From 482b3afda4c5c9bbc70e5cdde963d9a5bf244075 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 23 Jul 2026 16:47:42 +0200 Subject: [PATCH 1/4] chore(Konflux): Enable MintMaker auto-merge (#170) --- .github/renovate.json5 | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 0370332..6903ae9 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -32,20 +32,23 @@ "tekton", ], "dockerfile": { + "automerge": true, "includePaths": [ "konflux.Dockerfile", ], }, "rpm-lockfile": { + "automerge": true, "schedule": [ // Duplicate the schedule here because Konflux global config may have a special override for rpm-lockfile. - "* 3-7 * * *", + "* 2-8 * * *", ], }, "tekton": { + "automerge": true, "schedule": [ // Duplicate the schedule here because Konflux global config may have a special override for tekton. - "* 3-7 * * *", + "* 2-8 * * *", ], }, } From 9720a27d364eb4b25d4b34b5a630a79d73166415 Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 30 Jul 2026 17:18:43 +0200 Subject: [PATCH 2/4] chore(release): Add start Y release script (#179) --- scripts/start-y-stream-release.sh | 267 ++++++++++++++++++ scripts/templates/release-kustomization.yaml | 35 +++ .../release-plan-admission-prod.yaml | 48 ++++ .../release-plan-admission-stage.yaml | 48 ++++ 4 files changed, 398 insertions(+) create mode 100755 scripts/start-y-stream-release.sh create mode 100644 scripts/templates/release-kustomization.yaml create mode 100644 scripts/templates/release-plan-admission-prod.yaml create mode 100644 scripts/templates/release-plan-admission-stage.yaml diff --git a/scripts/start-y-stream-release.sh b/scripts/start-y-stream-release.sh new file mode 100755 index 0000000..4ea6533 --- /dev/null +++ b/scripts/start-y-stream-release.sh @@ -0,0 +1,267 @@ +#!/usr/bin/env bash + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)" +TEMPLATE_DIR="${SCRIPT_DIR}/templates" + +VERSION="" +KONFLUX_DATA_REPO="" +VERSION_DASHED="" + +usage() { + cat < + +Start a Y-stream release of agentic cluster security suite. + +Creates release branches, updates Tekton pipelines, generates Konflux +configuration, and commits changes locally. Review the diff before pushing. + +Arguments: + version Version in X.Y format (e.g., 1.5) + konflux-data-repo Path to the konflux-release-data repository + +Options: + -h, --help Show this help message + +Example: + $(basename "$0") 1.5 /path/to/konflux-release-data +EOF + exit 0 +} + +log() { + echo "==> $*" +} + +error() { + echo "ERROR: $*" >&2 + exit 1 +} + +parse_args() { + local positional=() + while [[ $# -gt 0 ]]; do + case "$1" in + -h|--help) + usage + ;; + -*) + error "Unknown option: $1" + ;; + *) + positional+=("$1") + shift + ;; + esac + done + + if [[ ${#positional[@]} -ne 2 ]]; then + error "Expected 2 positional arguments: . Got ${#positional[@]}." + fi + + export VERSION="${positional[0]}" + KONFLUX_DATA_REPO="${positional[1]}" + export VERSION_DASHED="${VERSION//./-}" +} + +validate_inputs() { + if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+$ ]]; then + error "Version must be in X.Y format (e.g., 1.5). Got: ${VERSION}" + fi + + if ! command -v yq &>/dev/null; then + error "yq is required but not found in PATH" + fi + + if ! command -v git &>/dev/null; then + error "git is required but not found in PATH" + fi + + if ! command -v kustomize &>/dev/null; then + error "kustomize is required but not found in PATH (needed by build-single.sh)" + fi + + if [[ ! -d "${KONFLUX_DATA_REPO}" ]]; then + error "konflux-data-repo directory does not exist: ${KONFLUX_DATA_REPO}" + fi + + if [[ ! -d "${KONFLUX_DATA_REPO}/.git" ]]; then + error "konflux-data-repo is not a git repository: ${KONFLUX_DATA_REPO}" + fi + + if [[ ! -d "${TEMPLATE_DIR}" ]]; then + error "Templates directory not found: ${TEMPLATE_DIR}" + fi + + local yq_version + yq_version=$(yq --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+') + # Get yq version, sort with 4.52.1 -> check that oldest version is 4.52.1. + if ! printf '%s\n' "4.52.1" "${yq_version}" | sort -V | head -n1 | grep -q "4.52.1"; then + error "yq version 4.52.1 or higher is required. Found: ${yq_version}" + fi +} + +prepare_stackrox_mcp_branch() { + local branch="release-${VERSION}" + + log "Fetching origin in stackrox-mcp..." + git -C "${SCRIPT_DIR}/.." fetch origin + + # -B resets the branch if it already exists, so reruns discard local unpushed commits. + log "Creating branch ${branch} from origin/main..." + git -C "${SCRIPT_DIR}/.." checkout -B "${branch}" origin/main +} + +update_tekton_pipelines() { + local tekton_dir="${SCRIPT_DIR}/../.tekton" + local files=( + "${tekton_dir}/acs-mcp-server-pull-request.yaml" + "${tekton_dir}/acs-mcp-server-push-main.yaml" + "${tekton_dir}/acs-mcp-server-push-release.yaml" + ) + + log "Updating Tekton pipeline files..." + for file in "${files[@]}"; do + if [[ ! -f "${file}" ]]; then + error "Tekton file not found: ${file}" + fi + + log " Updating $(basename "${file}")..." + + yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/application" = "agentic-cluster-security-suite-" + env(VERSION_DASHED)' "${file}" + yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/component" = "acs-mcp-server-" + env(VERSION_DASHED)' "${file}" + yq -i --yaml-compact-seq-indent '.spec.taskRunTemplate.serviceAccountName = "build-pipeline-acs-mcp-server-" + env(VERSION_DASHED)' "${file}" + yq -i --yaml-compact-seq-indent '(.spec.params[] | select(.name == "extra-labels") | .value[] | select(test("X\\.Y"))) |= sub("X\\.Y", env(VERSION))' "${file}" + done +} + +commit_stackrox_mcp() { + local repo_dir="${SCRIPT_DIR}/.." + + git -C "${repo_dir}" add .tekton/ + if git -C "${repo_dir}" diff --cached --quiet; then + log "No changes to commit in stackrox-mcp (already up to date)" + else + log "Committing Tekton pipeline changes..." + git -C "${repo_dir}" commit -m "Configure Konflux pipelines for release ${VERSION}" + fi +} + +prepare_konflux_data_branch() { + local branch="agentic-suite-release-${VERSION_DASHED}" + + log "Fetching origin in konflux-release-data..." + git -C "${KONFLUX_DATA_REPO}" fetch origin + + # -B resets the branch if it already exists, so reruns discard local unpushed commits. + log "Creating branch ${branch} from origin/main..." + git -C "${KONFLUX_DATA_REPO}" checkout -B "${branch}" origin/main +} + +create_release_plan_admissions() { + local rpa_dir="${KONFLUX_DATA_REPO}/config/kflux-prd-rh02.0fk9.p1/product/ReleasePlanAdmission/agentic-cluster-security-suite" + + if [[ ! -d "${rpa_dir}" ]]; then + error "ReleasePlanAdmission directory not found: ${rpa_dir}" + fi + + create_rpa_file "stage" + create_rpa_file "prod" +} + +create_rpa_file() { + export RPA_ENV="$1" + local rpa_dir="${KONFLUX_DATA_REPO}/config/kflux-prd-rh02.0fk9.p1/product/ReleasePlanAdmission/agentic-cluster-security-suite" + local template="${TEMPLATE_DIR}/release-plan-admission-${RPA_ENV}.yaml" + local