Updating PCO Policy controller image for 1.0.2 Release

[tommyd450]

No description provided.

[qodo-for-securesign]

PR Summary by Qodo

Bump policy-controller image digest for 1.0.2 release

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Update the Policy Controller Operator Helm values to reference the 1.0.2 image digest.
• Keep image pull behavior unchanged (IfNotPresent) while pinning an updated immutable artifact.

Diagram

graph TD
  V["helm-charts/policy-controller-operator/values.yaml"] --> H(["Helm chart render"]) --> D(["K8s Deployment"]) --> R{{"registry.redhat.io"}}

  subgraph Legend
    direction LR
    _file["File"] ~~~ _proc(["Process"]) ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a semantic image tag (e.g., 1.0.2) instead of a digest

• ➕ More readable and aligns with release naming
• ➕ Easier manual operations (rollbacks, audits) without looking up digests
• ➖ Tags are mutable unless registry policies enforce immutability
• ➖ Less supply-chain safety than pinning a digest

2. Automate digest updates (Renovate/ImagePolicy/GitOps pipeline)

• ➕ Reduces manual work for future releases and patch updates
• ➕ Can enforce consistent PR metadata, validation, and approvals
• ➖ Adds tooling/config complexity
• ➖ Still requires a policy decision on tag-vs-digest pinning

Recommendation: For release prep, the current approach (pinning an immutable digest in Helm values) is the safest and most reproducible. Consider adding automation later if digest bumps are frequent, but keep digest pinning as the default unless tag immutability is guaranteed.

Files changed (1) +1 / -1

Other (1) +1 / -1

values.yamlUpdate policy-controller webhook image digest +1/-1

Update policy-controller webhook image digest

• Bumps the pinned image digest for the policy-controller webhook container to the new release artifact. Pull policy and other configuration remain unchanged.

helm-charts/policy-controller-operator/values.yaml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Chart version not bumped 🐞 Bug ⚙ Maintainability

Description

This PR changes the chart’s shipped configuration by updating the webhook image digest in
values.yaml, but the chart version in Chart.yaml remains unchanged. If this chart is
packaged/published as a versioned artifact, keeping the same chart version makes the updated package
indistinguishable from the previous one and can cause publication/consumption ambiguity (e.g.,
registries/repositories rejecting, overwriting, or caching the artifact under the same version).

Code

helm-charts/policy-controller-operator/values.yaml[19]

+      version: sha256:4e402c4bd5cf40b4e57bc1a3c0b6f0a796bfed3c65407e7f88a6831a95cf10de

Relevance

● Weak

Many merged PRs update values.yaml digests without bumping Chart.yaml version (e.g., #141, #134,
#29).

PR-#141
PR-#134
PR-#29

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The deployed webhook image digest is updated in the chart values, but the chart’s own version
identifier stays at 0.1.0, meaning the chart package version does not reflect the content change.

helm-charts/policy-controller-operator/values.yaml[16-22]
helm-charts/policy-controller-operator/Chart.yaml[1-11]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Helm chart content changes (new webhook image digest) but `Chart.yaml` `version` remains the same. Chart versions should be incremented when chart contents change to keep published artifacts unambiguous.

## Issue Context
The PR updates `policy-controller.webhook.image.version` (digest pin) in `values.yaml`, which affects what gets deployed.

## Fix Focus Areas
- helm-charts/policy-controller-operator/Chart.yaml[1-11]
- helm-charts/policy-controller-operator/values.yaml[16-22]

## Suggested fix
- Increment `version:` in `Chart.yaml` (e.g., `0.1.0` -> `0.1.1`, or to whatever the release process requires).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}