chore: Update oci-ta tasks, add Renovate config

[red-hat-konflux]

@msugakov: I took over this PR adding more maintenance things on top of Renovate's change.
It's best to review this PR per commit.

Relates to ROX-22359

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a stackrox member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[msugakov]

/renovate rebase

[msugakov]

This is going to be fun: there's a behavior change in the task so that it does not seem to allow passing through the chain.
DBs failed but scanners did not. Probably because DBs don't do any actual dependency prefetch. I think we should just put blobs fetch before dependencies prefetch to solve the issue.

[msugakov]

/ok-to-test

[msugakov]

/retest

[tommartensen]

LGTM, but I don't understand how switching the order of tasks will do anything to resolve the issue you mention (or what caused it in the first place)

[msugakov]

It seems to me that prefetch tasks puts some skip marker file so that the next attempt to save oci artifact bails out respecting that file.

[msugakov]

The pipeline run where this happened is https://console.redhat.com/application-pipeline/workspaces/rh-acs/applications/acs/pipelineruns/scanner-db-build-vtkz6

[tommartensen]

It seems to me that prefetch tasks puts some skip marker file so that the next attempt to save oci artifact bails out respecting that file.

👍
Could you check that the pipeline run timeout is still accurate?

[openshift-ci]

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/scale-tests	aac7b78	link	false	/test scale-tests
ci/prow/slim-e2e-tests	aac7b78	link	false	/test slim-e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[msugakov]

/retest scanner-db-build

[msugakov]

scanner-db-build even if it timeouts got successfully to the last two tasks. It was just slow due to multiarch and pipelines slowness. I don't want to bump *-db-* timeouts just yet. Will merge.