rhidp 9361 pin the rhdh image to specific 1.y tag when creating a release 1.y branch in the rhdh operator and rhdh chart repos 1.6

.github/pull_request_template.md

@@ -1,28 +1,30 @@
 <!--
 Thank you for your contribution! Complete the following fields to provide insight into the changes being requested as well as steps that you can take to ensure it meets all of the requirements
 
-Please remember to:
-- mention any issue(s) that this PR closes using a closing keyword as well as the issue number, such as "Closes #XYZ" or "Resolves janus-idp/repo-name#XYZ", cf.
-  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
-- ensure there are no merge commits!
+Please remember to link any JIRA issue(s) that this PR closes or relates to, as this helps provide more context to reviewers.
 
- -->
+-->
 
 ## Description of the change
 
 <!-- Describe the change being requested. -->
 
-## Existing or Associated Issue(s)
+## Which issue(s) does this PR fix or relate to
 
 <!-- List any related issues. -->
 
-## Additional Information
+- _JIRA_issue_link_
 
- <!-- Provide as much information that you feel would be helpful for those reviewing the proposed changes. -->
+## How to test changes / Special notes to the reviewer
+
+<!--
+Detailed instructions may help reviewers test this PR quickly and provide quicker feedback.
+-->
 
 ## Checklist
 
-- [ ] Chart version bumped in `Chart.yaml` according to [semver](http://semver.org/).
-- [ ] Variables are documented in the `values.yaml` and added to the README.md. The [pre-commit](https://pre-commit.com/) utility can be used to generate the necessary content. Use `pre-commit run -a` to apply changes.
-- [ ] JSON Schema template updated and re-generated the raw schema via `pre-commit` hook.
-- [ ] List tests pass for Chart using the [Chart Testing](https://github.com/helm/chart-testing) tool and the `ct lint` command.
+- [ ] For each Chart updated, version bumped in the corresponding `Chart.yaml` according to [Semantic Versioning](http://semver.org/).
+- [ ] For each Chart updated, variables are documented in the `values.yaml` and added to the corresponding README.md. The [pre-commit](https://pre-commit.com/) utility can be used to generate the necessary content. Use `pre-commit run -a` to apply changes. The [pre-commit Workflow](./workflows/pre-commit.yaml) will do this automatically for you if needed.
+- [ ] JSON Schema template updated and re-generated the raw schema via the `pre-commit` hook.
+- [ ] Tests pass using the [Chart Testing](https://github.com/helm/chart-testing) tool and the `ct lint` command.
+- [ ] If you updated the [orchestrator-infra](../charts/orchestrator-infra) chart, make sure the versions of the [Knative CRDs](../charts/orchestrator-infra/crds) are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the [values.yaml](../charts/orchestrator-infra/values.yaml) file. See [Installing Knative Eventing and Knative Serving CRDs](../charts/orchestrator-infra/README.md#installing-knative-eventing-and-knative-serving-crds) for more details.

.github/workflows/bump-version.yml → .github/workflows/bump-version.yaml

@@ -13,43 +13,58 @@ jobs:
       contents: write
       id-token: write
       issues: write
+      pull-requests: write
 
     steps:
       - name: Check for command
         id: command
         continue-on-error: true
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const commentBody = context.payload.comment.body;
             const commandPrefix = "/bump ";
             let commandName = "";
-            let commandArgs = "";
+            let chartName = "";
+            let bumpLevel = "";
 
             if (commentBody.startsWith(commandPrefix)) {
               commandName = "bump";
               const args = commentBody.slice(commandPrefix.length).trim().split(" ");
-              commandArgs = args[0] || "patch";
+
+              if (args.length > 0 && args[0]) {
+                chartName = args[0];
+                bumpLevel = args[1] || "patch"; 
+
+                console.log(`Chart Name: ${chartName}, Bump Level: ${bumpLevel}`);
+                console.log(`Args array: ${JSON.stringify(args)}`);
+
+                const fs = require('fs');
+                fs.appendFileSync(process.env.GITHUB_OUTPUT, `chart-name=${chartName}\n`);
+                fs.appendFileSync(process.env.GITHUB_OUTPUT, `bump-level=${bumpLevel}\n`);
+                fs.appendFileSync(process.env.GITHUB_OUTPUT, `command-name=${commandName}\n`);
+
+              } else {
+                commandName = "";
+                core.warning("No chart name provided. Format: /bump <chart-name> [level]");
+                }
             }
 
