From bc666e47c1364dc814c2d31f9f931e048525a24f Mon Sep 17 00:00:00 2001 From: Martin Polasko Date: Tue, 20 Jan 2026 11:24:04 +0100 Subject: [PATCH 1/3] feat: add RPM lockfile automation workflow - Add rpms.in.yaml defining required RPM packages for operator - Add GitHub Action workflow for automated RPM lockfile updates - Based on PRs #3342, #3427, #3624 from redhat-developer/rhdh - Enables automated weekly RPM updates with auto-approval --- .github/workflows/update-rpm-lockfile.yaml | 128 +++++++++++++++++++++ rpms.in.yaml | 49 ++++++++ 2 files changed, 177 insertions(+) create mode 100644 .github/workflows/update-rpm-lockfile.yaml create mode 100644 rpms.in.yaml diff --git a/.github/workflows/update-rpm-lockfile.yaml b/.github/workflows/update-rpm-lockfile.yaml new file mode 100644 index 000000000..5030148a3 --- /dev/null +++ b/.github/workflows/update-rpm-lockfile.yaml @@ -0,0 +1,128 @@ +name: Update RPM Lockfile + +on: + workflow_dispatch: + schedule: + # Run at 3AM UTC every Monday + - cron: '0 3 * * 1' + push: + branches: + - main + - release-1.** + paths: + - 'rpms.in.yaml' + - '.rhdh/docker/Dockerfile' + - 'Dockerfile' + +permissions: + contents: write + +env: + DOCKERFILE_PATH: .rhdh/docker/Dockerfile + +jobs: + update-lockfile: + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # 4.3.0 + with: + fetch-depth: 0 + + - name: Check if hermetic Dockerfile exists + run: | + if [ ! -f "${{ env.DOCKERFILE_PATH }}" ]; then + echo "Error: ${{ env.DOCKERFILE_PATH }} not found!" + exit 1 + fi + + - name: Configure Git + run: | + git config --global user.name "rhdh-bot" + git config --global user.email "rhdh-bot@redhat.com" + + - name: Install rpm-lockfile-prototype + run: | + if [[ ! -x "${HOME}/.local/bin/rpm-lockfile-prototype" ]]; then + echo "Installing rpm-lockfile-prototype ..." + sudo apt-get update + sudo apt-get install -y python3 python3-pip python3-dev build-essential + sudo apt-get install -y podman skopeo rpm + sudo apt-get install -y dnf python3-dnf + mkdir -p "${HOME}/.local/bin/" + python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip + # Update PATH + export PATH=${PATH%":${HOME}/.local/bin"}:${HOME}/.local/bin + echo "${HOME}/.local/bin" >> $GITHUB_PATH + else + echo "rpm-lockfile-prototype already installed" + fi + + - name: Run rpm-lockfile-prototype + run: | + echo "Running '${HOME}/.local/bin/rpm-lockfile-prototype -f ${{ env.DOCKERFILE_PATH }} rpms.in.yaml' in $(pwd)" + ${HOME}/.local/bin/rpm-lockfile-prototype -f ${{ env.DOCKERFILE_PATH }} rpms.in.yaml + + - name: Check for lockfile changes + id: check-lockfile-changes + run: | + if git diff --quiet rpms.lock.yaml; then + echo "No changes to rpms.lock.yaml detected, skipping PR creation" + echo "changes=false" >> $GITHUB_OUTPUT + else + echo "Changes detected in rpms.lock.yaml, creating PR" + echo "changes=true" >> $GITHUB_OUTPUT + fi + + - name: Determine target branch + id: target-branch + run: | + TARGET_BRANCH="${{ github.ref_name }}" + echo "name=${TARGET_BRANCH}" >> $GITHUB_OUTPUT + echo "Target branch: ${TARGET_BRANCH}" + + - name: Create Pull Request + id: create-pull-request + if: steps.check-lockfile-changes.outputs.changes == 'true' + uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + with: + token: ${{ secrets.RHDH_BOT_TOKEN }} + commit-message: "chore: update rpms.lock.yaml [skip-build]" + title: "chore: update RPM lockfile in branch (${{ steps.target-branch.outputs.name }}) [skip-build]" + body: | + ## Description + This PR updates the `rpms.lock.yaml` file with the latest package versions based on current `rpms.in.yaml` configuration using `${{ env.DOCKERFILE_PATH }}` as the base container context + + This PR was automatically created by the [Update RPM Lockfile GitHub