chore: initial Qodo configuration

[zdrapela]

Description

Apply changes as in redhat-developer/rhdh-chart#240

• Add Qodo PR agent configuration file
• Set up Jira integration with API token
• Description as comment, instead of updating the PR description (default config can interfere with Sourcery AI and it looks messier).
• Disable the diagram
• Automatically apply labels to the PR according to the type
• Keep the code suggestions in one comment instead of inline suggestions.
• Don't trigger Qodo for bot PRs.

Configuration can be found in their docs:

• docs.qodo.ai/qodo-documentation/qodo-merge/configuration/configuration-file
• docs.qodo.ai/qodo-documentation/qodo-merge/tools/tools-list

Which issue(s) does this PR fix or relate to

• Fixes https://issues.redhat.com/browse/RHIDP-8718

PR acceptance criteria

• Tests
• Documentation

How to test changes / Special notes to the reviewer

Summary by Sourcery

Add initial Qodo PR agent configuration and set up CI checks for TOML validation.

Enhancements:

• Add .pr_agent.toml with Jira integration, GitHub app commands, reviewer settings, PR description options, code suggestions, ignored authors, and RAG arguments

CI:

• Introduce a GitHub Actions workflow to validate TOML files using tombi lint on push and pull requests

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

Blocking issues:

• An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)

General comments:

• Align the rag_repo_list values with the double-quoted style used elsewhere for consistency (e.g., ["repo1","repo2"] instead of ['repo1','repo2']).
• Consider narrowing the workflow’s path filter to target only the intended PR agent config files so you don’t accidentally lint other .toml files in the repo.
• Pin the tombi-toml/setup-tombi action to a more specific version or commit SHA to avoid unexpected breaking changes when the v1 tag is updated.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Align the rag_repo_list values with the double-quoted style used elsewhere for consistency (e.g., ["repo1","repo2"] instead of ['repo1','repo2']).
- Consider narrowing the workflow’s path filter to target only the intended PR agent config files so you don’t accidentally lint other .toml files in the repo.
- Pin the tombi-toml/setup-tombi action to a more specific version or commit SHA to avoid unexpected breaking changes when the v1 tag is updated.

## Individual Comments

### Comment 1
<location> `.pr_agent.toml:38` </location>
<code_context>
+
+[rag_arguments]
+enable_rag=true
+rag_repo_list=['redhat-developer/rhdh','redhat-developer/red-hat-developers-documentation-rhdh','redhat-developer/rhdh-operator','redhat-developer/rhdh-chart']
</code_context>

<issue_to_address>
Consider using double quotes for TOML string arrays for better compatibility.

Double quotes are recommended for TOML string arrays to avoid parser inconsistencies and potential parsing errors.
</issue_to_address>

### Comment 2
<location> `.pr_agent.toml:2` </location>
<code_context>
+[jira]
+jira_api_token = "${{ secrets.JIRA_API_TOKEN }}"
+jira_base_url = "https://issues.redhat.com"
+
</code_context>

<issue_to_address>
Environment variable interpolation may not be supported natively in TOML.

Verify that your tool or workflow can substitute environment variables in TOML files; otherwise, the literal string will be used. Consider other methods for managing secrets if this is not supported.
</issue_to_address>

## Security Issues

### Issue 1
<location> `.github/workflows/toml-checks.yaml:16` </location>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[zdrapela]

@sourcery-ai review

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

Blocking issues:

• An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)

Prompt for AI Agents

Please address the comments from this code review:
## Security Issues

### Issue 1
<location> `.github/workflows/toml-checks.yaml:16` </location>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[zdrapela]

@sourcery-ai review

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• Consider pinning the actions/checkout and tombi-toml setup steps to official version tags instead of commit SHAs to improve maintainability and clarity.
• It might be helpful to include a schema validation step alongside linting to ensure the .pr_agent.toml adheres to the expected Qodo config structure and catch missing or malformed fields early.
• You could simplify maintenance by merging the TOML validation into an existing CI pipeline or centralizing linting tasks to avoid having a standalone workflow file.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Consider pinning the actions/checkout and tombi-toml setup steps to official version tags instead of commit SHAs to improve maintainability and clarity.
- It might be helpful to include a schema validation step alongside linting to ensure the .pr_agent.toml adheres to the expected Qodo config structure and catch missing or malformed fields early.
- You could simplify maintenance by merging the TOML validation into an existing CI pipeline or centralizing linting tasks to avoid having a standalone workflow file.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[rm3l]

/lgtm