[RHOAIENG-66501] add package version metadata into env vars

.github/workflows/process-operator-bundle.yaml

@@ -2,6 +2,16 @@ name: Process Operator Bundle
 run-name: Process Operator Bundle
 on:
   workflow_dispatch:
+    inputs:
+      rhoai_version:
+        description: 'RHOAI version to process (e.g. rhoai-3.5, rhoai-3.5-ea.2). Branch name used if omitted.'
+        required: false
+        type: string
+      dry_run:
+        description: 'Push results to BRANCH-dry-run instead of the actual branch.'
+        required: false
+        type: boolean
+        default: false
   push:
     paths:
       - bundle/additional-images-patch.yaml
@@ -29,13 +39,24 @@ jobs:
     if: ${{ github.ref_name != 'main' }}
     runs-on: ubuntu-latest
     container:
-      image: quay.io/rhoai/rhoai-task-toolset:latest
+      # defined here: https://github.com/red-hat-data-services/devops-images/tree/main/builds
+      image: quay.io/rhoai-devops/olm-runner:latest
     steps:
-      - name: Get Current branch name
+      - name: Resolve branch and RHOAI version
         shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
+        run: |
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+
+          VERSION_SOURCE="${{ inputs.rhoai_version || github.head_ref || github.ref_name }}"
+          VERSION_SOURCE="${VERSION_SOURCE#rhoai-}"
+          if ! [[ "$VERSION_SOURCE" =~ ^([0-9]+\.[0-9]+(-ea\.[0-9]+)?)$ ]]; then
+            echo "::error::Cannot resolve RHOAI version from '$VERSION_SOURCE'. Provide rhoai_version input (e.g. rhoai-3.5)."
+            exit 1
+          fi
+          echo "rhoai_version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
         id: get_branch
-      - name: Git checkout RBC release
+      - name: Git checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ steps.get_branch.outputs.branch }}
@@ -48,24 +69,24 @@ jobs:
           path: utils
       - name: Install dependencies
         run: |
-          os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-          arch="$(uname -m | sed 's/x86_64/amd64/')"
-          yq_version="v4.44.3"
-          yq_filename="yq-$yq_version"
-          echo "-> Downloading yq" >&2
-          curl -sSfLo "$yq_filename" "https://github.com/mikefarah/yq/releases/download/$yq_version/yq_${os}_${arch}"
-          chmod +x $yq_filename
-          ln -s $yq_filename yq
-          cp $yq_filename /usr/local/bin/yq
-
-          echo "-> Installing findutils" >&2
-          microdnf install -y findutils
-
           pip install --default-timeout=100 -r utils/utils/processors/requirements.txt
 
+      - name: Login to container registries
+        env:
+          REGISTRY_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_REDHAT_IO_USERNAME }}
+          REGISTRY_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_REDHAT_IO_PASSWORD }}
+          REGISTRY_STAGE_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_USERNAME }}
+          REGISTRY_STAGE_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_PASSWORD }}
+          AIPCC_QUAY_RO_USERNAME: ${{ secrets.AIPCC_QUAY_RO_USERNAME }}
+          AIPCC_QUAY_RO_TOKEN: ${{ secrets.AIPCC_QUAY_RO_TOKEN }}
+        run: |
+          cosign login registry.redhat.io -u "${REGISTRY_REDHAT_IO_USERNAME}" -p "${REGISTRY_REDHAT_IO_PASSWORD}"
+          cosign login registry.stage.redhat.io -u "${REGISTRY_STAGE_REDHAT_IO_USERNAME}" -p "${REGISTRY_STAGE_REDHAT_IO_PASSWORD}"
+          cosign login quay.io -u "${AIPCC_QUAY_RO_USERNAME}" -p "${AIPCC_QUAY_RO_TOKEN}"
       - name: Process Operator Bundle
         env:
           BRANCH: ${{ steps.get_branch.outputs.branch }}
+          RHOAI_VERSION: ${{ steps.get_branch.outputs.rhoai_version }}
           OC_TOKEN: ${{ secrets.KONFLUX_INTERNAL_OC_TOKEN }}
           CLUSTER: p02
           RHOAI_QUAY_API_TOKEN: ${{ secrets.RHOAI_QUAY_API_TOKEN }}
@@ -78,8 +99,7 @@ jobs:
         run: |
           #Declare basic variables
           OPENSHIFT_VERSION=v4.13
-          RHOAI_VERSION=v${BRANCH/rhoai-/}
-          COMPONENT_SUFFIX=${RHOAI_VERSION//./-}
+          COMPONENT_SUFFIX=v${RHOAI_VERSION//./-}
           OPERATOR_BUNDLE_COMPONENT_NAME=odh-operator-bundle-${COMPONENT_SUFFIX}
           XKS_HELM_CHART_COMPONENT_NAME=rhai-on-xks-chart-${COMPONENT_SUFFIX}
           OPENSHIFT_HELM_CHART_COMPONENT_NAME=rhai-on-openshift-chart-${COMPONENT_SUFFIX}
@@ -112,14 +132,21 @@ jobs:
           OPENSHIFT_HELM_VALUES_YAML_PATH=${HELM_RAW_INPUTS_DIR}/rhai-on-openshift-chart/values.yaml
           OPENSHIFT_HELM_PUSH_PIPELINE_PATH=${BRANCH}/.tekton/${OPENSHIFT_HELM_CHART_COMPONENT_NAME}-push.yaml
 
