[TEST - DO NOT MERGE] ci: auto-update bundle manifests on same-repo PRs

.github/workflows/pr-bundle-diff-checks.yaml

@@ -16,32 +16,61 @@ jobs:
     name: Validate Bundle Manifests
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: write
 
     steps:
-      - name: Checkout
+      - name: Checkout PR branch
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.head_ref }}
+          # Use rhdh-bot token for same-repo PRs (enables push); falls back to default for forks
+          token: ${{ secrets.RHDH_BOT_TOKEN || github.token }}
           fetch-depth: 0
 
       - name: Setup Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: 'go.mod'
 
-      - name: Verify bundle manifests are up to date
-        run: |
-          make bundles build-installers
+      - name: Regenerate bundle manifests
+        run: make bundles build-installers
 
-          # Check if bundle manifests changed (ignoring createdAt timestamps)
+      - name: Check for changes
+        id: check
+        run: |
           # Since operator-sdk 1.26.0, `make bundle` changes the `createdAt` field from the bundle every time we run it.
           # The `git diff` below checks if only the createdAt field has changed. If it is the only change, it is ignored.
           # Inspired from https://github.com/operator-framework/operator-sdk/issues/6285#issuecomment-1415350333
           if git diff --quiet -I'^    createdAt: ' bundle config dist; then
             echo "✅ Bundle manifests are up to date"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Bundle manifests are out of sync"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Auto-commit and push updated bundle manifests
+        # Only attempt on same-repo PRs (not forks) for security; best-effort — failure falls through to the next step
+        if: steps.check.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
+        run: |
+          git config user.name "rhdh-bot"
+          git config user.email "rhdh-bot@redhat.com"
+          git add bundle/ config/ dist/
+          git commit -m "chore: regenerate bundle manifests"
+          git push
+
+      - name: Fail if bundle manifests are out of sync
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          # Re-check in case the auto-commit step already pushed the fix
+          if git diff --quiet -I'^    createdAt: ' bundle config dist; then
+            echo "✅ Bundle manifests were auto-updated and pushed"
             exit 0
           fi
 
-          # Bundle is out of sync - provide helpful error message
           echo "::error::Bundle manifests are out of sync with the code"
           echo ""
           echo "❌ The bundle manifests need to be regenerated."

Makefile

@@ -16,7 +16,7 @@ PROFILE_SHORT := $(shell echo $(PROFILE) | cut -d. -f1)
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
 # Set a default VERSION if it is not defined
 ifeq ($(origin VERSION), undefined)
-VERSION ?= 0.11.0
+VERSION ?= 0.11.1
 DEFAULT_VERSION := true
 else
 DEFAULT_VERSION := false

config/profile/backstage.io/kustomization.yaml

@@ -14,7 +14,7 @@ resources:
 images:
 - name: controller
   newName: quay.io/rhdh-community/operator
-  newTag: 0.11.0
+  newTag: 0.11.1
 
 generatorOptions:
   disableNameSuffixHash: true