All organizations · GSoC 2026 · Infrastructure and cloud, Development tools

Konflux

Secure software pipelines, the K8s way

Konflux is an open source, opinionated Kubernetes-native software factory built on Tekton, focused on software supply chain security. It provides an end-to-end pipeline: hermetic builds from source, cryptographic signing, provenance attestation, vulnerability scanning, policy verification, and release automation. Konflux integrates with the broader supply chain security ecosystem (Sigstore, SLSA, Conforma) and is built by a welcoming community that values collaboration, transparency, and mentorship. Contributors work with cutting-edge cloud-native technologies and help shape how we solve one of the most critical challenges in modern software delivery.

python
go
docker
kubernetes
tekton

cloud-native
CI/CD
Tekton
SLSA
supplychain

Project ideas

4 ideas on its 2026 ideas page; of the 4 that state a difficulty: 3 medium, 1 hard. 3 mentors named.

Reproducible Builds medium
zstd:chunked compression medium
prefetch: Adding support for the uv Python package manager to the Hermeto project medium
prefetch: Adding support for the Debian/Ubuntu package ecosystem [DEB] to the Hermeto project hard

Read the ideas page. Ideas are for scope reference; never copy one into a proposal.

History

In GSoC since 2026, 1 year. Projects per year: '26: 3.

On GitHub

94 repositories pushed to in the last year. Main languages: Go (33), Shell (22), Python (18), Dockerfile (16), JavaScript (1), SCSS (1).

Links and channels

Website: https://konflux-ci.dev/
Ideas page: https://github.com/konflux-ci/community/wiki/Google-Summer-of-Code-&-Outreachy-Project-Ideas-%E2%80%90-2026
Source code: https://github.com/konflux-ci
Mailing list: https://groups.google.com/g/konflux
Chat: https://join.slack.com/t/konflux-ci/shared_invite/zt-3g36o0a4x-Dmsy25XEGuBV79S7kd04CA

go deeper in your terminal

git-into-gsoc org "Konflux" --shortlist
git-into-gsoc repos "Konflux"
git-into-gsoc issues --org "Konflux"

or ask your assistant:
"Which Konflux repositories merge
newcomers' pull requests, and which beginner
issues are still free?"

Those commands read live data: which repositories merge outside pull requests, and which beginner issues nobody has claimed. Install in two minutes.