chore(EC-2153): move POLICY_BUNDLE_DIGEST default from tasks to pipeline

[jsmid1]

Remove the RH Konflux-specific POLICY_BUNDLE_DIGEST default value from the verify-enterprise-contract and verify-conforma-konflux-ta task definitions. The default is moved to the enterprise-contract pipeline definition where it belongs, since only Konflux consumers need the digest pin.

Non-Konflux consumers of tekton-catalog no longer inherit a default that doesn't apply to them. The pin-konflux-policy-bundle.sh script already handles empty POLICY_BUNDLE_DIGEST gracefully (no-op).

Changes:

• Clear POLICY_BUNDLE_DIGEST default to empty string in both tasks
• Add POLICY_BUNDLE_DIGEST param to enterprise-contract pipeline
• Update hack/update-policy-digest-in-tasks.sh to target the pipeline
• Update docs to remove the digest default
• Update test snapshots for the new no-op behavior

Resolves: EC-2153

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 20d33988-0106-4072-a052-28c686ff0de6

📥 Commits

Reviewing files that changed from the base of the PR and between 65cf118 and 6426479.

⛔ Files ignored due to path filters (2)

• features/__snapshots__/ta_task_validate_image.snap is excluded by !**/*.snap
• features/__snapshots__/task_validate_image.snap is excluded by !**/*.snap

📒 Files selected for processing (6)

• docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
• docs/modules/ROOT/pages/verify-enterprise-contract.adoc
• hack/update-policy-digest-in-tasks.sh
• pipelines/enterprise-contract/0.1/enterprise-contract.yaml
• tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
• tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml

💤 Files with no reviewable changes (2)

• docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
• docs/modules/ROOT/pages/verify-enterprise-contract.adoc

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The enterprise-contract pipeline now defines and forwards the pinned policy bundle digest. The verification tasks default to an empty digest. The update script and documentation now reference the pipeline-level parameter.

Changes

Policy bundle digest configuration

Layer / File(s)	Summary
Pipeline parameter and task wiring pipelines/enterprise-contract/0.1/enterprise-contract.yaml	Adds the POLICY_BUNDLE_DIGEST pipeline parameter with the pinned digest and passes it to the verify task.
Task default updates tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml, tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml	Changes both task defaults to an empty string and removes the previous pinning comments.
Digest update automation and documentation hack/update-policy-digest-in-tasks.sh, docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc, docs/modules/ROOT/pages/verify-enterprise-contract.adoc	Updates the script to target the pipeline and removes the documented digest defaults.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: simonbaird, robnester-rh

Merge Risk: ⚪ Minimal · up to 64264

The pipeline now owns the Konflux digest pin while direct task consumers retain the unpinned default; the change is mergeable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes moving the POLICY_BUNDLE_DIGEST default from task definitions to the pipeline.
Description check	✅ Passed	The description explains what changed, why it changed, and links the related EC-2153 ticket. It covers the required template information, although it does not use the exact section headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Low-risk refactor by a frequent contributor moving the POLICY_BUNDLE_DIGEST default from tasks to the pipeline, with the main concern being silent behavioral change for direct task users who bypass the pipeline.

[fullsend-ai-review]

Looks good to me

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.51% <ø> (ø)
generative	12.25% <ø> (ø)
integration	23.56% <ø> (ø)
unit	72.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.