target="${rpa_dir}/agentic-cluster-security-suite-${RPA_ENV}-${VERSION_DASHED}.yaml" + + log "Creating ${RPA_ENV} ReleasePlanAdmission..." + cp "${template}" "${target}" + + yq -i '.metadata.name = "agentic-cluster-security-suite-" + env(RPA_ENV) + "-" + env(VERSION_DASHED)' "${target}" + yq -i '.spec.applications[0] = "agentic-cluster-security-suite-" + env(VERSION_DASHED)' "${target}" + yq -i '.spec.data.releaseNotes.product_version = env(VERSION)' "${target}" + yq -i '.spec.data.mapping.components[0].name = "acs-mcp-server-" + env(VERSION_DASHED)' "${target}" + yq -i '(.spec.data.mapping.defaults.tags[] | select(test("X\\.Y"))) |= sub("X\\.Y", env(VERSION))' "${target}" +} + +create_release_kustomization() { + local tenant_base="${KONFLUX_DATA_REPO}/tenants-config/cluster/kflux-prd-rh02/tenants/agentic-cluster-security-suite-tenant/agentic-cluster-security-suite" + local release_dir="${tenant_base}/release-${VERSION}" + + log "Creating release-${VERSION} kustomization directory..." + mkdir -p "${release_dir}" + + cp "${TEMPLATE_DIR}/release-kustomization.yaml" "${release_dir}/kustomization.yaml" + + local target="${release_dir}/kustomization.yaml" + yq -i '.patches[0].patch |= sub("release-X\\.Y", "release-" + env(VERSION))' "${target}" + yq -i '.transformers[0] |= sub("-X-Y", "-" + env(VERSION_DASHED))' "${target}" +} + +update_parent_kustomization() { + local parent_kustomization="${KONFLUX_DATA_REPO}/tenants-config/cluster/kflux-prd-rh02/tenants/agentic-cluster-security-suite-tenant/agentic-cluster-security-suite/kustomization.yaml" + + if [[ ! -f "${parent_kustomization}" ]]; then + error "Parent kustomization.yaml not found: ${parent_kustomization}" + fi + + log "Adding release-${VERSION} to parent kustomization.yaml..." + yq -i '.resources |= (. + ["release-" + env(VERSION)] | unique)' "${parent_kustomization}" +} + +run_kustomize_build() { + local tenants_config_dir="${KONFLUX_DATA_REPO}/tenants-config" + + if [[ ! -f "${tenants_config_dir}/build-single.sh" ]]; then + error "build-single.sh not found in: ${tenants_config_dir}" + fi + + log "Running kustomize build validation..." + (cd "${tenants_config_dir}" && bash ./build-single.sh agentic-cluster-security-suite-tenant) +} + +commit_konflux_data() { + git -C "${KONFLUX_DATA_REPO}" add \ + config/kflux-prd-rh02.0fk9.p1/product/ReleasePlanAdmission/agentic-cluster-security-suite/ \ + tenants-config/cluster/kflux-prd-rh02/tenants/agentic-cluster-security-suite-tenant/ \ + tenants-config/auto-generated/cluster/kflux-prd-rh02/tenants/agentic-cluster-security-suite-tenant + if git -C "${KONFLUX_DATA_REPO}" diff --cached --quiet; then + log "No changes to commit in konflux-release-data (already up to date)" + else + log "Committing changes in konflux-release-data..." + git -C "${KONFLUX_DATA_REPO}" commit -m "Add agentic-cluster-security-suite release ${VERSION} configuration" + fi +} + +main() { + parse_args "$@" + validate_inputs + + log "Starting Y-stream release ${VERSION} (dashed: ${VERSION_DASHED})" + + log "" + log "=== Part 1: stackrox-mcp ===" + prepare_stackrox_mcp_branch + update_tekton_pipelines + commit_stackrox_mcp + + log "" + log "=== Part 2: konflux-release-data ===" + prepare_konflux_data_branch + create_release_plan_admissions + create_release_kustomization + update_parent_kustomization + run_kustomize_build + commit_konflux_data + + log "" + log "Y-stream release ${VERSION} setup complete!" + log "Review changes before