[release-1.9] feat: add RPM lockfile automation workflow

[openshift-cherrypick-robot]

This is an automated cherry-pick of #2141

/assign rm3l

[rhdh-qodo-merge]

ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🔒 Security concerns Supply-chain risk: The workflow installs rpm-lockfile-prototype from https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip, which is mutable and could be compromised upstream, impacting CI execution. Privileged automation / approval bypass: The workflow uses ${{ secrets.RHDH_BOT_TOKEN }} with contents: write and then adds lgtm/approved signals automatically. If downstream automation merges based on those signals, this could effectively bypass required human review.

⚡ Recommended focus areas for review Supply Chain The workflow installs rpm-lockfile-prototype directly from the main branch ZIP URL, which is not a pinned, immutable dependency and can lead to non-reproducible or unexpectedly changed behavior over time. Consider pinning to a specific tag/commit (or a release artifact) to make runs deterministic and reduce supply-chain risk. - name: Install rpm-lockfile-prototype run: | if [[ ! -x "${HOME}/.local/bin/rpm-lockfile-prototype" ]]; then echo "Installing rpm-lockfile-prototype ..." sudo apt-get update sudo apt-get install -y python3 python3-pip python3-dev build-essential sudo apt-get install -y podman skopeo rpm sudo apt-get install -y dnf python3-dnf mkdir -p "${HOME}/.local/bin/" python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip # Update PATH export PATH=${PATH%":${HOME}/.local/bin"}:${HOME}/.local/bin echo "${HOME}/.local/bin" >> $GITHUB_PATH Auto Approval The workflow automatically applies lgtm/approved labels and posts /lgtm and /approved comments using a write-scoped token. Validate that this matches the repository’s governance and that the bot identity is permitted to grant these approvals, since it can bypass human review expectations if other automation merges on these signals. - name: Create Pull Request id: create-pull-request if: steps.check-lockfile-changes.outputs.changes == 'true' uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 with: token: ${{ secrets.RHDH_BOT_TOKEN }} commit-message: "chore: update rpms.lock.yaml [skip-build]" title: "chore: update RPM lockfile in branch (${{ steps.target-branch.outputs.name }}) [skip-build]" body: | ## Description This PR updates the `rpms.lock.yaml` file with the latest package versions based on current `rpms.in.yaml` configuration using `${{ env.DOCKERFILE_PATH }}` as the base container context This PR was automatically created by the [Update RPM Lockfile GitHub Action](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}). branch: chore/automated-update-rpm-lockfile/${{ steps.target-branch.outputs.name }} delete-branch: true draft: false sign-commits: true labels: | lgtm approved add-paths: | rpms.lock.yaml - name: Add /lgtm and /approved comment if: steps.check-lockfile-changes.outputs.changes == 'true' && steps.create-pull-request.outputs.pull-request-number != '' uses: actions/github-script@v7 with: github-token: ${{ secrets.RHDH_BOT_TOKEN }} script: | const body = "/lgtm\n/approved"; const prNumber = ${{ steps.create-pull-request.outputs.pull-request-number }}; github.rest.issues.createComment({ issue_number: parseInt(prNumber), owner: context.repo.owner, repo: context.repo.repo, body: body })

📄 References redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [391-412] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [382-390] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [301-320] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [279-300] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [321-342] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [343-356] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [219-243] redhat-developer/rhdh-operator/config/profile/rhdh/plugin-deps/tekton.yaml [197-218]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Type

Enhancement

---

Description

• Add RPM lockfile automation workflow for automated weekly updates

• Define required RPM packages for operator in rpms.in.yaml

• Generate initial rpms.lock.yaml with resolved package versions

• Implement GitHub Action for automated PR creation with auto-approval

---

File Walkthrough

	Relevant files
Enhancement	update-rpm-lockfile.yaml GitHub Action workflow for automated RPM lockfile updates .github/workflows/update-rpm-lockfile.yaml New GitHub Action workflow triggered weekly (Mondays at 3AM UTC) and on push to main/release branches Installs rpm-lockfile-prototype tool and runs it against rpms.in.yaml Automatically creates PRs with auto-approval labels when lockfile changes detected Includes Git configuration, dependency installation, and summary reporting steps +128/-0
Configuration changes	rpms.in.yaml RPM package dependencies configuration file                            rpms.in.yaml Defines required RPM packages for RHDH operator runtime Specifies UBI 9 repository sources for appstream and baseos packages Includes FIPS support packages (openssl, crypto-policies) and base dependencies Documents instructions for regenerating rpms.lock.yaml using rpm-lockfile-prototype +49/-0    rpms.lock.yaml Initial RPM lockfile with resolved package versions            rpms.lock.yaml Initial lockfile with resolved RPM package versions for x86_64 architecture Contains 147 package entries with URLs, checksums, and source RPM references Includes both binary and source packages from UBI 9 repositories Specifies exact versions and SHA256 checksums for reproducible builds +147/-0

---

[rhdh-qodo-merge]