Action](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}). + branch: chore/automated-update-rpm-lockfile/${{ steps.target-branch.outputs.name }} + delete-branch: true + draft: false + sign-commits: true + labels: | + lgtm + approved + add-paths: | + rpms.lock.yaml + + - name: Add /lgtm and /approved comment + if: steps.check-lockfile-changes.outputs.changes == 'true' && steps.create-pull-request.outputs.pull-request-number != '' + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.RHDH_BOT_TOKEN }} + script: | + const body = "/lgtm\n/approved"; + const prNumber = ${{ steps.create-pull-request.outputs.pull-request-number }}; + github.rest.issues.createComment({ + issue_number: parseInt(prNumber), + owner: context.repo.owner, + repo: context.repo.repo, + body: body + }) + + - name: Summary + run: | + if [ "${{ steps.check-lockfile-changes.outputs.changes }}" == "true" ]; then + echo "✅ RPM lockfile updated and created PR: ${{ steps.create-pull-request.outputs.pull-request-url }}" + else + echo "🚫 No changes detected in RPM lockfile" + fi diff --git a/rpms.in.yaml b/rpms.in.yaml new file mode 100644 index 000000000..3c8e63f82 --- /dev/null +++ b/rpms.in.yaml @@ -0,0 +1,49 @@ +# RHDH Operator RPM dependencies +# after editing, run (https://github.com/konflux-ci/rpm-lockfile-prototype): +# rpm-lockfile-prototype -f .rhdh/docker/Dockerfile rpms.in.yaml +# to regenerate rpms.lock.yaml +# +# Note that the repoid values are special, and must be from here: +# https://github.com/release-engineering/rhtap-ec-policy/blob/main/data/known_rpm_repositories.yml + +allowerasing: true +contentOrigin: +repos: + - repoid: ubi-9-for-$basearch-appstream-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os/ + - repoid: ubi-9-for-$basearch-appstream-source-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS + - repoid: ubi-9-for-$basearch-baseos-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os/ + - repoid: ubi-9-for-$basearch-baseos-source-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS + +packages: + # Required for FIPS support in the operator runtime + - openssl + - openssl-libs + - openssl-fips-provider + - openssl-fips-provider-so + # Base dependencies pulled in by openssl + - ca-certificates + - crypto-policies + - crypto-policies-scripts + - glibc + - glibc-common + - glibc-minimal-langpack + - keyutils-libs + - krb5-libs + - libcom_err + - libgcc + - libselinux + - libstdc++ + - libtasn1 + - libunistring + - libxcrypt + - ncurses-base + - ncurses-libs + - p11-kit + - p11-kit-trust + - pcre2 + - readline + - zlib From a637f3b1375bade6305a8c9f66560f0e5976467e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Pola=C5=A1ko?= <50864147+polasudo@users.noreply.github.com> Date: Wed, 21 Jan 2026 08:18:21 +0100 Subject: [PATCH 2/3] Update .github/workflows/update-rpm-lockfile.yaml Co-authored-by: Armel Soro --- .github/workflows/update-rpm-lockfile.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-rpm-lockfile.yaml b/.github/workflows/update-rpm-lockfile.yaml index 5030148a3..b17e15d66 100644 --- a/.github/workflows/update-rpm-lockfile.yaml +++ b/.github/workflows/update-rpm-lockfile.yaml @@ -12,7 +12,7 @@ on: paths: - 'rpms.in.yaml' - '.rhdh/docker/Dockerfile' - - 'Dockerfile' + - '.github/workflows/update-rpm-lockfile.yaml' permissions: contents: write From f97560a63f651621f90413e02ba0694300c254e1 Mon Sep 17 00:00:00 2001 From: Martin Polasko Date: Thu, 22 Jan 2026 13:09:38 +0100 Subject: [PATCH 3/3] chore: add initial rpms.lock.yaml --- rpms.in.yaml | 18 +++--- rpms.lock.yaml | 147 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 156 insertions(+), 9 deletions(-) create mode 100644 rpms.lock.yaml diff --git a/rpms.in.yaml b/rpms.in.yaml index 3c8e63f82..1f3903592 100644 --- a/rpms.in.yaml +++ b/rpms.in.yaml @@ -8,15 +8,15 @@ allowerasing: true contentOrigin: -repos: - - repoid: ubi-9-for-$basearch-appstream-rpms - baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os/ - - repoid: ubi-9-for-$basearch-appstream-source-rpms - baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS - - repoid: ubi-9-for-$basearch-baseos-rpms - baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os/ - - repoid: ubi-9-for-$basearch-baseos-source-rpms - baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS + repos: + - repoid: ubi-9-for-$basearch-appstream-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os/ + - repoid: ubi-9-for-$basearch-appstream-source-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS + - repoid: ubi-9-for-$basearch-baseos-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os/ + - repoid: ubi-9-for-$basearch-baseos-source-rpms + baseurl: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS packages: # Required for FIPS support in the operator runtime diff --git a/rpms.lock.yaml b/rpms.lock.yaml new file mode 100644 index 000000000..e6813ec34 --- /dev/null +++ b/rpms.lock.yaml @@ -0,0 +1,147 @@ +--- +lockfileVersion: 1 +lockfileVendor: redhat +arches: +- arch: x86_64 + packages: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/l/libxcrypt-compat-4.4.18-3.el9.x86_64.rpm + repoid: ubi-9-for-x86_64-appstream-rpms + size: 93189 + checksum: sha256:2bd6c288e1970a001d3a1ae69166c0d926d9c87ce892edcb2110f4e142c12a7a + name: libxcrypt-compat + evr: 4.4.18-3.el9 + sourcerpm: libxcrypt-4.4.18-3.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/p/python-unversioned-command-3.9.25-2.el9_7.noarch.rpm + repoid: ubi-9-for-x86_64-appstream-rpms + size: 9351 + checksum: sha256:ddc75f8460178a142a203ba8d5082c7d58393281238400d11a82cc5ee6487390 + name: python-unversioned-command + evr: 3.9.25-2.el9_7 + sourcerpm: python3.9-3.9.25-2.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/crypto-policies-20250905-1.git377cc42.el9_7.noarch.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 92511 + checksum: sha256:38078d704d7be136211a17da34692e9e669fd59a43ec2e82b22082e280c6f290 + name: crypto-policies + evr: 20250905-1.git377cc42.el9_7 + sourcerpm: crypto-policies-20250905-1.git377cc42.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/c/crypto-policies-scripts-20250905-1.git377cc42.el9_7.noarch.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 104676 + checksum: sha256:5e0cbb9b384a94aebde15ab9a1c01b4dd33c52734e1bb559b43fb18b075295ab + name: crypto-policies-scripts + evr: 20250905-1.git377cc42.el9_7 + sourcerpm: crypto-policies-20250905-1.git377cc42.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/e/expat-2.5.0-5.el9_7.1.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 120241 + checksum: sha256:e8ce7bfb8667fc6e4d080f4cae71e175a25cc78b5389a41e3e2e05ffe8edeafe + name: expat + evr: 2.5.0-5.el9_7.1 + sourcerpm: expat-2.5.0-5.el9_7.1.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-3.5.1-5.el9_7.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 1555474 + checksum: sha256:3bfd7ceb59a554e40cb417e2b5b2d046be671ce49abc058328807049baf1134f + name: openssl + evr: 1:3.5.1-5.el9_7 + sourcerpm: openssl-3.5.1-5.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-fips-provider-3.0.7-8.el9.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 9402 + checksum: sha256:bbf25303def8e1270675531c47bdad432f6ad8ef4c327556ae65bd6abaf8edb5 + name: openssl-fips-provider + evr: 3.0.7-8.el9 + sourcerpm: openssl-fips-provider-3.0.7-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-fips-provider-so-3.0.7-8.el9.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 589811 + checksum: sha256:ab48d98504fae6f8636de027a1ee06d21d5e9c27b7beb247017a6fe55567c5e9 + name: openssl-fips-provider-so + evr: 3.0.7-8.el9 + sourcerpm: openssl-fips-provider-3.0.7-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/o/openssl-libs-3.5.1-5.el9_7.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 2411938 + checksum: sha256:632caf8af918169330719ff0bf79ea7ba3e545a352e3da293df5cf4fbbb70e4d + name: openssl-libs + evr: 1:3.5.1-5.el9_7 + sourcerpm: openssl-3.5.1-5.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-3.9.25-2.el9_7.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 26401 + checksum: sha256:f0aebc2ba2783ad81c9989e23405ce5ccd9f2df0e67d89ce41c61e7c12c6585c + name: python3 + evr: 3.9.25-2.el9_7 + sourcerpm: python3.9-3.9.25-2.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-libs-3.9.25-2.el9_7.x86_64.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 8476647 + checksum: sha256:a4954756304bce5257f4b494c61fee45a1d733e1791fd9a0c3eac6eed97f2e6f + name: python3-libs + evr: 3.9.25-2.el9_7 + sourcerpm: python3.9-3.9.25-2.el9_7.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-pip-wheel-21.3.1-1.el9.noarch.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 1193706 + checksum: sha256:75c46aab03898c66ce16be556432b71aed7efcedce02b9263339c14f57b4fdc0 + name: python3-pip-wheel + evr: 21.3.1-1.el9 + sourcerpm: python-pip-21.3.1-1.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-setuptools-wheel-53.0.0-15.el9.noarch.rpm + repoid: ubi-9-for-x86_64-baseos-rpms + size: 479203 + checksum: sha256:36dacb345e21bc0308ef2508f0c93995520a15ef0b56aab3593186c8dc9c0c5a + name: python3-setuptools-wheel + evr: 53.0.0-15.el9 + sourcerpm: python-setuptools-53.0.0-15.el9.src.rpm + source: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/c/crypto-policies-20250905-1.git377cc42.el9_7.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 107074 + checksum: sha256:a8ccbe1e1a1b7263941b20d156594925a70017d6de72889dfa7618d8b02a33aa + name: crypto-policies + evr: 20250905-1.git377cc42.el9_7 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/e/expat-2.5.0-5.el9_7.1.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 8380127 + checksum: sha256:29a0e23a89d0f1ba640a694688699e1c765c4f5793d9f9c0642a97aa54179664 + name: expat + evr: 2.5.0-5.el9_7.1 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/l/libxcrypt-4.4.18-3.el9.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 543970 + checksum: sha256:d18f72eb41ecd0370e2e47f1dc5774be54e9ff3b4dd333578017666c7c488f40 + name: libxcrypt + evr: 4.4.18-3.el9 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-3.5.1-5.el9_7.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 53367097 + checksum: sha256:281dbaae5d7b8e71144ce6f54bff89d28b9e3f5e7c650148b79ad2944590521a + name: openssl + evr: 1:3.5.1-5.el9_7 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/o/openssl-fips-provider-3.0.7-8.el9.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 89979766 + checksum: sha256:f6e518e04053c5ff00bea751cd9bad3bd7a2be0eb8259b9d45b3cf1a80438bb9 + name: openssl-fips-provider + evr: 3.0.7-8.el9 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/python-pip-21.3.1-1.el9.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 8984717 + checksum: sha256:cb9e0cca3bd8dc24798cf1fb333d574774ce8288598331d44994d768f33648d3 + name: python-pip + evr: 21.3.1-1.el9 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/python-setuptools-53.0.0-15.el9.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 2080284 + checksum: sha256:08d279a3ec69f016e717f56bcec922cd68353fa8acba8de8fb56cf34ebc876a5 + name: python-setuptools + evr: 53.0.0-15.el9 + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/python3.9-3.9.25-2.el9_7.src.rpm + repoid: ubi-9-for-x86_64-baseos-source-rpms + size: 20804484 + checksum: sha256:3e860ebcea7b1aa430712d24968c55c774f06428f2a7f4cb6b772159a67f97fa + name: python3.9 + evr: 3.9.25-2.el9_7 + module_metadata: []