[release-1.8] ci: Stabilize CI by pinning to specific RHDH tag on PRs [RHDHBUGS-2513]

[rm3l]

Description of the change

Manual cherry-pick of #297 to fix CI failures in release-1.8

Which issue(s) does this PR fix or relate to

• Relates to RHDHBUGS-2513

How to test changes / Special notes to the reviewer

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Run pre-commit run --all-files to run the hooks and then push any resulting changes. The pre-commit Workflow will enforce this and warn you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHDHBUGS-2513 - Partially compliant Compliant requirements: Stabilize PR CI by avoiding reliance on the unstable next tag. Keep coverage for next by running it separately (e.g., nightly) rather than blocking PRs. Non-compliant requirements: Fix CI failures in the chart repo that are caused by the next RHDH image tag failing to start. Requires further human verification: Confirm PR CI is now stable across typical PRs (charts changed vs. unchanged) and that the configured pinned image (latest or repo variables) actually starts successfully. Confirm the nightly workflow using next behaves as expected (it should fail only when next is broken, without impacting PR gating).

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🔒 Security concerns Supply chain risk: The workflow downloads and executes a remote install script via curl for OLM (install.sh) without pinning to a checksum/signature. Consider pinning artifacts with checksums, using a pinned action, or otherwise verifying the downloaded content before execution.

⚡ Recommended focus areas for review Possible Issue The ingress controller install command appears to have the Helm chart reference in the release-name position (helm install ingress-nginx/ingress-nginx --generate-name ...). Helm expects helm install [RELEASE] CHART (or helm install --generate-name CHART), so this may fail at runtime and break CI. - name: Install Ingress Controller if: steps.list-changed.outputs.changed == 'true' shell: bash run: | helm install ingress-nginx/ingress-nginx --generate-name \ --set controller.service.type='NodePort' \ --set controller.admissionWebhooks.enabled=false CI Breakage The free disk space action is configured with rm_cmd: "rmz", which is likely an invalid command and may cause the step (and the workflow) to fail when it runs. - name: Remove unnecessary files to free up disk space if: steps.list-changed.outputs.changed == 'true' uses: endersonmenezes/free-disk-space@e6ed9b02e683a3b55ed0252f1ee469ce3b39a885 # v3 with: remove_android: true remove_dotnet: true remove_haskell: true rm_cmd: "rmz"

📚 Focus areas based on broader codebase context CI Stability The composite action hard-codes --set route.enabled=false for KinD-based CI, but it does not also disable PostgreSQL persistence. Existing CI-specific values disable both routes and PVCs, so leaving persistence enabled may reintroduce flaky failures when the cluster lacks a default storage class/PVC provisioning behavior differs. Consider adding --set upstream.postgresql.primary.persistence.enabled=false (or using the existing CI values file) for consistency. (Ref 1, Ref 2) EXTRA_ARGS=( "--set route.enabled=false" "--set upstream.ingress.enabled=true" "--set global.host=rhdh.127.0.0.1.sslip.io" ) Reference reasoning: The repo’s CI values files explicitly document the KinD CI workaround as “no Routes and no PVCs” and implement it by disabling route.enabled and upstream.postgresql.primary.persistence.enabled. Aligning the Helm args with that existing pattern reduces divergence and the chance of CI-only storage-related failures.

📄 References redhat-developer/rhdh-chart/charts/backstage/ci/with-custom-image-for-test-pod-values.yaml [1-15] redhat-developer/rhdh-chart/charts/backstage/ci/with-test-pod-disabled-values.yaml [1-12] redhat-developer/rhdh-chart/charts/backstage/values.yaml [342-356] redhat-developer/rhdh-chart/charts/backstage/templates/tests/test-secret.yaml [1-3] redhat-developer/rhdh-chart/ct-install.yaml [1-11] redhat-developer/rhdh-chart/ct.yaml [1-10] redhat-developer/rhdh-chart/cr.yaml [1-2] redhat-developer/rhdh/scripts/rhdh-openshift-setup/values.yaml [238-252]

[rhdh-qodo-merge]

