no_failed_informative_tests
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: The Task "ecosystem-cert-preflight-checks" from the build Pipeline reports a failed informative test
  Term: ecosystem-cert-preflight-checks
  Title: No informative tests failed
  Description: Produce a warning if any informative tests have their result set to "FAILED". The result type is configurable by
  the "failed_tests_results" key, and the list of informative tests is configurable by the "informative_tests" key in the rule
  data.
  Solution: There is a test that failed. Make sure that any task in the build pipeline with a result named 'TEST_OUTPUT' does not
  fail. More information about the test should be available in the logs for the build Pipeline.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "build-container" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: buildah-remote-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "clone-repository" will be denied by rule pattern "oci://quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta"
  starting on 2026-09-05T00:00:00Z.
  Term: git-clone-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "rpms-signature-scan" will be denied by rule pattern "oci://quay.io/konflux-ci/konflux-vanguard/*" starting on
  2026-09-24T00:00:00Z.
  Term: rpms-signature-scan
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

› [Warning] trusted_task.future_deny_rule
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:8258706e8caa93e835c946fac2224afdada4dea69962fcca8491c43cfb610e65
  Reason: Task "sast-snyk-check" will be denied by rule pattern
  "oci://quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta" starting on 2026-09-05T00:00:00Z.
  Term: sast-snyk-check-oci-ta
  Title: Future deny rule will apply
  Description: Warn when a task matches a deny rule that has an effective_on date in the future. This provides advance notice that
  a task will become untrusted when the deny rule takes effect.
  Solution: Update the Task to a version that will not match the future deny rule before its effective date.

For more information about policy issues, see the policy documentation: https://conforma.dev/docs/policy/