chore: initial Qodo configuration

[zdrapela]

Description of the change

Apply changes as in redhat-developer/rhdh-operator#1619

• Add Qodo PR agent configuration file
• Set up Jira integration with API token
• Description as comment, instead of updating the PR description (default config can interfere with Sourcery AI and it looks messier).
• Disable the diagram
• Automatically apply labels to the PR acording to the type
• Keep the code suggestions in one comment instead of inline suggestions.
• Don't trigger Qodo for bot PRs.

Configuration can be found in their docs:

• docs.qodo.ai/qodo-documentation/qodo-merge/configuration/configuration-file
• docs.qodo.ai/qodo-documentation/qodo-merge/tools/tools-list

Which issue(s) does this PR fix or relate to

• https://issues.redhat.com/browse/RHIDP-8718

How to test changes / Special notes to the reviewer

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Use pre-commit run -a to apply changes. The pre-commit Workflow will do this automatically for you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

Summary by Sourcery

Add initial Qodo PR agent configuration and enforce TOML validation

Enhancements:

• Introduce .pr_agent.toml to configure Qodo agent with Jira integration, custom PR commands, review and description settings, code suggestion preferences, ignored authors, and RAG arguments
• Add GitHub Actions workflow to lint TOML configuration files using the tombi tool

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

Blocking issues:

• An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)

Prompt for AI Agents

Please address the comments from this code review:
## Individual Comments

### Comment 1
<location> `.github/workflows/toml-checks.yaml:16` </location>
<code_context>
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: tombi-toml/setup-tombi@v1
+      - name: Validate TOML files
+        run: tombi lint
\ No newline at end of file
</code_context>

<issue_to_address>
Consider pinning the tombi-toml action to a specific commit for security.

Pinning to a commit hash ensures the action's code cannot change unexpectedly, reducing supply chain risks.
</issue_to_address>

## Security Issues

### Issue 1
<location> `.github/workflows/toml-checks.yaml:16` </location>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[zdrapela]

@sourcery-ai review

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• Use the glob pattern '/*.toml' instead of '.toml' in the workflow to ensure TOML files in subdirectories are also validated.
• Consider referencing stable version tags (e.g., v5, v1) for actions/checkout and tombi setup rather than commit SHAs to simplify future upgrades.
• Add a fallback or skip logic for Qodo review steps when the JIRA_API_TOKEN is missing to avoid blocking PRs that don’t require Jira integration.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Use the glob pattern '**/*.toml' instead of '**.toml' in the workflow to ensure TOML files in subdirectories are also validated.
- Consider referencing stable version tags (e.g., v5, v1) for actions/checkout and tombi setup rather than commit SHAs to simplify future upgrades.
- Add a fallback or skip logic for Qodo review steps when the JIRA_API_TOKEN is missing to avoid blocking PRs that don’t require Jira integration.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[rm3l]

/lgtm