[release-1.9] ci: auto-update bundle manifests on same-repo PRs - #3227
Merged
rm3l merged 1 commit intoJul 20, 2026
Conversation
|
PR Summary by QodoCI: auto-update bundle manifests on same-repo PRs
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
rm3l
deleted the
cherry-pick/release-1.9/ci/auto-update-bundle-manifests-on-pr
branch
July 20, 2026 16:22
Code Review by Qodo
1. check step lacks strict mode
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
+41
to
+51
| run: | | ||
| # Since operator-sdk 1.26.0, `make bundle` changes the `createdAt` field from the bundle every time we run it. | ||
| # The `git diff` below checks if only the createdAt field has changed. If it is the only change, it is ignored. | ||
| # Inspired from https://github.com/operator-framework/operator-sdk/issues/6285#issuecomment-1415350333 | ||
| if git diff --quiet -I'^ createdAt: ' bundle config dist; then | ||
| echo "✅ Bundle manifests are up to date" | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "Bundle manifests are out of sync" | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| fi |
There was a problem hiding this comment.
1. check step lacks strict mode 📘 Rule violation ☼ Reliability
The workflow run scripts do not enable strict mode (e.g., set -euo pipefail) and do not validate required runtime env vars (like GITHUB_OUTPUT), reducing robustness and making failures easier to miss in CI. This violates the shell hardening compliance requirements for script blocks executed in the workflow, including critical git operations.
Agent Prompt
## Issue description
The workflow contains multi-line `run` scripts that do not explicitly enable strict mode (`set -euo pipefail`) and, where applicable, do not validate required runtime environment variables (e.g., `GITHUB_OUTPUT`) before use. This can allow silent/partial failures (including during critical git operations) and violates the shell hardening compliance requirements for CI scripts.
## Issue Context
PR Compliance ID 5 requires hardened shell scripting practices in CI, including strict mode and validating required env vars to ensure predictable failure handling and to prevent brittle behavior (ShellCheck-aligned practices). The affected steps include `Check for changes` (writes to `GITHUB_OUTPUT`) and `Auto-commit and push updated bundle manifests` (runs multiple `git` commands).
## Fix Focus Areas
- .github/workflows/pr-bundle-diff-checks.yaml[41-51]
- .github/workflows/pr-bundle-diff-checks.yaml[61-76]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
45
to
+51
| if git diff --quiet -I'^ createdAt: ' bundle config dist; then | ||
| echo "✅ Bundle manifests are up to date" | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "Bundle manifests are out of sync" | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| fi |
There was a problem hiding this comment.
3. Untracked outputs not detected 🐞 Bug ≡ Correctness
The workflow decides whether manifests changed using only git diff, which ignores untracked files, so newly generated files under bundle/, config/, or dist/ can be missed and the workflow will incorrectly set changed=false. This can let out-of-sync generated outputs pass without failing and without triggering the auto-commit/push.
Agent Prompt
## Issue description
The change detection step uses `git diff` only. `git diff` does not report newly created untracked files, so the workflow can incorrectly conclude there were no changes and skip both the auto-push attempt and the failure gate.
## Issue Context
`make bundles build-installers` can create new output files (e.g., `dist/<profile>/install.yaml`). Profiles are derived from directories under `config/manifests`, so a PR adding a new profile directory can generate new files that are untracked until added.
## Fix Focus Areas
- .github/workflows/pr-bundle-diff-checks.yaml[39-51]
- Makefile[1-1]
- Makefile[269-280]
## Proposed fix
Update the "Check for changes" step to consider both:
1) tracked diffs (ignoring createdAt), AND
2) untracked files under `bundle`, `config`, and `dist`.
Example approach (bash):
- Keep the existing `git diff --quiet -I'^ createdAt: '` check.
- Add an untracked check such as:
- `UNTRACKED=$(git ls-files --others --exclude-standard bundle config dist)`
- Treat `changed=true` if `UNTRACKED` is non-empty.
This preserves the createdAt ignore logic while preventing false "no changes" when new generated files appear.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual cherry-pick of #3169