[release-1.9] feat: add RPM lockfile automation workflow - #2156

- name: Install rpm-lockfile-prototype
  run: |
    if [[ ! -x "${HOME}/.local/bin/rpm-lockfile-prototype" ]]; then
      echo "Installing rpm-lockfile-prototype ..."
      sudo apt-get update
      sudo apt-get install -y python3 python3-pip python3-dev build-essential
      sudo apt-get install -y podman skopeo rpm
      sudo apt-get install -y dnf python3-dnf
      mkdir -p "${HOME}/.local/bin/"
      python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip
      # Update PATH
      export PATH=${PATH%":${HOME}/.local/bin"}:${HOME}/.local/bin
      echo "${HOME}/.local/bin" >> $GITHUB_PATH

- name: Create Pull Request
  id: create-pull-request
  if: steps.check-lockfile-changes.outputs.changes == 'true'
  uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
  with:
    token: ${{ secrets.RHDH_BOT_TOKEN }}
    commit-message: "chore: update rpms.lock.yaml [skip-build]"
    title: "chore: update RPM lockfile in branch (${{ steps.target-branch.outputs.name }}) [skip-build]"
    body: |
      ## Description
      This PR updates the `rpms.lock.yaml` file with the latest package versions based on current `rpms.in.yaml` configuration using `${{ env.DOCKERFILE_PATH }}` as the base container context

      This PR was automatically created by the [Update RPM Lockfile GitHub Action](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
    branch: chore/automated-update-rpm-lockfile/${{ steps.target-branch.outputs.name }}
    delete-branch: true
    draft: false
    sign-commits: true
    labels: |
      lgtm
      approved
    add-paths: |
      rpms.lock.yaml

- name: Add /lgtm and /approved comment
  if: steps.check-lockfile-changes.outputs.changes == 'true' && steps.create-pull-request.outputs.pull-request-number != ''
  uses: actions/github-script@v7
  with:
    github-token: ${{ secrets.RHDH_BOT_TOKEN }}
    script: |
      const body = "/lgtm\n/approved";
      const prNumber = ${{ steps.create-pull-request.outputs.pull-request-number }};
      github.rest.issues.createComment({
        issue_number: parseInt(prNumber),
        owner: context.repo.owner,
        repo: context.repo.repo,
        body: body
      })

# in .github/workflows/update-rpm-lockfile.yaml
# ...
  - name: Create Pull Request
    if: steps.check-lockfile-changes.outputs.changes == 'true'
    uses: peter-evans/create-pull-request@...
    with:
      # ...
      labels: |
        lgtm
        approved
      # ...

  - name: Add /lgtm and /approved comment
    if: steps.check-lockfile-changes.outputs.changes == 'true' && ...
    uses: actions/github-script@v7
    with:
      script: |
        const body = "/lgtm\n/approved";
        github.rest.issues.createComment(...)

# in .github/workflows/update-rpm-lockfile.yaml
# ...
  - name: Create Pull Request
    if: steps.check-lockfile-changes.outputs.changes == 'true'
    uses: peter-evans/create-pull-request@...
    with:
      # ...
      # The 'lgtm' and 'approved' labels are removed to enforce manual review.
      # A label like 'dependencies' or 'automated-pr' could be used instead.
      labels: dependencies
      # ...

  # The step to add '/lgtm' and '/approved' comments is removed entirely.