[cherry-pick: release-v0.28.x] fix(release): copy vendor tarball into kodata instead of symlink

[tekton-robot]

This is a cherry-pick of #1791

---

Changes

ko v0.19.0 enforces that kodata/ symlinks must not resolve outside the
kodata root (ko-build/ko#1619), a deliberate security hardening. This broke
the run-ko step in our release pipeline, which symlinked
cmd/*/kodata/source.tar.gz to a tarball in an external mktemp -d
directory:

Error: error processing import paths in ".../config/100-deployment.yaml":
error resolving image references: tarring kodata: kodata symlink
".../cmd/controller/kodata/source.tar.gz" resolves to "/tmp/tmp.gGIAFn/source.tar.gz"
which is outside the kodata root ".../cmd/controller/kodata"

This surfaced during a v0.28.0 patch release after bumping the pinned
ko image digest for Go 1.26.4 support (#1778), which pulled in ko v0.19.1.

Fix: copy the vendor tarball into each cmd/*/kodata/ directory instead of
symlinking to it from a shared tmpdir. ko already dereferences symlinks
and embeds the resolved file's bytes into the image layer when tarring
kodata, so this has no effect on the final image size — only the symlink
itself was rejected, not the underlying content.

Applied the same fix to the historical examples/releases/v0.3.0-build-chains-taskrun.yaml
for consistency, since it has the identical pattern.

Note: tektoncd/pipeline's tekton/publish.yaml has the same unfixed
pattern and is pinned to the same ko v0.19.1 image family, so it's likely
exposed to the same issue.

Submitter Checklist

• Has Tests included if any functionality added or changed — N/A, release pipeline script fix
• Follows the commit message standard
• Meets the Tekton contributor standards
• Has a kind label. You can add one by adding a comment on this PR that contains /kind bug
• Release notes block below has been updated with any user facing changes

Fix release pipeline `ko resolve` failure caused by `ko` >= v0.19.0 rejecting
the `kodata/source.tar.gz` symlink used to bundle vendored source.

Made with Cursor

[anithapriyanatarajan]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anithapriyanatarajan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anithapriyanatarajan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

fixed ko-build/ko#1698 but we cant wait fr it to be released

[jkhelil]

/lgtm