-            core.setOutput("command-name", commandName);
-            core.setOutput("command-arguments", commandArgs);
-
       - name: Add eyes reaction
         if: steps.command.outputs.command-name == 'bump'
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: ${{ github.repository }}
           comment-id: ${{ github.event.comment.id }}
-          reaction-type: eyes
+          reactions: eyes
 
-      - uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
         if: steps.command.outputs.command-name == 'bump'
         with:
-          python-version: 3.13
+          python-version: 3.14
 
-      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         if: steps.command.outputs.command-name == 'bump'
         with:
           go-version: ^1
@@ -68,7 +83,7 @@ jobs:
 
       - name: Checkout Repository
         if: steps.command.outputs.command-name == 'bump'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           token: ${{ steps.generate_token.outputs.token }}
 
@@ -81,22 +96,22 @@ jobs:
       - name: Get version
         if: steps.command.outputs.command-name == 'bump'
         id: get_version
-        uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd # v4.45.1
+        uses: mikefarah/yq@0ecdce24e83f0fa127940334be98c86b07b0c488 # v4.48.1
         with:
-          cmd: yq ".version" charts/backstage/Chart.yaml
+          cmd: yq ".version" charts/${{ steps.command.outputs.chart-name }}/Chart.yaml
 
-      - uses: actions-ecosystem/action-bump-semver@34e334551143a5301f38c830e44a22273c6ff5c5  # v1
+      - uses: actions-ecosystem/action-bump-semver@34e334551143a5301f38c830e44a22273c6ff5c5 # v1
         if: steps.command.outputs.command-name == 'bump'
         id: semver
         with:
           current_version: ${{ steps.get_version.outputs.result }}
-          level: ${{ steps.command.outputs.command-arguments }}
+          level: ${{ steps.command.outputs.bump-level }}
 
       - name: Bump the version
         if: steps.command.outputs.command-name == 'bump'
-        uses: mikefarah/yq@8bf425b4d1344db7cd469a8d10a390876e0c77fd # v4.45.1
+        uses: mikefarah/yq@0ecdce24e83f0fa127940334be98c86b07b0c488 # v4.48.1
         with:
-          cmd: yq -i '.version = "${{ steps.semver.outputs.new_version }}"' charts/backstage/Chart.yaml
+          cmd: yq -i '.version = "${{ steps.semver.outputs.new_version }}"' charts/${{ steps.command.outputs.chart-name }}/Chart.yaml
 
       - name: Run pre-commit
         if: steps.command.outputs.command-name == 'bump'
@@ -109,10 +124,10 @@ jobs:
 
       - name: Commit pre-commit changes
         if: steps.command.outputs.command-name == 'bump'
-        uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+        uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7
         with:
-          commit_message: Bump version to ${{ steps.semver.outputs.new_version }}
-          commit_options: '-s'
+          commit_message: Bump ${{ steps.command.outputs.chart-name }} version to ${{ steps.semver.outputs.new_version }}
+          commit_options: "-s"
           commit_user_name: RHDH Bot
-          commit_user_email: 146280956+rhdh-bot@users.noreply.github.com 
+          commit_user_email: 146280956+rhdh-bot@users.noreply.github.com
           commit_author: RHDH Bot <146280956+rhdh-bot@users.noreply.github.com >

