OAPE-829: Add helm auto-rebase - #458
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe change documents the Helm Operator repository scope, improves upstream merge handling, adds an automated rebase and pull request workflow, and removes obsolete Docker image definitions and the ChangesUpstream rebase workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Operator as Operator
participant AutoRebase as hack/auto-rebase.sh
participant Git as Git repository
participant GitHub as GitHub
participant PatchGate as Patch and build validation
Operator->>AutoRebase: select release tag or enable discovery
AutoRebase->>GitHub: detect release tags and existing pull requests
AutoRebase->>Git: fetch upstream and create rebase branch
AutoRebase->>Git: run UPSTREAM-MERGE.sh
AutoRebase->>PatchGate: update builders and run validation
PatchGate-->>AutoRebase: return patch and build status
AutoRebase->>GitHub: push branch and create pull request
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: neha037 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
UPSTREAM-MERGE.sh (1)
49-55: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winFail fast if the branch update steps fail.
git checkout "$rebase_branch"at Line 43 andgit merge "$remote_branch"at Line 49 are unchecked. If either fails, the script continues and creates the rebase branch from the wrong commit. The new force-delete at Lines 50-54 also removes the previous protection from the fallback message at Line 55. Add explicit checks.♻️ Proposed change
-git merge "$remote_branch" +git merge "$remote_branch" || { echo "Failed to merge $remote_branch, aborting."; exit 1; }Apply the same pattern to Line 43:
git checkout "$rebase_branch" || { echo "Failed to checkout $rebase_branch, aborting."; exit 1; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` around lines 49 - 55, Make the branch update steps fail fast: add explicit error handling to git checkout "$rebase_branch" and git merge "$remote_branch" so each prints a failure message and exits nonzero when unsuccessful. Preserve the existing cleanup and rebase-branch creation flow, while retaining a clear fallback message if creating the new branch fails.hack/auto-rebase.sh (2)
237-256: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider a failure trap for diagnostics.
If
./UPSTREAM-MERGE.shfails at Line 238,set -eends the script while the repository is mid-merge andoriginstill holds the token URL. A trap that logs the current branch and merge state helps triage the periodic job.♻️ Proposed change
+ trap 'rc=$?; [[ $rc -ne 0 ]] && log "FAILED (rc=${rc}) on branch $(git rev-parse --abbrev-ref HEAD 2>/dev/null)"; exit $rc' ERR + log "Running UPSTREAM-MERGE.sh ${tag} ${REBASE_BRANCH} ${UPSTREAM_REMOTE}" ./UPSTREAM-MERGE.sh "$tag" "$REBASE_BRANCH" "$UPSTREAM_REMOTE"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/auto-rebase.sh` around lines 237 - 256, Add a failure trap around the main auto-rebase flow containing UPSTREAM-MERGE.sh that logs the current branch and merge state when the merge command fails or the script exits unexpectedly. Ensure the trap also cleans sensitive token-bearing remote configuration before termination, while preserving the existing success, patch-gate, push, and pull-request behavior.
65-71: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAvoid writing the token into
.git/config.
git remote set-urlstoresGITHUB_TOKENin cleartext in.git/config. The token then persists for the rest of the job and in any artifact that archives the workspace. Use a credential store outside the repository instead.🔒️ Proposed change
configure_origin_auth() { if [[ -z "${GITHUB_TOKEN:-}" ]]; then return 0 fi - # Prefer HTTPS with embedded token for non-interactive push. - git remote set-url "$ORIGIN_REMOTE" "https://x-access-token:${GITHUB_TOKEN}`@github.com/`${DEST_ORG_REPO}.git" + # Keep the token out of .git/config; use a short-lived credential file. + local cred_file + cred_file=$(mktemp) + chmod 600 "$cred_file" + printf 'https://x-access-token:%s@github.com\n' "$GITHUB_TOKEN" >"$cred_file" + git config credential.helper "store --file=${cred_file}" + git remote set-url "$ORIGIN_REMOTE" "https://github.com/${DEST_ORG_REPO}.git" + trap 'rm -f "$cred_file"' EXIT }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/auto-rebase.sh` around lines 65 - 71, Update configure_origin_auth to avoid embedding GITHUB_TOKEN in the URL passed to git remote set-url, which persists the token in .git/config. Keep the repository remote URL free of credentials and configure a temporary credential mechanism outside the repository for the non-interactive push, scoped to the job.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/auto-rebase.sh`:
- Around line 8-20: Update the environment-variable documentation header in
auto-rebase.sh to include UPSTREAM_URL and ORIGIN_URL, noting that they control
the repository URLs configured by ensure_remote. Keep the existing descriptions
and defaults unchanged.