pushing:" + log " git -C ${SCRIPT_DIR}/.. diff HEAD~1" + log " git -C ${KONFLUX_DATA_REPO} diff HEAD~1" +} + +main "$@" diff --git a/scripts/templates/release-kustomization.yaml b/scripts/templates/release-kustomization.yaml new file mode 100644 index 0000000..1a1c9ca --- /dev/null +++ b/scripts/templates/release-kustomization.yaml @@ -0,0 +1,35 @@ +--- +resources: + - ../_base + - ../_release-plans + +patches: + - target: + kind: Component + name: acs-mcp-server + patch: | + apiVersion: appstudio.redhat.com/v1alpha1 + kind: Component + metadata: + name: component + spec: + source: + git: + revision: release-X.Y + +transformers: + - |- + apiVersion: builtin + kind: PrefixSuffixTransformer + metadata: + name: suffixTransformer + suffix: -X-Y + fieldSpecs: + - path: /spec/application + - path: /spec/displayName + - path: /spec/componentName + - path: /metadata/name + - path: /metadata/labels/release.appstudio.openshift.io\/releasePlanAdmission + - path: /metadata/labels/appstudio.redhat.com\/application + - path: /metadata/labels/appstudio.redhat.com\/component + - path: /subjects/name diff --git a/scripts/templates/release-plan-admission-prod.yaml b/scripts/templates/release-plan-admission-prod.yaml new file mode 100644 index 0000000..3ad1e2a --- /dev/null +++ b/scripts/templates/release-plan-admission-prod.yaml @@ -0,0 +1,48 @@ +--- +apiVersion: appstudio.redhat.com/v1alpha1 +kind: ReleasePlanAdmission +metadata: + annotations: + rhel_target: "el9" + labels: + release.appstudio.openshift.io/block-releases: "false" + pp.engineering.redhat.com/business-unit: hybrid-platforms + name: agentic-cluster-security-suite-prod-X-Y + namespace: rhtap-releng-tenant +spec: + applications: [agentic-cluster-security-suite-X-Y] + origin: agentic-cluster-security-suite-tenant + policy: registry-standard + data: + releaseNotes: + product_id: [1126] + product_name: "agentic cluster security suite" + product_version: "X.Y" + mapping: + components: + - name: acs-mcp-server-X-Y + repositories: + - url: "registry.redhat.io/agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" + defaults: + tags: + - "{{ git_sha }}" + - "{{ git_short_sha }}" + - "X.Y" + - "X.Y-{{ timestamp }}" + pushSourceContainer: true + intention: production + enforceContainerFirstSecurityLabels: true + pipeline: + pipelineRef: + resolver: git + params: + - name: url + value: "https://github.com/konflux-ci/release-service-catalog.git" + - name: revision + value: production + - name: pathInRepo + value: "pipelines/managed/rh-advisories/rh-advisories.yaml" + serviceAccountName: release-registry-prod + timeouts: + pipeline: "01h0m0s" + tasks: 01h0m0s diff --git a/scripts/templates/release-plan-admission-stage.yaml b/scripts/templates/release-plan-admission-stage.yaml new file mode 100644 index 0000000..5555eeb --- /dev/null +++ b/scripts/templates/release-plan-admission-stage.yaml @@ -0,0 +1,48 @@ +--- +apiVersion: appstudio.redhat.com/v1alpha1 +kind: ReleasePlanAdmission +metadata: + annotations: + rhel_target: "el9" + labels: + release.appstudio.openshift.io/block-releases: "false" + pp.engineering.redhat.com/business-unit: hybrid-platforms + name: agentic-cluster-security-suite-stage-X-Y + namespace: rhtap-releng-tenant +spec: + applications: [agentic-cluster-security-suite-X-Y] + origin: agentic-cluster-security-suite-tenant + policy: registry-standard-stage + data: + releaseNotes: + product_id: [1126] + product_name: "agentic cluster security suite" + product_version: "X.Y" + mapping: + components: + - name: acs-mcp-server-X-Y + repositories: + - url: "registry.stage.redhat.io/agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" + defaults: + tags: + - "{{ git_sha }}" + - "{{ git_short_sha }}" + - "X.Y" + - "X.Y-{{ timestamp }}" + pushSourceContainer: true + intention: staging + enforceContainerFirstSecurityLabels: true + pipeline: + pipelineRef: + resolver: git + params: + - name: url + value: "https://github.com/konflux-ci/release-service-catalog.git" + - name: revision + value: production + - name: pathInRepo + value: "pipelines/managed/rh-advisories/rh-advisories.yaml" + serviceAccountName: release-registry-staging + timeouts: + pipeline: "01h0m0s" + tasks: 01h0m0s From 1aca5bfd17a3aa78bbc9b8ed8864eaf08e6ce72b Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 30 Jul 2026 17:18:44 +0200 Subject: [PATCH 3/4] chore(release): Add prepare release script (#185) --- scripts/prepare-release.sh | 193 ++++++++++++++++++++++++ scripts/templates/release-resource.yaml | 26 ++++ 2 files changed, 219 insertions(+) create mode 100755 scripts/prepare-release.sh create mode 100644 scripts/templates/release-resource.yaml diff --git a/scripts/prepare-release.sh b/scripts/prepare-release.sh new file mode 100755 index 0000000..b90cd86 --- /dev/null +++ b/scripts/prepare-release.sh @@ -0,0 +1,193 @@ +#!/usr/bin/env bash + +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)" +REPO_DIR="${SCRIPT_DIR}/.." +TEMPLATE_DIR="${SCRIPT_DIR}/templates" + +VERSION="" +VERSION_DASHED="" +RELEASE_VERSION="" +RELEASE_VERSION_DASHED="" + +usage() { + cat < + +Prepare a patch release for an existing Y-stream release branch. + +Discovers the next Z version from existing tags, creates a prepare branch, +updates Chart.yaml, and generates Konflux Release resource YAMLs for +stage and production. + +Arguments: + version Y-stream version in X.Y format (e.g., 0.2, 1.1) + +Example: + $(basename "$0") 0.2 + $(basename "$0") 1.1 +EOF + exit 0 +} + +log() { + echo "==> $*" +} + +error() { + echo "ERROR: $*" >&2 + exit 1 +} + +parse_args() { + local positional=() + while [[ $# -gt 0 ]]; do + case "$1" in + -h|--help) + usage + ;; + -*) + error "Unknown option: $1" + ;; + *) + positional+=("$1") + shift + ;; + esac + done + + if [[ ${#positional[@]} -ne 1 ]]; then + error "Expected 1 positional argument: . Got ${#positional[@]}." + fi + + export VERSION="${positional[0]}" + export VERSION_DASHED="${VERSION//./-}" +} + +validate_inputs() { + if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+$ ]]; then + error "Version must be in X.Y format (e.g., 0.2). Got: ${VERSION}" + fi + + if ! command -v yq &>/dev/null; then + error "yq is required but not found in PATH" + fi + + if ! command -v git &>/dev/null; then + error "git is required but not found in PATH" + fi + + local yq_version + yq_version=$(yq --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+') + if ! printf '%s\n' "4.52.1" "${yq_version}" | sort -V | head -n1 | grep -q "4.52.1"; then + error "yq version 4.52.1 or higher is required. Found: ${yq_version}" + fi + + if [[ ! -d "${TEMPLATE_DIR}" ]]; then + error "Templates directory not found: ${TEMPLATE_DIR}" + fi + + git -C "${REPO_DIR}" fetch origin + if ! git -C "${REPO_DIR}" rev-parse --verify "origin/release-${VERSION}" &>/dev/null; then + error "Release branch origin/release-${VERSION} does not exist. Run start-y-stream-release.sh first." + fi +} + +checkout_release_branch() { + local branch="release-${VERSION}" + + log "Checking out branch ${branch}..." + git -C "${REPO_DIR}" checkout "${branch}" + git -C "${REPO_DIR}" pull --ff-only origin "${branch}" +} + +discover_next_version() { + local latest_tag + latest_tag=$(git -C "${REPO_DIR}" tag -l "${VERSION}.