ⓘ Your approaching your monthly quota for Qodo. Upgrade your plan

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Remove automatic PR approval workflow The workflow should be modified to remove the automatic approval of pull requests it creates. This involves removing the steps that add 'lgtm'/'approved' labels and comments, thereby ensuring all dependency updates undergo manual human review for security and stability. Examples: .github/workflows/update-rpm-lockfile.yaml [101-121] labels: | lgtm approved add-paths: | rpms.lock.yaml - name: Add /lgtm and /approved comment if: steps.check-lockfile-changes.outputs.changes == 'true' && steps.create-pull-request.outputs.pull-request-number != '' uses: actions/github-script@v7 with: ... (clipped 11 lines) Solution Walkthrough: Before: # in .github/workflows/update-rpm-lockfile.yaml # ... - name: Create Pull Request if: steps.check-lockfile-changes.outputs.changes == 'true' uses: peter-evans/create-pull-request@... with: # ... labels: | lgtm approved # ... - name: Add /lgtm and /approved comment if: steps.check-lockfile-changes.outputs.changes == 'true' && ... uses: actions/github-script@v7 with: script: | const body = "/lgtm\n/approved"; github.rest.issues.createComment(...) After: # in .github/workflows/update-rpm-lockfile.yaml # ... - name: Create Pull Request if: steps.check-lockfile-changes.outputs.changes == 'true' uses: peter-evans/create-pull-request@... with: # ... # The 'lgtm' and 'approved' labels are removed to enforce manual review. # A label like 'dependencies' or 'automated-pr' could be used instead. labels: dependencies # ... # The step to add '/lgtm' and '/approved' comments is removed entirely. Suggestion importance[1-10]: 9 __ Why: This suggestion correctly identifies a critical security and process flaw where the workflow bypasses human review for dependency updates by automatically approving its own PRs.	High
Possible issue	Pin dependency to a specific commit Pin the rpm-lockfile-prototype dependency to a specific commit hash instead of the main branch to ensure workflow stability and reproducibility. .github/workflows/update-rpm-lockfile.yaml [53] -python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip +python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/d1912953235b042f56708c32243d57f582520331.zip # Pinned to commit d191295 Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies a potential source of instability in the workflow by using the main branch for a dependency and proposes pinning to a specific commit, which is a crucial best practice for reproducibility.	Medium
	Fix branch trigger pattern Replace the branch glob pattern release-1. with the more conventional release-1.* to correctly trigger the workflow on release branches.** .github/workflows/update-rpm-lockfile.yaml [11] -- release-1.** +- release-1.* Apply / Chat Suggestion importance[1-10]: 5 __ Why: The suggestion is correct that release-1.* is the more precise and conventional glob pattern for matching branches like release-1.x. While release-1.** would also work, using the correct pattern improves clarity and adheres to best practices.	Low
Organization best practice	Enable strict mode and quoting Add set -euo pipefail and quote variable expansions/redirect targets; also avoid exporting PATH in-process and rely on $GITHUB_PATH consistently to prevent subtle failures. .github/workflows/update-rpm-lockfile.yaml [44-59] - name: Install rpm-lockfile-prototype run: | + set -euo pipefail + if [[ ! -x "${HOME}/.local/bin/rpm-lockfile-prototype" ]]; then echo "Installing rpm-lockfile-prototype ..." sudo apt-get update sudo apt-get install -y python3 python3-pip python3-dev build-essential sudo apt-get install -y podman skopeo rpm sudo apt-get install -y dnf python3-dnf mkdir -p "${HOME}/.local/bin/" - python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip - # Update PATH - export PATH=${PATH%":${HOME}/.local/bin"}:${HOME}/.local/bin - echo "${HOME}/.local/bin" >> $GITHUB_PATH + python3 -m pip install --user "https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip" + echo "${HOME}/.local/bin" >> "${GITHUB_PATH}" else echo "rpm-lockfile-prototype already installed" fi Apply / Chat Suggestion importance[1-10]: 6 __ Why: Relevant best practice - Harden shell scripts by enabling strict modes, quoting variables, and avoiding brittle PATH manipulation to prevent runtime errors.	Low
General	Remove redundant auto-approval comment step Remove the redundant step that adds /lgtm and /approved comments, as the PR is already being labeled with lgtm and approved, which may be sufficient for auto-merge automation. .github/workflows/update-rpm-lockfile.yaml [107-120] -- name: Add /lgtm and /approved comment - if: steps.check-lockfile-changes.outputs.changes == 'true' && steps.create-pull-request.outputs.pull-request-number != '' - uses: actions/github-script@v7 - with: - github-token: ${{ secrets.RHDH_BOT_TOKEN }} - script: | - const body = "/lgtm\n/approved"; - const prNumber = ${{ steps.create-pull-request.outputs.pull-request-number }}; - github.rest.issues.createComment({ - issue_number: parseInt(prNumber), - owner: context.repo.owner, - repo: context.repo.repo, - body: body - }) +# This step can be removed if the 'lgtm' and 'approved' labels are sufficient +# to trigger the desired automation (e.g., auto-merge). Apply / Chat Suggestion importance[1-10]: 4 __ Why: The suggestion correctly identifies a potential redundancy between adding labels and comments for auto-approval, proposing a valid simplification if the CI system supports label-based triggers.	Low
More

[rm3l]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rm3l

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rm3l]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment