fix(ci): run RPM lock renewal on ubuntu-26.04

[jiridanek]

Summary

• Follow-up to [rhoai-2.25] chore(ci): RPM lock renewal workflow + CI triage docs for rhoai-2.25 #2643: runs-on: ubuntu-latest resolved to ubuntu-24.04 and broke install-podman-action (AppArmor pasta reload exits 2 when usr.bin.pasta is missing).
• Switch RPM lock renewal to ubuntu-26.04, matching Build Notebooks / install-podman-action.

Failed run: https://github.com/red-hat-data-services/notebooks/actions/runs/30529455139/job/90828049465

Test plan

• Dispatch RPM Lock Files Renewal Action with --ref fix/rhoai-2.25-rpms-lock-ubuntu-26.04, variant=rhds, branch=rhoai-2.25
• Confirm runner is ubuntu-26.04 and Install Podman succeeds

Made with Cursor

Summary by CodeRabbit

• Chores
  • Updated the RPM lock-file renewal process to run on a newer Ubuntu environment.
  • Improved workflow documentation explaining the runner requirement and preventing AppArmor-related failures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a0da44d3-5714-4e2e-a810-f647c0ff63f0

📥 Commits

Reviewing files that changed from the base of the PR and between bb1413c and dbfe475.

📒 Files selected for processing (1)

• .github/workflows/rpms-lock-renewal.yaml

---

📝 Walkthrough

Walkthrough

The RPM lock renewal workflow now runs its refresh job on ubuntu-26.04 and documents the AppArmor-related pasta failure associated with ubuntu-latest.

Changes

RPM lock renewal

Layer / File(s)	Summary
Update lock renewal runner .github/workflows/rpms-lock-renewal.yaml	The refresh-rpm-lock-files job uses ubuntu-26.04, with comments explaining the previous runner’s AppArmor-related pasta peer reload failure.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately states the main change: moving RPM lock renewal to ubuntu-26.04.
Description check	✅ Passed	The PR includes a clear summary and test plan, but the self-checklist and merge-criteria checkboxes are not completed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rhoai-2.25-rpms-lock-ubuntu-26.04

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Superseded by newer run: https://github.com/red-hat-data-services/notebooks/actions/runs/30530033405

CI status [antigravity]

Run: Build Notebooks (push) #30529916949 — 2/2 complete · 2 skipped
Last updated: 2026-07-30T09:15:16Z

Workflow completed with skipped jobs.

[jiridanek]

Validation from PR branch

Dispatched RPM Lock Files Renewal Action with:

gh workflow run rpms-lock-renewal.yaml \
  --ref fix/rhoai-2.25-rpms-lock-ubuntu-26.04 \
  -f variant=rhds -f branch=rhoai-2.25 -f use_cache=false

Run: https://github.com/red-hat-data-services/notebooks/actions/runs/30529943934

Step	Result
Runner image	ubuntu-26.04 (fixes prior 24.04 AppArmor pasta failure)
Install Podman	success
Regenerate rpms.lock.yaml	success (produced a lockfile diff)
Create Pull Request	failed — GH_TOKEN / secrets.GH_ACCESS_TOKEN empty → Invalid username or token on git push (exit 128)

So the ubuntu-26.04 runner fix is validated. Auto-PR push needs a working GH_ACCESS_TOKEN repo secret (or switch push/PR creation to GITHUB_TOKEN with contents: write / pull-requests: write). That is separate from this runner change.

[ide-developer]

Trial job results (ide-developer)

Dispatched from PR branch fix/rhoai-2.25-rpms-lock-ubuntu-26.04:

https://github.com/red-hat-data-services/notebooks/actions/runs/30529943934

Step	Result
Runner	ubuntu-26.04
Install Podman	passed (AppArmor pasta step OK — fixes the prior 24.04 failure)
Regenerate rpms.lock.yaml	passed (lockfile diff produced)
Create Pull Request	failed — secrets.GH_ACCESS_TOKEN empty → git push auth error (exit 128)

Verdict for this PR: the ubuntu-26.04 runner change is validated. Overall workflow conclusion was failure only on the auto-PR push step (repo secret / token config), which is outside the scope of this one-line runner fix.

