OAPE-829: Add helm auto-rebase

README.md

@@ -33,6 +33,52 @@ The downstream ci files are as follows:
 
 When an upstream release is ready, you can sync down that release downstream.
 
+This midstream primarily ships the **Helm Operator** image for OpenShift
+(`release/helm/`). Upstream Operator SDK tags are merged into this repo with
+[`UPSTREAM-MERGE.sh`](./UPSTREAM-MERGE.sh). Downstream-only packaging for the
+`operator-sdk` binary was removed (OAPE-110); Ansible scaffolding comes from an
+external plugin module.
+
+### Automatic rebase (periodic)
+
+A Prow periodic (OAPE-829) runs [`hack/auto-rebase.sh`](./hack/auto-rebase.sh)
+weekly against `main`. That wrapper:
+
+1. Compares [`UPSTREAM-VERSION`](./UPSTREAM-VERSION) to the newest upstream
+   `v*` release tag on `operator-framework/operator-sdk`.
+2. If a newer tag exists (and no rebase branch/PR already covers it), runs
+   `./UPSTREAM-MERGE.sh <tag> main`.
+3. Updates golang builder pins in `.ci-operator.yaml` and
+   `release/helm/Dockerfile` if the upstream golang version changed.
+4. Verifies patches and build with `make -f ci/prow.Makefile patch build`.
+5. Pushes `$tag-rebase-main` and opens a PR. It does **not** auto-merge.
+
+**Still manual after the bot opens a PR:** review conflict fallout, fix or drop
+patches that no longer apply, add any needed `UPSTREAM: <carry>:` commits, and
+merge. ART image-consistency bumps for Dockerfiles are unrelated and continue
+separately.
+
+**CI credentials:** the periodic uses the OAPE team's GitHub App
+(`openshift-app-platform-shift-bot`) via the existing `test-credentials`
+secret `openshift-app-platform-shift-github-bot` — the same bot used by
+`openshift-eng/oape-ai-e2e`. The App must be **installed** on
+`openshift/ocp-release-operator-sdk` with `contents:write` and
+`pull_requests:write` permissions.
+
+**Prerequisites:** `git`, `gh` (GitHub CLI), `make`.
+
+Local dry-run (no push/PR):
+
+```bash
+DRY_RUN=1 ./hack/auto-rebase.sh
+```
+
+Force a specific tag (for testing):
+
+```bash
+FORCE_TAG=v1.42.3 DRY_RUN=1 ./hack/auto-rebase.sh
+```
+
 ### Verify upstream
 
 Verify you have the upstream repo as a remote:
@@ -66,7 +112,7 @@ you want. In this steps below we will sync `v1.4.1` to `main`.
 
 To build simply use the `UPSTREAM-MERGE.sh` script.
 
-`./UPSTREAM-MEGE.sh <UPSTREAM-TAG>`
+`./UPSTREAM-MERGE.sh <UPSTREAM-TAG>`
 
 Here is an example run using upstream tag `v1.4.1`
 

UPSTREAM-MERGE.sh

@@ -27,29 +27,46 @@ if [[ -z "$version" ]]; then
 fi
 
 sdk_repo=$(git remote get-url "$upstream_remote")
-if [[ $sdk_repo != "https://github.com/operator-framework/operator-sdk.git" ]]; then
-  echo "Upstream remote url should be set to kubernetes-sigs repo."
+# Accept HTTPS and SSH forms for operator-framework/operator-sdk (CI may rewrite remotes).
+if [[ ! "$sdk_repo" =~ ^((https|ssh)://)?((git@)?github\.com[:/])operator-framework/operator-sdk(\.git)?/?$ ]]; then
+  echo "Upstream remote url should point at operator-framework/operator-sdk via HTTPS or SSH (git@/https:///ssh://)."
   exit 1
 fi
 
 # check state of working directory
-git diff-index --quiet HEAD || { printf "!! Git status not clean, aborting !!\\n\\n%s" "$(git status)"; exit 1; }
+git diff-index --quiet HEAD || { printf "!! Git status not clean, aborting !!\n\n%s" "$(git status)"; exit 1; }
 
