feat: replace olm-catalog branch with PR-based catalog workflow

.github/olm-publish/action.yaml

@@ -1,5 +1,5 @@
 name: 'Publish to OLM'
-description: 'Publishes the operator to OLM'
+description: 'Publishes the operator to OLM. Expects olm/index-template.yaml to exist in the working tree.'
 inputs:
   quay_login:
     description: "Quay login"
@@ -15,6 +15,7 @@ runs:
     shell: bash
     run: |
       go version
+
   - name: Setup Go environment
     uses: actions/setup-go@v5
     if: steps.go-version.outcome == 'failure'
@@ -32,34 +33,6 @@ runs:
       username: ${{ inputs.quay_login }}
       password: ${{ inputs.quay_token }}
 
-  - name: Create new integration branch
-    shell: bash
-    # Creating a branch here in order to avoid commiting to our local main
-    # branch further down in this action. In some make targets we use main's sha
-    # and by creating a branch here we can just assume local main is the same as
-    # remote main.
-    run: |
-      # Discard any uncommitted changes from previous steps (e.g., standard-version)
-      git reset --hard HEAD
-      git clean -fd
-      git checkout -b olm-publish-action-scratch
-
-  - name: Fetch olm-catalog branch
-    shell: bash
-    run: git fetch origin olm-catalog
-
-  - name: Git merge olm-catalog branch
-    shell: bash
-    run: |
-      git config user.name rhobs-release-bot
-      git config user.email release-bot@monitoring.rhobs.io
-
-      # NOTE: uses strategy-option=ours as bundle created for a release using
-      # make initiate-release conflicts with the previous bundle created for
-      # development branch, so the version in main takes precedence over the
-      # one in olm-catalog branch
-      git merge -Xours origin/olm-catalog  -m "ci: merge olm-catalog branch"
-
   - name: Build Operator Image
     shell: bash
     run: make operator-image
@@ -76,20 +49,12 @@ runs:
     shell: bash
     run: make bundle-push
 
-
   - name: Build Catalog Image
     shell: bash
-    run: |
-      make catalog-image
+    # update-channels.sh modifies olm/index-template.yaml in place;
+    # the calling workflow is responsible for committing and opening a PR.
+    run: make catalog-image
 
-      # NOTE: add a commit only if the catalog can built sucessfully
-      git add bundle/ olm/
-      git commit -m "ci(bot): update catalog image"
-
-  - name: Publish catalog image
+  - name: Publish Catalog Image
     shell: bash
-    run: |
-      make catalog-push
-
-      # update olm-catalog only if catalog could be successfully published
-      git push origin HEAD:olm-catalog
+    run: make catalog-push

.github/workflows/olm-stable.yaml

@@ -1,21 +1,44 @@
 ---
+# Triggered when a GitHub pre-release is promoted to a full release.
+# Publishes OLM stable images and opens a PR against the corresponding
+# release-* branch with the updated catalog index.
 name: OLM Stable Channel
 
 on:
   release:
     types:
       - released
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     environment: quay
     steps:
+      - name: Determine release branch
+        id: branch
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          # v1.4.2 -> release-1.4
+          BRANCH="release-$(echo "${TAG#v}" | cut -d. -f1,2)"
+          echo "name=$BRANCH" >> "$GITHUB_OUTPUT"
+
       - uses: actions/checkout@v6
         with:
+          ref: ${{ steps.branch.outputs.name }}
           fetch-depth: 0
+          token: ${{ secrets.REPOSITORY_PUSH_TOKEN }}
+
+      - name: Setup Go environment
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+          check-latest: true
 
-      - name: publish
+      - name: Publish catalog
         uses: ./.github/olm-publish
         env:
           IMG_BASE: ${{ vars.IMG_BASE }}
@@ -25,3 +48,27 @@ jobs:
         with:
           quay_login: ${{ secrets.QUAY_LOGIN }}
           quay_token: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Open catalog PR
+        env:
+          GH_TOKEN: ${{ secrets.REPOSITORY_PUSH_TOKEN }}
+        run: |
+          git config user.name rhobs-release-bot
+          git config user.email release-bot@monitoring.rhobs.io
+
+          VERSION="$(cat VERSION)"
+          TARGET_BRANCH="${{ steps.branch.outputs.name }}"
+          PR_BRANCH="ci/olm-catalog-stable-${TARGET_BRANCH}"
+          git checkout -b "$PR_BRANCH"
+          git add bundle/ olm/index-template.yaml
+          git commit -m "ci(bot): update OLM stable catalog to ${VERSION}"
+          git push --force origin "$PR_BRANCH"
+
+          existing=$(gh pr list --head "$PR_BRANCH" --base "$TARGET_BRANCH" --json number --jq '.[0].number')
+          if [ -z "$existing" ]; then
+            gh pr create \
+              --base "$TARGET_BRANCH" \
+              --head "$PR_BRANCH" \
+              --title "ci: update OLM stable catalog (${VERSION})" \
+              --body "Automated catalog update for the stable channel."
+          fi