*" --sort=-version:refname | grep -E "^${VERSION}\.[0-9]+$" | head -1 || true) + + if [[ -z "${latest_tag}" ]]; then + export RELEASE_VERSION="${VERSION}.0" + else + local patch + patch="${latest_tag##*.}" + export RELEASE_VERSION="${VERSION}.$((patch + 1))" + fi + + export RELEASE_VERSION_DASHED="${RELEASE_VERSION//./-}" + log "Next release version: ${RELEASE_VERSION}" +} + +create_prepare_branch() { + local branch="release-${RELEASE_VERSION_DASHED}-prepare" + + # -B resets the branch if it already exists, so reruns discard local unpushed commits. + log "Creating branch ${branch}..." + git -C "${REPO_DIR}" checkout -B "${branch}" +} + +update_chart_version() { + local chart="${REPO_DIR}/charts/stackrox-mcp/Chart.yaml" + + if [[ ! -f "${chart}" ]]; then + error "Chart.yaml not found: ${chart}" + fi + + log "Updating Chart.yaml to version ${RELEASE_VERSION}..." + yq -i '.version = env(RELEASE_VERSION)' "${chart}" + yq -i '.appVersion = env(RELEASE_VERSION)' "${chart}" +} + +create_release_resources() { + local releases_dir="${REPO_DIR}/releases/${RELEASE_VERSION}" + + log "Creating release resources in releases/${RELEASE_VERSION}/..." + mkdir -p "${releases_dir}" + + export RELEASE_AUTHOR="${USER}" + + create_release_file "stage" "${releases_dir}" + create_release_file "prod" "${releases_dir}" +} + +create_release_file() { + export RELEASE_ENV="$1" + local output_dir="$2" + local template="${TEMPLATE_DIR}/release-resource.yaml" + local target="${output_dir}/agentic-cluster-security-suite-${VERSION_DASHED}--${RELEASE_VERSION_DASHED}--${RELEASE_ENV}.yaml" + + log " Creating ${RELEASE_ENV} Release resource..." + cp "${template}" "${target}" + + yq -i '.metadata.generateName |= (sub("X-Y-Z", env(RELEASE_VERSION_DASHED)) | sub("X-Y", env(VERSION_DASHED)) | sub("RELEASE_ENV", env(RELEASE_ENV)))' "${target}" + yq -i '.metadata.labels."release.appstudio.openshift.io/author" = env(RELEASE_AUTHOR)' "${target}" + yq -i '.spec.releasePlan |= (sub("RELEASE_ENV", env(RELEASE_ENV)) | sub("X-Y", env(VERSION_DASHED)))' "${target}" + yq -i '(.spec.data.mapping.defaults.tags[] | select(test("X\\.Y\\.Z"))) |= sub("X\\.Y\\.Z", env(RELEASE_VERSION))' "${target}" + yq -i '(.spec.data.mapping.defaults.tags[] | select(test("X\\.Y"))) |= sub("X\\.Y", env(VERSION))' "${target}" + yq -i '.spec.data.releaseNotes.topic |= sub("X\\.Y\\.Z", env(RELEASE_VERSION))' "${target}" + yq -i '.spec.data.releaseNotes.description |= sub("X\\.Y\\.Z", env(RELEASE_VERSION))' "${target}" +} + +main() { + parse_args "$@" + validate_inputs + + log "Preparing release for Y-stream ${VERSION}" + + checkout_release_branch + discover_next_version + create_prepare_branch + update_chart_version + create_release_resources + + log "" + log "Release preparation complete!" + log " Branch: release-${RELEASE_VERSION_DASHED}-prepare" + log " Chart.yaml: version=${RELEASE_VERSION}, appVersion=${RELEASE_VERSION}" + log " Stage: releases/${RELEASE_VERSION}/agentic-cluster-security-suite-${VERSION_DASHED}--${RELEASE_VERSION_DASHED}--stage.yaml" + log " Prod: releases/${RELEASE_VERSION}/agentic-cluster-security-suite-${VERSION_DASHED}--${RELEASE_VERSION_DASHED}--prod.yaml" + log "" + log "Review changes, then commit and push." +} + +main "$@" diff --git a/scripts/templates/release-resource.yaml b/scripts/templates/release-resource.yaml new file mode 100644 index 0000000..4eab02d --- /dev/null +++ b/scripts/templates/release-resource.yaml @@ -0,0 +1,26 @@ +kind: Release +apiVersion: appstudio.redhat.com/v1alpha1 +metadata: + generateName: agentic-cluster-security-suite-X-Y--X-Y-Z--RELEASE_ENV- + namespace: agentic-cluster-security-suite-tenant + labels: + release.appstudio.openshift.io/automated: "false" + release.appstudio.openshift.io/author: "RELEASE_AUTHOR" +spec: + releasePlan: agentic-cluster-security-suite-RELEASE_ENV-X-Y + snapshot: WARNING-replace-before-create-WARNING + data: + mapping: + defaults: + tags: + - "X.Y" + - "X.Y.Z" + - "X.Y.Z-{{ incrementer }}" + releaseNotes: + synopsis: 'Agentic cluster security suite release' + topic: 'The Tech Preview X.Y.Z (TP) release of agentic cluster security suite introduces early access to ACS MCP server' + description: 'The Tech Preview X.Y.Z (TP) release of agentic cluster security suite.' + solution: 'The agentic cluster security suite bridges Red Hat Advanced Cluster Security for Kubernetes data with advanced AI models.' + type: RHEA + references: + - 'https://github.com/stackrox/stackrox-mcp/blob/main/README.md#quick-start' From 275d461663270e4f1a381ff1a5249b125640fd7c Mon Sep 17 00:00:00 2001 From: Mladen Todorovic Date: Thu, 30 Jul 2026 18:08:47 +0200 Subject: [PATCH 4/4] chore(CI): Split updates per day to allow smooth auto-merge process (#192) --- .github/dependabot.yml | 6 ++++-- .github/renovate.json5 | 17 +++++++++++------ 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1c648b7..35ca4b7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,7 +3,8 @@ updates: - package-ecosystem: "gomod" directory: "/" schedule: - interval: "daily" + interval: "weekly" + day: "monday" commit-message: prefix: "chore" prefix-development: "chore" @@ -16,7 +17,8 @@ updates: - package-ecosystem: "gomod" directory: "/e2e-tests/tools" schedule: - interval: "daily" + interval: "weekly" + day: "monday" commit-message: prefix: "chore" prefix-development: "chore" diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 6903ae9..ed479e3 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -17,8 +17,9 @@ "timezone": "Etc/UTC", "schedule": [ // Allowed syntax: https://docs.renovatebot.com/configuration-options/#schedule - // Between 3a.m. and 7a.m. every day, outside business hours across EU and US timezones. - "* 3-7 * * *", + // Fallback schedule. Each manager overrides this with a day-specific schedule + // to avoid multiple PRs being created at the same time (which causes merge conflicts). + "* 2-8 * * *", ], // Tell Renovate not to update PRs when outside schedule. "updateNotScheduled": false, @@ -36,19 +37,23 @@ "includePaths": [ "konflux.Dockerfile", ], + "schedule": [ + // Friday, 2a.m. to 8a.m. UTC. + "* 2-8 * * 5", + ], }, "rpm-lockfile": { "automerge": true, "schedule": [ - // Duplicate the schedule here because Konflux global config may have a special override for rpm-lockfile. - "* 2-8 * * *", + // Saturday, 2a.m. to 8a.m. UTC. + "* 2-8 * * 6", ], }, "tekton": { "automerge": true, "schedule": [ - // Duplicate the schedule here because Konflux global config may have a special override for tekton. - "* 2-8 * * *", + // Sunday, 2a.m. to 8a.m. UTC. + "* 2-8 * * 0", ], }, }