.github/workflows/lint.yaml

@@ -0,0 +1,66 @@
+name: Lint Charts
+
+on:
+  pull_request:
+    branches:
+      - main
+      - rhdh-1.[0-9]+
+      - 1.[0-9]+.x
+      - release-1.[0-9]+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+
+  lint-chart:
+    name: Lint Metadata
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # renovate: tag=v3.5
+        with:
+          version: v3.10.0
+
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+        with:
+          python-version: 3.14
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
+        with:
+          version: '3.14.0'
+          yamllint_version: '1.37.1'
+          yamale_version: '6.0.0'
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --target-branch "${{ github.event.pull_request.base.ref }}")
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Add Helm Repositories
+        if: steps.list-changed.outputs.changed == 'true'
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add backstage https://backstage.github.io/charts
+          helm repo update
+
+      - name: Run chart-testing (lint)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: |
+          ct lint \
+            --debug \
+            --config ct-lint.yaml \
+            --target-branch "${{ github.event.pull_request.base.ref }}"

.github/workflows/pre-commit.yaml

@@ -0,0 +1,97 @@
+name: Pre-commit
+
+on:
+  # pull_request_target needed to be able to commit and push pre-commit diffs to external fork PRs.
+  # But we included a manual authorization safeguard to prevent PWN requests. See the 'authorize' job below.
+  pull_request_target:
+    branches:
+      - main
+      - rhdh-1.[0-9]+
+      - 1.[0-9]+.x
+      - release-1.[0-9]+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+  authorize:
+    # The 'external' environment is configured with the maintainers team as required reviewers.
+    # All the subsequent jobs in this workflow 'need' this job, which will require manual approval for PRs coming from external forks.
+    # see list of approvers in OWNERS file
+    environment:
+      ${{ (github.event.pull_request.head.repo.full_name == github.repository ||
+      contains(fromJSON('["gazarenkov","kadel","nickboldt","rm3l","kim-tsao","Fortune-Ndlovu","subhashkhileri","zdrapela","openshift-cherrypick-robot"]'), github.event.pull_request.user.login)) && 'internal' || 'external' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: approved
+        run: echo "✓"
+
+  pre-commit:
+    name: Pre-commit
+    runs-on: ubuntu-latest
+    needs: authorize
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GO111MODULE: on
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+          repository: ${{github.event.pull_request.head.repo.full_name}}
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+        with:
+          python-version: 3.14
+
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+        with:
+          go-version: ^1
+
+      - name: Setup helm-docs
+        run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
+
+      - name: Run pre-commit
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        continue-on-error: true  # Don't fail immediately; we'll handle it below
+        with:
+          extra_args: --verbose --all-files --show-diff-on-failure
+
+      - name: Check for changes after pre-commit
+        id: diff-checker
+        run: |
+          echo "CHANGED=$(if git diff --quiet; then echo "false"; else echo "true"; fi)" >> $GITHUB_OUTPUT
+
+      - name: Commit and push any manifest changes
+        if: ${{ steps.diff-checker.outputs.CHANGED == 'true' }}
+        run: |
+          git remote add fork "https://github.com/${{ github.event.pull_request.head.repo.full_name }}.git"
+          git fetch fork ${{ github.event.pull_request.head.ref }}
+          git checkout -B pr-branch fork/${{ github.event.pull_request.head.ref }}
+
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+
+          git add -A .
+          git commit \
+            -m "chore(pre-commit): Auto-fix hooks" \
+            -m "Co-authored-by: $GITHUB_ACTOR <$GITHUB_ACTOR@users.noreply.github.com>"
+
+          git push fork pr-branch:${{ github.event.pull_request.head.ref }}
+
+      - name: Comment on PR if manifests were updated
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        if: ${{ !cancelled() && steps.diff-checker.outputs.CHANGED == 'true' }}
+        continue-on-error: true
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '⚠️ <b>Files changed after running the pre-commit hooks</b><br/><br/>Those changes should have been pushed automatically to your PR branch.<br/><br/><b>NOTE: </b>If the PR checks are stuck after this additional commit, manually close the PR and immediately reopen it to trigger the checks again.'
+            })

.github/workflows/release.yaml

@@ -0,0 +1,42 @@
+name: Release Charts
+
+on:
+  push:
+    branches:
+      - main
+      - release-1.[0-9]+
+    paths:
+      - "charts/**"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+
+      - name: Add dependencies
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add backstage https://backstage.github.io/charts
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        with:
+          config: cr.yaml
+          mark_as_latest: ${{ github.ref == 'refs/heads/main' }}
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}