fix(ci): run RPM lock renewal on ubuntu-26.04 by jiridanek · Pull Request #2644 · red-hat-data-services/notebooks

jiridanek · 2026-07-30T09:14:16Z

Summary

Follow-up to [rhoai-2.25] chore(ci): RPM lock renewal workflow + CI triage docs for rhoai-2.25 #2643: runs-on: ubuntu-latest resolved to ubuntu-24.04 and broke install-podman-action (AppArmor pasta reload exits 2 when usr.bin.pasta is missing).
Switch .github/workflows/rpms-lock-renewal.yaml to ubuntu-26.04, matching Build Notebooks / install-podman-action.

Failed run: https://github.com/red-hat-data-services/notebooks/actions/runs/30529455139/job/90828049465

Test plan

Dispatch RPM Lock Files Renewal Action with --ref fix/rhoai-2.25-rpms-lock-renewal-workflow, variant=rhds, branch=rhoai-2.25
Confirm runner is ubuntu-26.04 and Install Podman succeeds

Made with Cursor

Summary by CodeRabbit

New Features
- Added a manually triggered workflow to regenerate RPM lockfiles for supported variants.
- The workflow can create a branch and open a pull request with updated lockfiles.
Documentation
- Added a CI failure triage guide covering stale RPM locks, hermetic build failures, and related troubleshooting scenarios.
- Updated contributor guidance with RPM lock renewal and CI troubleshooting instructions.

Backport a manual-only rpms-lock-renewal Action for rhoai-2.25 (separate from pylock), and document that hermetic dnf NEVR conflicts usually mean stale Hermeto RPM pins that should be relocked via that workflow. Co-authored-by: Cursor <cursoragent@cursor.com>

Codeserver is the only Hermeto RPM consumer on this branch and runs on public UBI, unlike main's RHDS path that may still require subscription secrets. Co-authored-by: Cursor <cursoragent@cursor.com>

Avoid copying a git-crypt ciphertext blob into Podman auth.json when GIT_CRYPT_KEY is absent on the public-UBI rhoai-2.25 path. Co-authored-by: Cursor <cursoragent@cursor.com>

install-podman-action assumes ubuntu-26.04; on 24.04 (ubuntu-latest) the AppArmor pasta peer reload fails because usr.bin.pasta is missing. Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci · 2026-07-30T09:14:24Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign caponetto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-07-30T09:14:26Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-07-30T09:14:35Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2b854a93-dc3e-41bf-b4bd-f2990f0e3f48

📥 Commits

Reviewing files that changed from the base of the PR and between bb1413c and 29c17a7.

📒 Files selected for processing (3)

.github/workflows/rpms-lock-renewal.yaml
Agents.md
docs/ci-failure-triage.md

📝 Walkthrough

Walkthrough

Adds a manually triggered GitHub Actions workflow to regenerate ODH or RHDS RPM lockfiles and open labeled PRs. Adds CI failure triage documentation for stale hermetic RPM pins and links it from Agents.md.

Changes

RPM lock renewal and CI triage

Layer / File(s)	Summary
Workflow inputs, credentials, and cache preparation `.github/workflows/rpms-lock-renewal.yaml`	Defines manual variant, branch, and cache inputs; checks out the selected branch; configures conditional RHDS credentials; and prepares Podman caching.
Lockfile regeneration and automated PR creation `.github/workflows/rpms-lock-renewal.yaml`	Regenerates available RPM lockfiles, stages changes, and creates a labeled update branch and pull request.
CI failure triage guidance `Agents.md`, `docs/ci-failure-triage.md`	Documents stale RPM pin symptoms, renewal procedures, related failure classes, and links to the new playbook.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

red-hat-data-services/notebooks#2328: Refreshes RHDS RPM lockfile pins targeted by the renewal workflow.
red-hat-data-services/notebooks#2643: Contains overlapping RPM renewal workflow and CI triage documentation changes.

Suggested reviewers: ide-developer, atheo89

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

Resolve merge conflict in branch fix/rhoai-2.25-rpms-lock-renewal-workflow

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/rhoai-2.25-rpms-lock-renewal-workflow

_{Comment @coderabbitai help to get the list of available commands.}

jiridanek · 2026-07-30T09:15:04Z

Superseded by #2645 (clean tip-based ubuntu-26.04-only change after #2643 merged).

jiridanek and others added 4 commits July 30, 2026 10:45

docs(ci): note rhoai-2.25 RPM locks need no RHEL subscription

e861502

Codeserver is the only Hermeto RPM consumer on this branch and runs on public UBI, unlike main's RHDS path that may still require subscription secrets. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(ci): only use pull-secret.json when it is valid JSON

c2836ae

Avoid copying a git-crypt ciphertext blob into Podman auth.json when GIT_CRYPT_KEY is absent on the public-UBI rhoai-2.25 path. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(ci): run RPM lock renewal on ubuntu-26.04

29c17a7

install-podman-action assumes ubuntu-26.04; on 24.04 (ubuntu-latest) the AppArmor pasta peer reload fails because usr.bin.pasta is missing. Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci Bot requested review from atheo89 and dibryant July 30, 2026 09:14

openshift-ci Bot added the needs-rebase label Jul 30, 2026

github-actions Bot added the review-requested label Jul 30, 2026

jiridanek closed this Jul 30, 2026

jiridanek deleted the fix/rhoai-2.25-rpms-lock-renewal-workflow branch July 30, 2026 09:15

coderabbitai Bot mentioned this pull request Jul 30, 2026

RHAIENG-6546: align rhoai-2.25 GHA disk layout with main (no LVM, /mnt, ubuntu-26.04) #2647

Merged

9 tasks

Navigation Menu

Uh oh!

fix(ci): run RPM lock renewal on ubuntu-26.04 - #2644

fix(ci): run RPM lock renewal on ubuntu-26.04#2644
jiridanek wants to merge 4 commits into
rhoai-2.25from
fix/rhoai-2.25-rpms-lock-renewal-workflow

jiridanek commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Uh oh!

jiridanek commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jiridanek commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Uh oh!

jiridanek commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jiridanek commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading