Remove symlinks - due to ko-build update

[ngelman1]

Changes

Summary

ko v0.19.1 introduced a security restriction that rejects symlinks in kodata
that resolve outside the kodata root directory. This broke all e2e tests in CI
since setup-ko installs the latest release.

The cmd/controller/kodata/ directory contained symlinks to ../../.git/HEAD
and ../../.git/refs which are no longer used — knative.dev/pkg/changeset
now uses debug.ReadBuildInfo() to get VCS info at runtime instead of reading
from kodata.

Changes

• Remove cmd/controller/kodata/HEAD symlink (unused)
• Remove cmd/controller/kodata/refs symlink (unused)
• Replace cmd/controller/kodata/LICENSE symlink with a real file copy

logs from the failing tests:
2026-06-30T10:47:58.1714887Z Error: error processing import paths in "config/100-deployment.yaml": error resolving image references: tarring kodata: kodata symlink "/home/runner/work/chains/chains/cmd/controller/kodata/HEAD" resolves to "/home/runner/work/chains/chains/.git/HEAD" which is outside the kodata root "/home/runner/work/chains/chains/cmd/controller/kodata" 2026-06-30T10:47:58.1740223Z ERROR: Tekton Chains installation failed 2026-06-30T10:47:58.1742404Z *** E2E TEST FAILED ***

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

[waveywaves]

also let's pin ko to 1.18.1 like it's done in tektoncd/pipeline#10358 also if necessary

[ngelman1]

@waveywaves pinning versions is what I was trying to avoid.. isnt it a temporary solution well have to deal with anyway in the future?

[enarha]

@waveywaves pinning versions is what I was trying to avoid.. isnt it a temporary solution well have to deal with anyway in the future?

To me it sounds we need that temp solution until the ko fix is released and we can use that new ko binary. I see we use ko resolve here and there, not sure if we are hitting that edge case tektoncd/pipeline#10357 .

[ngelman1]

@waveywaves pinning versions is what I was trying to avoid.. isnt it a temporary solution well have to deal with anyway in the future?

To me it sounds we need that temp solution until the ko fix is released and we can use that new ko binary. I see we use ko resolve here and there, not sure if we are hitting that edge case tektoncd/pipeline#10357 .

yes it was failing anyway witout it. pinned now

[enarha]

/lgtm

[enarha]

/approve
on behalf of @waveywaves

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enarha, waveywaves

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [enarha]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/cherry-pick release-v0.27.x

[jkhelil]

/cherry-pick release-v0.26.x

[jkhelil]

/cherry-pick release-v0.25.x

[tekton-robot]

✅ Cherry-pick to release-v0.27.x successful!

A new pull request has been created to cherry-pick this change to release-v0.27.x.

PR: #1744

Please review and merge the cherry-pick PR.

[tekton-robot]

✅ Cherry-pick to release-v0.25.x successful!

A new pull request has been created to cherry-pick this change to release-v0.25.x.

PR: #1745

Please review and merge the cherry-pick PR.

[tekton-robot]

✅ Cherry-pick to release-v0.26.x successful!

A new pull request has been created to cherry-pick this change to release-v0.26.x.

PR: #1746

Please review and merge the cherry-pick PR.