- Around line 47-54: Update ensure_remote to avoid silently rewriting an
existing remote URL: either log the URL change clearly before git remote
set-url, or require an explicit caller opt-in before performing it. Preserve
adding missing remotes and ensure the main invocation for ORIGIN_REMOTE no
longer changes a developer’s existing origin unnoticed.
- Around line 73-86: Harden ensure_gh by creating a private temporary directory
with mktemp -d, downloading with curl --fail, and validating the archive against
the release checksum before extraction. Use that directory instead of fixed /tmp
paths, create ${HOME}/bin before the fallback install, and structure
installation failures so they reach the existing die message rather than exiting
early under set -euo pipefail.
In `@README.md`:
- Around line 69-76: Update both shell code fences in the README examples around
the DRY_RUN and FORCE_TAG commands to specify the bash language identifier,
preserving their existing commands and formatting.
In `@UPSTREAM-MERGE.sh`:
- Around line 30-34: Update the sdk_repo validation condition to anchor the
remote URL at its beginning, allowing only known GitHub forms such as
github.com:..., github.com/..., or https://github.com/..., while continuing to
accept the existing repository suffix variants. Keep the rejection message and
exit behavior unchanged.
---
Nitpick comments:
In `@hack/auto-rebase.sh`:
- Around line 237-256: Add a failure trap around the main auto-rebase flow
containing UPSTREAM-MERGE.sh that logs the current branch and merge state when
the merge command fails or the script exits unexpectedly. Ensure the trap also
cleans sensitive token-bearing remote configuration before termination, while
preserving the existing success, patch-gate, push, and pull-request behavior.
- Around line 65-71: Update configure_origin_auth to avoid embedding
GITHUB_TOKEN in the URL passed to git remote set-url, which persists the token
in .git/config. Keep the repository remote URL free of credentials and configure
a temporary credential mechanism outside the repository for the non-interactive
push, scoped to the job.
In `@UPSTREAM-MERGE.sh`:
- Around line 49-55: Make the branch update steps fail fast: add explicit error
handling to git checkout "$rebase_branch" and git merge "$remote_branch" so each
prints a failure message and exits nonzero when unsuccessful. Preserve the
existing cleanup and rebase-branch creation flow, while retaining a clear
fallback message if creating the new branch fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f81b84be-5ebe-46dd-a0ef-71ad683f1615
📒 Files selected for processing (3)
README.mdUPSTREAM-MERGE.shhack/auto-rebase.sh
openshift-ci-robot
added
the
jira/valid-reference
|
@neha037: This pull request references OAPE-829 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
UPSTREAM-MERGE.sh (1)
51-54: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftProtect existing local branch commits before force-deleting.
git branch -Dcan remove the only local reference to unmerged commits in${version}-rebase-${rebase_branch}. The script can be run manually, although the comment describes this cleanup as CI-specific. Gate the deletion to CI, require explicit confirmation, or create a backup reference first.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` around lines 51 - 54, Update the existing-branch cleanup around `${version}-rebase-${rebase_branch}` so `git branch -D` cannot remove unmerged commits without protection. Restrict deletion to CI, require explicit confirmation, or create a backup reference before deleting, while preserving the current cleanup behavior for safe automated runs.
🧹 Nitpick comments (1)
UPSTREAM-MERGE.sh (1)
44-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCheck the tracking-branch command directly.
The code checks
$?after the assignment. Use the assignment in theifcondition and quote'@{u}'. This removes indirect status handling and avoids the ShellCheck warnings.Proposed refactor
-remote_branch=$(git rev-parse --abbrev-ref --symbolic-full-name @{u}) -if [[ $? -ne 0 ]]; then +if ! remote_branch=$(git rev-parse --abbrev-ref --symbolic-full-name '@{u}'); then echo "Your branch is not properly tracking a remote as required, aborting." exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` around lines 44 - 48, Update the tracking-branch lookup in UPSTREAM-MERGE.sh to use the git rev-parse command directly as the if-condition, and quote the @{u} revision argument. Remove the separate $? check while preserving the existing error message and exit behavior when no upstream branch is configured.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/auto-rebase.sh`:
- Around line 152-154: Update the pre-mutation validation in the auto-rebase
flow, before the mutation phase, to reject any non-empty git status --porcelain
output, including untracked files, before reaching the cleanup block containing
git clean -fd. Preserve the existing patch-gate behavior while ensuring
pre-existing untracked work cannot be deleted.
- Around line 77-83: Update the EXIT trap registration in configure_origin_auth
to capture the current cred_file path when the trap is created, rather than
expanding the local variable at process exit. Preserve removal of the temporary
credential file and compatibility with set -u.
