Menu
Run check-payload locally to scan container images for FIPS compliance issues before they block a Konflux release
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Clone a repo with working hermetic builds and compare the implementation against the hermeto guide to identify gaps and improvements
Provision a VM on Red Hat Beaker for multi-arch testing
Run Conforma (Enterprise Contract) validation against a Konflux snapshot or a single image to check release policy compliance
Create a temporary pull request PipelineRun from an existing push PipelineRun to test build changes on an RHOAI release branch
Deploy locally-working hermetic build configuration into Konflux pipelines for RHOAI components
Productize an upstream Dockerfile for Konflux builds — base image swaps, digest pinning, FIPS compliance, label metadata, and build-arg simplification
| name | check-payload |
| description | Run check-payload locally to scan container images for FIPS compliance issues before they block a Konflux release |
| version | 1.0.0 |
Read guides/check-payload.md (relative to the plugin root) thoroughly before starting. It is the source of truth for all check-payload details — do not duplicate its content, reference it as you go.
Check prerequisites: Ask the user what platform they're on (macOS vs Linux) — macOS runs the scan under QEMU emulation, which is slower. Confirm podman is installed and running. Ask whether they've already built the check-payload container image — if not, walk them through the one-time setup from the guide.
Determine what to scan: Ask the user whether they want to scan:
If they're unsure which image to scan, help them identify the right one — ask what component they're working on and whether they have a recent build.
Run the scan: Follow the manual podman commands in the guide (skopeo copy, umoci unpack, check-payload scan). Let the user know the scan may take a minute. If the image requires registry authentication, help them mount their pull secret.
Interpret results:
Handle false positives: If any failures look like false positives (e.g., statically linked binaries that don't do crypto), explain the exception process from the guide. Offer to generate the TOML exception syntax with --print-exceptions and help draft the check-payload PR.
Next steps: Based on what was found, point the user to relevant guides and skills — dockerfile-productization for build flag changes, hermeto-prefetch for hermetic build setup, or conforma for broader release policy validation.