+          #Declare SBOM metadata config path
+          METADATA_CONFIG_PATH=${BRANCH}/bundle/metadata-config.yaml
+          METADATA_CONFIG_FLAG=""
+          if [ -f "${METADATA_CONFIG_PATH}" ]; then
+            METADATA_CONFIG_FLAG="-mc ${METADATA_CONFIG_PATH}"
+          fi
+
           #Invoke Bundle processor to patch the catalog
           python3 utils/utils/processors/bundle-processor.py \
             -op bundle-patch \
             -b ${BUILD_CONFIG_PATH} \
             -c ${BUNDLE_CSV_PATH} \
             -p ${PATCH_YAML_PATH} \
             -o ${OUTPUT_FILE_PATH} \
-            -v ${BRANCH} \
+            -v rhoai-${RHOAI_VERSION} \
             -a ${ANNOTATION_YAML_PATH} \
             -xhp ${XKS_HELM_PATCH_YAML_PATH} \
             -xhv ${XKS_HELM_VALUES_YAML_PATH} \
@@ -128,7 +155,8 @@ jobs:
             -ohv ${OPENSHIFT_HELM_VALUES_YAML_PATH} \
             -ohpp ${OPENSHIFT_HELM_PUSH_PIPELINE_PATH} \
             -y ${BUNDLE_PUSH_PIPELINE_PATH} \
-            -x enable
+            -x enable \
+            ${METADATA_CONFIG_FLAG}
 
           # Sync processed content back to bundle and helm directories
           # Convention: root-level files are permanent configs, subdirectories are synced content
@@ -157,4 +185,8 @@ jobs:
           git config user.name "Openshift-AI DevOps"
           git config user.email "openshift-ai-devops@redhat.com"
           git add -A
-          git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images" && git push origin ${{ steps.get_branch.outputs.branch }})
+          PUSH_BRANCH="${{ inputs.dry_run == true && format('{0}-dry-run-bundle', steps.get_branch.outputs.branch) || steps.get_branch.outputs.branch }}"
+          FORCE_FLAG="${{ inputs.dry_run == true && '--force' || '' }}"
+          git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images
+
+          ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" && git push ${FORCE_FLAG} origin HEAD:${PUSH_BRANCH})