In `@UPSTREAM-MERGE.sh`:
- Line 49: Update the tag merge command in the merge flow to handle failures
from `git merge --no-commit tags/"$version"`: continue only when `MERGE_HEAD`
confirms an active conflict state, and otherwise print an abort message and exit
nonzero so staged version changes cannot be committed without the requested tag
merge. Keep the existing successful merge path unchanged.
- Around line 31-33: Update the validation failure branch in UPSTREAM-MERGE.sh
to avoid interpolating the full sdk_repo value in its echo message. Log a fixed,
non-sensitive validation error instead, while preserving the existing rejection
and exit behavior.
- Line 31: Update the remote URL validation condition in the upstream repository
check to reject plain HTTP while continuing to accept HTTPS and supported SSH
forms for operator-framework/operator-sdk, so git fetch only uses encrypted
transport.
---
Outside diff comments:
In `@UPSTREAM-MERGE.sh`:
- Around line 51-54: Update the existing-branch cleanup around
`${version}-rebase-${rebase_branch}` so `git branch -D` cannot remove unmerged
commits without protection. Restrict deletion to CI, require explicit
confirmation, or create a backup reference before deleting, while preserving the
current cleanup behavior for safe automated runs.
---
Nitpick comments:
In `@UPSTREAM-MERGE.sh`:
- Around line 44-48: Update the tracking-branch lookup in UPSTREAM-MERGE.sh to
use the git rev-parse command directly as the if-condition, and quote the @{u}
revision argument. Remove the separate $? check while preserving the existing
error message and exit behavior when no upstream branch is configured.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6b8b077e-6fbe-40b1-a65c-2ec558700927
📒 Files selected for processing (3)
README.mdUPSTREAM-MERGE.shhack/auto-rebase.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
|
/retest |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
UPSTREAM-MERGE.sh (3)
137-137: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winStop when a local commit fails.
The script does not enable
set -e, and thegit commitat Line [137] is unchecked. A hook, signing, identity, or repository-state failure can leave the merge uncommitted while Lines [139]-[154] continue and print completion. The automation wrapper can then publish a branch without the intended merge commit.Guard the commit at Line [137] and the vendor commit at Line [149] with explicit failure handling.
Proposed fix
-git commit -m "Merge upstream tag $version" -m "Operator SDK $version" -m "Merge executed via ./UPSTREAM-MERGE.sh $version $rebase_branch $upstream_remote" -m "$(printf "Overwritten conflicts:\\n%s" "$unmerged_files")" +if ! git commit -m "Merge upstream tag $version" -m "Operator SDK $version" -m "Merge executed via ./UPSTREAM-MERGE.sh $version $rebase_branch $upstream_remote" -m "$(printf "Overwritten conflicts:\\n%s" "$unmerged_files")"; then + echo "Failed to create the upstream merge commit, aborting." + exit 1 +fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` at line 137, Update the git commit commands in UPSTREAM-MERGE.sh, specifically the merge commit near the shown command and the vendor commit near the later commit block, to use explicit failure handling. If either commit fails, immediately stop the script with a nonzero status so subsequent completion or publishing steps cannot run.
43-54: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winEnsure the target branch is checked out.
git checkout "$rebase_branch"can treat a tracked path as a pathspec. If no branch has that name, the command succeeds without changingHEAD, so the later lookup and merge operate on the previously checked-out branch. Use a branch-only command or verifygit symbolic-ref --quiet --short HEADequals$rebase_branch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` around lines 43 - 54, Update the checkout step for rebase_branch to use branch-only checkout semantics, such as the existing branch-specific Git command, so a tracked path cannot be accepted as a successful checkout. Ensure the script aborts when rebase_branch is not actually checked out before performing the upstream lookup and merge.
30-37: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winSecurity Misconfiguration (CWE-346): Origin Validation Error
Exploitability: Moderate
Require explicit upstream URL forms.
Line 31 accepts
github.com/operator-framework/operator-sdkas a local path.git fetchcan then read local Git objects, so the allowlist does not prove that the upstream tag came from GitHub. Accept only explicithttps://github.com/...andgit@github.com:...forms.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@UPSTREAM-MERGE.sh` around lines 30 - 37, Update the sdk_repo validation regex in UPSTREAM-MERGE.sh to accept only explicit HTTPS URLs beginning with https://github.com/operator-framework/operator-sdk and SSH URLs beginning with git@github.com:operator-framework/operator-sdk, while preserving optional .git and trailing-slash handling; reject the bare github.com/operator-framework/operator-sdk form.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@UPSTREAM-MERGE.sh`:
- Line 137: Update the git commit commands in UPSTREAM-MERGE.sh, specifically
the merge commit near the shown command and the vendor commit near the later
commit block, to use explicit failure handling. If either commit fails,
immediately stop the script with a nonzero status so subsequent completion or
publishing steps cannot run.
