Catalog health: API modernization, image pinning, and CVE remediation

[vdemeester]

Summary

A static + CVE analysis of the catalog's active (non-deprecated) resources surfaces a few concrete, mostly-mechanical maintenance buckets. Full interactive report (foldable, filterable):

• 📊 Report: https://paste.sbr.pm/tekton-catalog-health.html
• 📦 Data + analyzer (reproducible): https://gist.github.com/vdemeester/b621e09210fed7e1bc090fa230267a74

Baseline main@8e41018 · 158 active resources (150 deprecated excluded).

Findings

Area	Count	Notes
API version outdated	123	Task not on v1 / StepAction not on v1beta1
Mutable-tag images	46	not pinned to @sha256
:latest / untagged images	10	should pin
CVEs (HIGH/CRITICAL)	1,772 C / 18,437 H	across 87 scanned images; high counts ≈ stale pins
$(params) in script:	79	hardening review (prefer env)
Privileged securityContext	5	mostly legitimate (buildah/buildkit) — review only
Missing tests/run.yaml	(see report)
Missing spec.description	(see report)

Note: $(params)-in-script and privileged are review signals, not automatic bugs — many are legitimate. PipelineResources usage is 0 among active resources (all such tasks are already deprecated).

Proposed work (in rough priority)

• Supply chain: re-pin the 56 mutable/:latest images to current digests
• CVEs: refresh the worst offenders (plumbing/test-runner, goreleaser, gradle, gke-deploy, …) — usually a digest bump
• API: bump 123 outdated primaries to v1 / v1beta1 (batched, copy-then-modify per task)
• Hardening: review the 79 $(params)-in-script tasks, move interpolation to env
• Metadata/tests: fill missing spec.description and tests/run.yaml

Methodology

catalog-health-analyzer.py (in the gist): parses primary manifests, resolves image digests (skopeo/crane), runs trivy for HIGH/CRITICAL. Re-run with --cve. Numbers exclude tekton.dev/deprecated resources by default.

[gferreir]

@vdemeester I'm picking up this issue. Plan is to tackle it in two phases:

Phase 1 — API bump (v1beta1 → v1)

There are 121 tasks still on v1beta1. I'll submit them in batches grouped by family — easier to review and keeps each PR focused:

PR	Family	Tasks
01	openshift-*	4
02	argocd + deployment/CD	9
03	github-*	11
04	git + gitlab-*	8
05	code-quality (linters) A	9
06	code-quality (linters) B	9
07	CLI tools	11
08	cloud + storage	11
09	security + scanning	11
10	image build	6
11	messaging	6
12	kubernetes + EKS	5
13	developer tools	6
14	build + automation	8
15	testing + publishing + misc	7

All following copy-then-modify from CONTRIBUTING.md, bumping pipelines.minVersion to 0.50.0, updating tests/README, and pinning hardcoded mutable images by digest where applicable.

Phase 2 — Script injection hardening

~85 tasks have $(params.*) interpolated directly in script: blocks. Once Phase 1 PRs land, I'll follow up moving those to env: vars per AGENTS.md guidelines. Same family grouping.

Heads up

• Aware of Update helm upgrade from repo to 0.4 #1318, fix(github-add-comment): add 0.8 with bounded results to avoid 4096 byte limit #1386, and feat: fix api endpoint and add optional ssl verification #1324 — will adjust version numbers if any of those merge first.
• Starting with the openshift-* family. Will submit in waves from there.

Happy to adjust the grouping or batch size if you have a preference.

[vdemeester]

@gferreir also note that there is this proposal in review : tektoncd/community#1283
I still it is still nice to do this work before we sunset this repository though 👼🏼

[gferreir]

@vdemeester Thanks for the heads-up on TEP-0168. I read through it — makes sense as the next step for the catalog.

I agree that getting the cleanup done before the sunset is worth it. Tasks already on v1 with pinned images will be in better shape for whatever comes next, whether that's migration to tektoncd-catalog/* repos or just a cleaner archived state.

I'll pick up the pace on the remaining PRs. #1391 is up for review, and I'm working through the next batches (argocd/deployment, github-*, git/gitlab). Goal is to get as many of the 15 Phase 1 PRs submitted in the coming weeks.

If there's a rough timeline for the sunset, that'd help me prioritize which families to push first.