PR Type

Enhancement

---

Description

• Extract chart testing logic into reusable composite action for consistency

• Add nightly workflow to test unstable 'next' RHDH image tag separately

• Stabilize PR CI by pinning to specific stable RHDH image tag

• Simplify test workflow by removing matrix strategy and branch patterns

---

File Walkthrough

Relevant files

Enhancement

action.yml Create reusable composite action for chart testing              .github/actions/test-charts/action.yml New composite action encapsulating all chart testing steps Configurable inputs for target branch, Helm args, and chart selection Sets up Helm, Python, chart-testing tools and KIND cluster Installs required dependencies (Ingress, OLM, Knative, SonataFlow CRDs) +185/-0  nightly.yaml Add nightly workflow for unstable image testing                    .github/workflows/nightly.yaml New workflow scheduled nightly to test unstable 'next' RHDH image Uses composite action with all charts and specific RHDH image configuration Runs on schedule and supports manual workflow dispatch +29/-0    test.yaml Simplify PR workflow and use composite action                        .github/workflows/test.yaml Remove matrix strategy testing multiple RHDH versions (latest and next) Simplify to single job testing only stable/RC 'latest' RHDH image Remove branch patterns 'rhdh-1.[0-9]+' and '1.[0-9]+.x' from triggers Replace inline testing steps with call to composite action Add environment variables for configurable RHDH image repository and tag Conditionally pass image configuration only for main branch PRs +13/-140

---

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Fix disk cleanup command Correct the rm_cmd parameter from the invalid command rmz to rm -rf to fix the disk cleanup step. .github/actions/test-charts/action.yml [64] -rm_cmd: "rmz" +rm_cmd: "rm -rf" Apply / Chat Suggestion importance[1-10]: 9 __ Why: The suggestion fixes a clear bug where an invalid command rmz is used, which would cause the disk cleanup step to fail; changing it to rm -rf restores the intended functionality.	High
	Use idempotent kubectl command for robustness Replace kubectl create with the idempotent kubectl apply when installing CRDs to prevent failures if the resources already exist on re-runs. .github/actions/test-charts/action.yml [152-156] run: | for crdDir in charts/orchestrator-infra/crds/*; do - kubectl create -f "${crdDir}" + kubectl apply -f "${crdDir}" done - kubectl create -f "https://github.com/apache/incubator-kie-tools/releases/download/${SONATAFLOW_OPERATOR_VERSION}/apache-kie-${SONATAFLOW_OPERATOR_VERSION}-incubating-sonataflow-operator.yaml" + kubectl apply -f "https://github.com/apache/incubator-kie-tools/releases/download/${SONATAFLOW_OPERATOR_VERSION}/apache-kie-${SONATAFLOW_OPERATOR_VERSION}-incubating-sonataflow-operator.yaml" Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out that using kubectl apply instead of kubectl create makes the step idempotent, which is a best practice for improving CI script robustness.	Medium
	Fix fragile shell argument parsing Simplify and fix the parsing of extra Helm arguments by using string concatenation instead of a fragile read command, which can fail with arguments containing spaces. .github/actions/test-charts/action.yml [165-185] run: | - EXTRA_ARGS=( - "--set route.enabled=false" - "--set upstream.ingress.enabled=true" - "--set global.host=rhdh.127.0.0.1.sslip.io" - ) + helm_extra_args="--set route.enabled=false --set upstream.ingress.enabled=true --set global.host=rhdh.127.0.0.1.sslip.io" if [[ -n "$INPUT_EXTRA_HELM_ARGS" ]]; then - IFS=' ' read -ra ADDITIONAL_ARGS <<< "$INPUT_EXTRA_HELM_ARGS" - EXTRA_ARGS+=("${ADDITIONAL_ARGS[@]}") + helm_extra_args="$helm_extra_args $INPUT_EXTRA_HELM_ARGS" fi CT_ARGS=( --debug --config ct-install.yaml --upgrade --target-branch "$INPUT_TARGET_BRANCH" - --helm-extra-set-args="${EXTRA_ARGS[*]}" + --helm-extra-set-args="$helm_extra_args" ) if [[ "$INPUT_ALL_CHARTS" == "true" ]]; then CT_ARGS+=(--all) fi ct install "${CT_ARGS[@]}" Apply / Chat Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that parsing arguments with read is fragile and proposes a simpler, more robust string concatenation method, preventing potential future bugs.	Low
More

[rm3l]

Merging as it is a manual cherry-pick and to unblock the CI failing on #330