 # update remote, including tags (-t)
 git fetch -t "$upstream_remote"
 
 # do work on the correct branch
-git checkout "$rebase_branch"
+git checkout "$rebase_branch" || { echo "Failed to checkout $rebase_branch, aborting."; exit 1; }
 remote_branch=$(git rev-parse --abbrev-ref --symbolic-full-name @{u})
 if [[ $? -ne 0 ]]; then
-  echo "Your branch is not properly tracking upstream as required, aborting."
+  echo "Your branch is not properly tracking a remote as required, aborting."
   exit 1
 fi
-git merge "$remote_branch"
+if ! git merge "$remote_branch"; then
+  if git rev-parse -q --verify MERGE_HEAD >/dev/null; then
+    git merge --abort || { echo "Failed to abort merge $remote_branch."; exit 1; }
+  fi
+  echo "Failed to merge $remote_branch, aborting."
+  exit 1
+fi
+# Replace a leftover local rebase branch from a prior failed attempt when running in CI.
+if git show-ref --verify --quiet "refs/heads/${version}-rebase-${rebase_branch}"; then
+  echo "Deleting existing local branch ${version}-rebase-${rebase_branch}"
+  git branch -D "${version}-rebase-${rebase_branch}"
+fi
 git checkout -b "$version"-rebase-"$rebase_branch" || { echo "Expected branch $version-rebase-$rebase_branch to not exist, delete and retry."; exit 1; }
 
 # do the merge, but don't commit so tweaks below are included in commit
-git merge --no-commit tags/"$version"
+if ! git merge --no-commit "tags/$version"; then
+  if ! git rev-parse -q --verify MERGE_HEAD >/dev/null; then
+    echo "Failed to merge tags/$version, aborting."
+    exit 1
+  fi
+fi
 
 # preserve our version of these files
 # git checkout HEAD -- OWNERS Makefile .gitignore
@@ -60,33 +77,23 @@ unmerged_files=$(git diff --name-only --diff-filter=U --exit-code)
 differences=$?
 
 if [[ $differences -eq 1 ]]; then
-  unmerged_files_oneline=$(echo "$unmerged_files" | paste -s -d ' ')
-  unmerged=$(git status --porcelain $unmerged_files_oneline | sed 's/ /,/')
-
-  # both deleted => remove => DD
-  # added by us => remove => AU
-  # deleted by them => remove  => UD
-  # deleted by us => remove => DU
-  # added by them => add => UA
-  # both added => take theirs => AA
-  # both modified => take theirs => UU
-  for line in $unmerged
-  do
-      IFS=","
-      set $line
-      case $1 in
-          "DD" | "AU" | "UD" | "DU")
-          git rm -- $2
-          ;;
-          "UA")
-          git add -- $2
-          ;;
-          "AA" | "UU")
-          git checkout --theirs -- $2
-          git add -- $2
-          ;;
-      esac
-  done
+  # Resolve each unmerged file: remove deletions, take upstream on conflicts.
+  while IFS= read -r fname; do
+    [[ -n "$fname" ]] || continue
+    sts=$(git status --porcelain -- "$fname" | cut -c1-2)
+    case "$sts" in
+      DD|AU|UD|DU)
+        git rm -- "$fname"
+        ;;
+      UA)
+        git add -- "$fname"
+        ;;
+      AA|UU)
+        git checkout --theirs -- "$fname"
+        git add -- "$fname"
+        ;;
+    esac
+  done <<< "$unmerged_files"
 
   if [[ $(git diff --check) ]]; then
     echo "All conflict markers should have been taken care of, aborting."
@@ -123,7 +130,7 @@ git add patches/03-setversion.patch
 git diff --staged --quiet && { echo "No changed files in merge?! Aborting."; exit 1; }
 
 # make local commit
-git commit -m "Merge upstream tag $version" -m "Operator SDK $version" -m "Merge executed via ./UPSTREAM-MERGE.sh $version $upstream_remote $rebase_branch" -m "$(printf "Overwritten conflicts:\\n%s" "$unmerged_files")"
+git commit -m "Merge upstream tag $version" -m "Operator SDK $version" -m "Merge executed via ./UPSTREAM-MERGE.sh $version $rebase_branch $upstream_remote" -m "$(printf "Overwritten conflicts:\\n%s" "$unmerged_files")"
 
 # verify merge is correct
 git --no-pager log --oneline "$(git merge-base origin/"$rebase_branch" tags/"$version")"..tags/"$version"

ci/prow.Makefile

@@ -25,7 +25,4 @@ test-e2e-helm: patch
 test-subcommand: patch
 	./ci/tests/subcommand.sh
 
-ci-images:
-	docker build -f ci/dockerfiles/builder.Dockerfile -t osdk-builder .
-
-.PHONY: patch build test-e2e-go test-e2e-helm patch test-subcommand ci-images
+.PHONY: patch build test-e2e-go test-e2e-helm patch test-subcommand