Skip to content

ci: auto-update bundle manifests on same-repo PRs #3169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rm3l wants to merge 4 commits into
base: main
Choose a base branch
from
Open

ci: auto-update bundle manifests on same-repo PRs #3169

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8f834d6
ci: auto-update bundle manifests on same-repo PRs
rm3l Jul 9, 2026
639ad61
fix: specify repository in checkout for fork PR branches
rm3l Jul 9, 2026
7ac0c4d
test: bump VERSION to trigger outdated bundle (will revert)
rm3l Jul 9, 2026
1d7027e
Revert "test: bump VERSION to trigger outdated bundle (will revert)"
rm3l Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 35 additions & 6 deletions .github/workflows/pr-bundle-diff-checks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,32 +16,61 @@ jobs:
name: Validate Bundle Manifests
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: write

steps:
- name: Checkout
- name: Checkout PR branch
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ${{ github.event.pull_request.head.repo.full_name }}
ref: ${{ github.head_ref }}
# Use rhdh-bot token for same-repo PRs (enables push); falls back to default for forks
token: ${{ secrets.RHDH_BOT_TOKEN || github.token }}
fetch-depth: 0

- name: Setup Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
with:
go-version-file: 'go.mod'

- name: Verify bundle manifests are up to date
run: |
make bundles build-installers
- name: Regenerate bundle manifests
run: make bundles build-installers

# Check if bundle manifests changed (ignoring createdAt timestamps)
- name: Check for changes
id: check
run: |
# Since operator-sdk 1.26.0, `make bundle` changes the `createdAt` field from the bundle every time we run it.
# The `git diff` below checks if only the createdAt field has changed. If it is the only change, it is ignored.
# Inspired from https://github.com/operator-framework/operator-sdk/issues/6285#issuecomment-1415350333
if git diff --quiet -I'^ createdAt: ' bundle config dist; then
echo "✅ Bundle manifests are up to date"
echo "changed=false" >> "$GITHUB_OUTPUT"
else
echo "Bundle manifests are out of sync"
echo "changed=true" >> "$GITHUB_OUTPUT"
fi

- name: Auto-commit and push updated bundle manifests
# Only attempt on same-repo PRs (not forks) for security; best-effort — failure falls through to the next step
if: steps.check.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository
continue-on-error: true
run: |
git config user.name "rhdh-bot"
git config user.email "rhdh-bot@redhat.com"
git add bundle/ config/ dist/
git commit -m "chore: regenerate bundle manifests"
git push

- name: Fail if bundle manifests are out of sync
if: steps.check.outputs.changed == 'true'
run: |
# Re-check in case the auto-commit step already pushed the fix
if git diff --quiet -I'^ createdAt: ' bundle config dist; then
echo "✅ Bundle manifests were auto-updated and pushed"
exit 0
fi
Comment on lines +54 to 72

@rhdh-qodo-merge rhdh-qodo-merge Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Push failure false-green 🐞 Bug ≡ Correctness

The workflow commits regenerated manifests and allows git push to fail (`continue-on-error:
true`), but the subsequent “Fail if…” step only checks the local working tree. If the push fails
after a successful local commit, git diff becomes clean and the job exits 0 even though the PR
branch is still out of sync.
Agent Prompt 
### Issue description
The workflow can report success even when the auto-push fails, because it commits locally and then later validates only via `git diff` (local state), not remote state.

### Issue Context
- `continue-on-error: true` makes push failures non-fatal.
- After a successful `git commit`, `git diff` becomes clean even if `git push` failed, causing the subsequent step to incorrectly `exit 0`.

### Fix Focus Areas
- .github/workflows/pr-bundle-diff-checks.yaml[54-72]

### Suggested fix approach
1. Give the auto-commit step an `id` (e.g., `autopush`) and write an output like `pushed=true/false`.
2. If `git push` fails, undo the local commit so the next step still sees a diff and fails (or explicitly fail based on `pushed=false`).
   - Example pattern inside the step:
     - run `git commit ...`
     - `if git push; then echo "pushed=true" >> $GITHUB_OUTPUT; else echo "pushed=false" >> $GITHUB_OUTPUT; git reset --hard HEAD~1; fi`
3. In the “Fail if…” step, only exit 0 when `steps.autopush.outputs.pushed == 'true'` (or otherwise keep failing when `changed=true`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


# Bundle is out of sync - provide helpful error message
echo "::error::Bundle manifests are out of sync with the code"
echo ""
echo "❌ The bundle manifests need to be regenerated."
Expand Down