Approving the runner fix on that basis.

[ide-developer]

LGTM. Trial dispatch from this branch (run 30529943934) ran on ubuntu-26.04 and Install Podman + lock regen succeeded. Remaining Create-PR auth failure is empty GH_ACCESS_TOKEN, not caused by this change.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ide-developer
Once this PR has been reviewed and has the lgtm label, please assign jiridanek for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiridanek]

@coderabbitai For this workflow you need push + open PR (+ label). Use either:

Classic PAT (usual for GH_ACCESS_TOKEN):
https://github.com/settings/tokens/new?description=GH_ACCESS_TOKEN%20%28rpms-lock-renewal%20%2F%20piplock%29&scopes=repo

Fine-grained (prefilled write scopes, no workflows:write needed):
https://github.com/settings/personal-access-tokens/new?name=GH_ACCESS_TOKEN&description=Push%20lockfile%20branches%20and%20open%20PRs%20from%20rpms-lock-renewal%20%2F%20piplock&contents=write&pull_requests=write

Then store it as the GH_ACCESS_TOKEN repo secret on red-hat-data-services/notebooks. If the org enforces SAML SSO, authorize that token for red-hat-data-services after creation.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@jiridanek Acknowledged. The renewal workflows require a repository-scoped GH_ACCESS_TOKEN that can push the generated lockfile branch, create the PR, and apply its label. A fine-grained token with Contents: write and Pull requests: write is sufficient; authorize it for red-hat-data-services under SAML SSO when required, then store it as the repository secret.

This is separate from—and does not affect—the validated ubuntu-26.04 runner change.

---

✏️ Learnings added

Learnt from: jiridanek
URL: https://github.com/red-hat-data-services/notebooks/pull/2645

Timestamp: 2026-07-30T09:21:58.058Z
Learning: In red-hat-data-services/notebooks, the RPM lock renewal and piplock automation require the repository secret `GH_ACCESS_TOKEN` to push generated lockfile branches, create pull requests, and apply labels. Configure either a classic PAT with `repo` scope or a fine-grained token scoped to the repository with Contents: write and Pull requests: write; authorize it for the `red-hat-data-services` organization when SAML SSO is enforced.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

[github-actions]

CI status [antigravity]

Run: Build Notebooks (pr) #30530033405 — 3/3 complete · 1 passed · 2 failed
Last updated: 2026-07-30T09:22:19Z after workflow update completed

Failures so far

Job	Failed step	Link
codeserver-ubi9-python-3.12 · linux/arm64 [rhoai] / build	Build: make codeserver-ubi9-python-3.12	logs
codeserver-ubi9-python-3.12 · linux/amd64 [rhoai] / build	Build: make codeserver-ubi9-python-3.12	logs

Likely root causes

• The codeserver-ubi9-python-3.12 build failed on both linux/amd64 and linux/arm64 architectures during the dnf install step inside codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu.
• Specifically, the package manager encountered a conflict when trying to install nodejs-devel requiring nodejs(x86-64) = 1:22.23.1-1.module+el9.8.0+24457+996af7aa (or equivalent aarch64 package), where a different version (1:22.23.1-2.module+el9.8.0+24538+3f176d52) was already present or requested from @System, leading to conflicting package requests and exit status 1.

Suggested next steps

• Review the nodejs and nodejs-devel package versions and module streams enabled or specified in codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu or repository configurations to resolve version conflicts.

[jiridanek]

Confirmed — job 90831701962 succeeded end-to-end, and #2646 is the auto lock PR from ide-developer.

For red-hat-data-services repos, use a classic PAT only (fine-grained can’t be scoped to those org repos):

https://github.com/settings/tokens/new?description=GH_ACCESS_TOKEN%20%28rpms-lock-renewal%20%2F%20piplock%29&scopes=repo

That repo classic token is enough for same-repo branch push + gh pr create. Store it as the GH_ACCESS_TOKEN Actions secret.