- Around line 43-54: Update the checkout step for rebase_branch to use
branch-only checkout semantics, such as the existing branch-specific Git
command, so a tracked path cannot be accepted as a successful checkout. Ensure
the script aborts when rebase_branch is not actually checked out before
performing the upstream lookup and merge.
- Around line 30-37: Update the sdk_repo validation regex in UPSTREAM-MERGE.sh
to accept only explicit HTTPS URLs beginning with
https://github.com/operator-framework/operator-sdk and SSH URLs beginning with
git@github.com:operator-framework/operator-sdk, while preserving optional .git
and trailing-slash handling; reject the bare
github.com/operator-framework/operator-sdk form.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3d1e734e-82ff-4ead-abd7-49a5b0d4d2ad
📒 Files selected for processing (3)
README.mdUPSTREAM-MERGE.shhack/auto-rebase.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- README.md
- hack/auto-rebase.sh
|
/retest |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/auto-rebase.sh`:
- Around line 145-147: Update open_pr_exists so failures from gh pr list are
detected and propagated instead of treating an empty count as no open PR.
Preserve the existing count-based success check, but explicitly return a failure
status when the query command fails so the caller stops before rebasing.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 830049cc-c20e-4359-8f3b-abe277a0cfc3
📒 Files selected for processing (9)
README.mdUPSTREAM-MERGE.shci/dockerfiles/builder.Dockerfileci/dockerfiles/go-e2e.Dockerfileci/dockerfiles/helm-e2e.Dockerfileci/dockerfiles/scorecard-proxy.Dockerfileci/prow.Makefilehack/auto-rebase.shrelease/helm/upstream.Dockerfile
💤 Files with no reviewable changes (5)
- ci/dockerfiles/helm-e2e.Dockerfile
- ci/dockerfiles/scorecard-proxy.Dockerfile
- ci/dockerfiles/builder.Dockerfile
- ci/dockerfiles/go-e2e.Dockerfile
- release/helm/upstream.Dockerfile
🚧 Files skipped from review as they are similar to previous changes (2)
- README.md
- UPSTREAM-MERGE.sh
|
/retest |
1 similar comment
|
/retest |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@UPSTREAM-MERGE.sh`:
- Line 49: Update the git merge failure handler in UPSTREAM-MERGE.sh to check
whether MERGE_HEAD exists and abort the in-progress merge before exiting.
Preserve the existing failure message and exit status for all merge failures.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 925ae044-d2b5-4176-9978-3a505ba083df
📒 Files selected for processing (7)
README.mdUPSTREAM-MERGE.shci/dockerfiles/go-e2e.Dockerfileci/dockerfiles/scorecard-proxy.Dockerfileci/prow.Makefilehack/auto-rebase.shrelease/helm/upstream.Dockerfile
💤 Files with no reviewable changes (3)
- release/helm/upstream.Dockerfile
- ci/dockerfiles/scorecard-proxy.Dockerfile
- ci/dockerfiles/go-e2e.Dockerfile
🚧 Files skipped from review as they are similar to previous changes (3)
- ci/prow.Makefile
- README.md
- hack/auto-rebase.sh
19883d9 to
5572534
Compare
|
@neha037: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Description of the change:
Adds
hack/auto-rebase.sh— a Prow periodic wrapper that automates rebasing this midstream onto newer upstream Operator SDK release tags. Also hardensUPSTREAM-MERGE.sh(URL validation, merge-failure handling, conflict resolution) and removes obsolete Dockerfiles / CI targets that are no longer used.Key files:
hack/auto-rebase.sh— discovers the newest upstreamv*tag beyondUPSTREAM-VERSION, runsUPSTREAM-MERGE.sh, updates golang builder pins, runs patch/build gate, pushes a branch, and opens a PR. Does not auto-merge.UPSTREAM-MERGE.sh— improved upstream URL regex (accepts HTTPS and SSH), proper merge-abort on conflict,while readconflict resolution loop.README.md— documents the Helm Operator focus, automatic rebase workflow, CI credentials, and local dry-run instructions.Removed dead files:
ci/dockerfiles/go-e2e.Dockerfile,ci/dockerfiles/scorecard-proxy.Dockerfile,release/helm/upstream.Dockerfile, and theci-imagesMakefile target.Companion Prow periodic job PR: openshift/release#82799
Motivation for the change:
Manual upstream rebases are error-prone and easy to forget. Automating the process (OAPE-829) ensures timely rebase PRs are opened weekly, reducing toil and keeping the Helm Operator midstream current with upstream Operator SDK releases.
Checklist
If the pull request includes user-facing changes, extra documentation is required: