chore(main): release 3.38.4

[jsell-rh]

🤖 I have created a release beep boop

3.38.4 (2026-07-02)

Reverts

• retarget Konflux deploy-tag back to hp-fleet-gitops (#784) (9d793be)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f4f5d3f3-bc5f-4e3a-b111-995d5ff7944f

📥 Commits

Reviewing files that changed from the base of the PR and between 9d793be and af6a4d7.

📒 Files selected for processing (5)

• .github/.release-please-manifest.json
• CHANGELOG.md
• src/api/pyproject.toml
• src/dev-ui/VERSION
• website/package.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Bumped the release version to 3.38.4 across the project.
• Documentation
  • Updated the changelog with a new 3.38.4 entry dated 2026-07-02.
• Revert
  • Noted that the Konflux deploy-tag was moved back to hp-fleet-gitops.

Walkthrough

No functional code changes. Version strings bumped from 3.38.3 to 3.38.4 across .github/.release-please-manifest.json, src/api/pyproject.toml, src/dev-ui/VERSION, and website/package.json. CHANGELOG.md gains a 3.38.4 entry noting a Konflux deploy-tag revert to hp-fleet-gitops. No Go source (API, Sentinel, Adapter, Broker) touched.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Compact Metadata

Related Issues: None referenced in diff.
Related PRs: None referenced in diff.
Suggested Labels: release, chore, version-bump
Suggested Reviewers: None specified in provided data — assign whoever owns release-please config; verify signature/provenance on tag retarget per SLSA supply-chain concerns (CWE-494: Download of Code Without Integrity Check applies to any deploy-tag retargeting).

Security note: Revert of Konflux deploy-tag to hp-fleet-gitops is a CI/CD deployment target change — verify this retarget was reviewed against unauthorized branch/tag redirection (CWE-829: Inclusion of Functionality from Untrusted Control Sphere). No code diff provided for the actual Konflux pipeline config; flag if pipeline definitions are out of scope of this PR but affect deploy trust boundary.

Poem:
Version ticks from three to four,
No logic touched behind the door.
A tag reverts to gitops home—
Check its trust before you roam.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: an automated release bump to version 3.38.4.
Description check	✅ Passed	The description directly describes the 3.38.4 release and its revert note, matching the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: Diff only bumps release metadata/version files; 0 suspicious log lines containing token/password/credential/secret. No CWE-532 exposure found.
No Hardcoded Secrets	✅ Passed	PASS: No CWE-798 hardcoded creds found; changed files are version bumps/changelog only, with no API keys/tokens/passwords, embedded-cred URLs, or long base64 strings.
No Weak Cryptography	✅ Passed	PASS: Touched files are release metadata/version bumps only; no md5/des/rc4/sha1-for-security, ECB, custom crypto, or secret compares found (CWE-327/328).
No Injection Vectors	✅ Passed	Only release metadata changed; no code changes or new CWE-89/78/79/502 sinks were introduced in the touched files.
No Privileged Containers	✅ Passed	Only version/changelog files changed; no Kubernetes/OpenShift manifests, Helm templates, or Dockerfiles were modified, so no privileged settings were introduced (CWE-250).
No Pii Or Sensitive Data In Logs	✅ Passed	PR only bumps release metadata/changelog; no slog/logr/zap/fmt.Print callsites added, so no CWE-532-style sensitive logging exposure.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release-please--branches--main--components--kartograph

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch release-please--branches--main--components--kartograph

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-02 05:08 UTC

[jsell-rh]

🤖 Created releases:

• v3.38.4

🌻