.github/workflows/release-branch.yaml

@@ -0,0 +1,140 @@
+# Handles RC releases cut from release-* branches.
+# Triggered by a chore(release): commit pushed to any release-* branch.
+# Creates a GitHub pre-release, publishes OLM candidate images, and opens a PR
+# against the release branch with the updated catalog index.
+name: Release Branch
+on:
+  push:
+    branches: ['release-*']
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  e2e-tests-olm:
+    if: "startsWith(github.event.head_commit.message, 'chore(release):')"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: e2e tests through OLM
+        uses: ./.github/e2e-tests-olm
+
+  create-github-prerelease:
+    needs:
+      - e2e-tests-olm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.REPOSITORY_PUSH_TOKEN }}
+          persist-credentials: false
+
+      # standard-version's release-as relies on controller-gen for code generation.
+      - name: Setup Go environment
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+          check-latest: true
+
+      - name: Generate release notes
+        run: |
+          git config user.name rhobs-release-bot
+          git config user.email release-bot@monitoring.rhobs.io
+          npx standard-version -i RELEASE_BODY.md \
+            --release-as $(cat VERSION) \
+            --skip.commit
+
+      - name: Publish tag
+        id: publish_tag
+        run: |
+          git push --follow-tags
+          echo "tag_name=$(git describe HEAD --abbrev=0)" >> $GITHUB_OUTPUT
+
+      - name: Create Github release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ steps.publish_tag.outputs.tag_name }}
+          bodyFile: RELEASE_BODY.md
+          # NOTE: We always generate pre-releases and mark them as releases manually
+          prerelease: true
+
+  publish-olm-candidate:
+    needs:
+      - create-github-prerelease
+    runs-on: ubuntu-latest
+    environment: quay
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.REPOSITORY_PUSH_TOKEN }}
+
+      - name: Setup Go environment
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+          check-latest: true
+
+      - name: Set version
+        id: version
+        run: |
+          version="$(cat VERSION)-rc"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Publish catalog
+        uses: ./.github/olm-publish
+        env:
+          IMG_BASE: ${{ vars.IMG_BASE }}
+          VERSION: ${{ steps.version.outputs.version }}
+          CHANNELS: candidate,development
+          DEFAULT_CHANNEL: candidate
+          RELEASE_SHA: ${GITHUB_SHA}
+        with:
+          quay_login: ${{ secrets.QUAY_LOGIN }}
+          quay_token: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Open catalog PR
+        env:
+          GH_TOKEN: ${{ secrets.REPOSITORY_PUSH_TOKEN }}
+        run: |
+          git config user.name rhobs-release-bot
+          git config user.email release-bot@monitoring.rhobs.io
+
+          TARGET_BRANCH="${{ github.ref_name }}"
+          PR_BRANCH="ci/olm-catalog-candidate-${TARGET_BRANCH}"
+          git checkout -b "$PR_BRANCH"
+          git add bundle/ olm/index-template.yaml
+          git commit -m "ci(bot): update OLM candidate catalog to ${{ steps.version.outputs.version }}"
+          git push --force origin "$PR_BRANCH"
+
+          existing=$(gh pr list --head "$PR_BRANCH" --base "$TARGET_BRANCH" --json number --jq '.[0].number')
+          if [ -z "$existing" ]; then
+            gh pr create \
+              --base "$TARGET_BRANCH" \
+              --head "$PR_BRANCH" \
+              --title "ci: update OLM candidate catalog (${{ steps.version.outputs.version }})" \
+              --body "Automated catalog update for the candidate channel."
+          fi
+
+      - name: Publish Package
+        uses: ./.github/package-operator-publish
+        env:
+          IMG_BASE: ${{ vars.IMG_BASE }}
+          VERSION: ${{ steps.version.outputs.version }}
+        with:
+          quay_login: ${{ secrets.QUAY_LOGIN }}
+          quay_token: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Publish test harness
+        uses: ./.github/osd-test-harness-publish
+        env:
+          IMG_BASE: ${{ vars.IMG_BASE }}
+          VERSION: ${{ steps.version.outputs.version }}
+        with:
+          quay_login: ${{ secrets.QUAY_LOGIN }}
+          quay_token: ${{ secrets.QUAY_TOKEN }}