.github/workflows/trigger-nightly-bundle-build.yaml

@@ -2,6 +2,16 @@ name: Trigger Nightly Bundle Build
 run-name: Trigger Nightly Bundle Build
 on:
   workflow_dispatch:
+    inputs:
+      rhoai_version:
+        description: 'RHOAI version to process (e.g. rhoai-3.5, rhoai-3.5-ea.2). Branch name used if omitted.'
+        required: false
+        type: string
+      dry_run:
+        description: 'Push results to BRANCH-dry-run instead of the actual branch.'
+        required: false
+        type: boolean
+        default: false
   push:
     paths:
       - schedule/bundle-github-trigger.txt
@@ -22,13 +32,24 @@ jobs:
     if: ${{ github.ref_name != 'main' }}
     runs-on: ubuntu-latest
     container:
-      image: quay.io/rhoai/rhoai-task-toolset:latest
+      # defined here: https://github.com/red-hat-data-services/devops-images/tree/main/builds
+      image: quay.io/rhoai-devops/olm-runner:latest
     steps:
-      - name: Get Current branch name
+      - name: Resolve branch and RHOAI version
         shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
+        run: |
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+
+          VERSION_SOURCE="${{ inputs.rhoai_version || github.head_ref || github.ref_name }}"
+          VERSION_SOURCE="${VERSION_SOURCE#rhoai-}"
+          if ! [[ "$VERSION_SOURCE" =~ ^([0-9]+\.[0-9]+(-ea\.[0-9]+)?)$ ]]; then
+            echo "::error::Cannot resolve RHOAI version from '$VERSION_SOURCE'. Provide rhoai_version input (e.g. rhoai-3.5)."
+            exit 1
+          fi
+          echo "rhoai_version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
         id: get_branch
-      - name: Git checkout RBC release
+      - name: Git checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ steps.get_branch.outputs.branch }}
@@ -41,21 +62,24 @@ jobs:
           path: utils
       - name: Install dependencies
         run: |
-          os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-          arch="$(uname -m | sed 's/x86_64/amd64/')"
-          yq_version="v4.44.3"
-          yq_filename="yq-$yq_version"
-          echo "-> Downloading yq" >&2
-          curl -sSfLo "$yq_filename" "https://github.com/mikefarah/yq/releases/download/$yq_version/yq_${os}_${arch}"
-          chmod +x $yq_filename
-          ln -s $yq_filename yq
-          cp $yq_filename /usr/local/bin/yq
-
           pip install --default-timeout=100 -r utils/utils/processors/requirements.txt
 
+      - name: Login to container registries
+        env:
+          REGISTRY_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_REDHAT_IO_USERNAME }}
+          REGISTRY_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_REDHAT_IO_PASSWORD }}
+          REGISTRY_STAGE_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_USERNAME }}
+          REGISTRY_STAGE_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_PASSWORD }}
+          AIPCC_QUAY_RO_USERNAME: ${{ secrets.AIPCC_QUAY_RO_USERNAME }}
+          AIPCC_QUAY_RO_TOKEN: ${{ secrets.AIPCC_QUAY_RO_TOKEN }}
+        run: |
+          cosign login registry.redhat.io -u "${REGISTRY_REDHAT_IO_USERNAME}" -p "${REGISTRY_REDHAT_IO_PASSWORD}"
+          cosign login registry.stage.redhat.io -u "${REGISTRY_STAGE_REDHAT_IO_USERNAME}" -p "${REGISTRY_STAGE_REDHAT_IO_PASSWORD}"
+          cosign login quay.io -u "${AIPCC_QUAY_RO_USERNAME}" -p "${AIPCC_QUAY_RO_TOKEN}"
       - name: Process Operator Bundle
         env:
           BRANCH: ${{ steps.get_branch.outputs.branch }}
+          RHOAI_VERSION: ${{ steps.get_branch.outputs.rhoai_version }}
           OC_TOKEN: ${{ secrets.KONFLUX_INTERNAL_OC_TOKEN }}
           CLUSTER: p02
           RHOAI_QUAY_API_TOKEN: ${{ secrets.RHOAI_QUAY_API_TOKEN }}
@@ -68,8 +92,7 @@ jobs:
         run: |
           #Declare basic variables
           OPENSHIFT_VERSION=v4.13
-          RHOAI_VERSION=v${BRANCH/rhoai-/}
-          COMPONENT_SUFFIX=${RHOAI_VERSION//./-}
+          COMPONENT_SUFFIX=v${RHOAI_VERSION//./-}
           OPERATOR_BUNDLE_COMPONENT_NAME=odh-operator-bundle-${COMPONENT_SUFFIX}
           XKS_HELM_CHART_COMPONENT_NAME=rhai-on-xks-chart-${COMPONENT_SUFFIX}
           OPENSHIFT_HELM_CHART_COMPONENT_NAME=rhai-on-openshift-chart-${COMPONENT_SUFFIX}
@@ -102,14 +125,21 @@ jobs:
           OPENSHIFT_HELM_VALUES_YAML_PATH=${HELM_RAW_INPUTS_DIR}/rhai-on-openshift-chart/values.yaml
           OPENSHIFT_HELM_PUSH_PIPELINE_PATH=${BRANCH}/.tekton/${OPENSHIFT_HELM_CHART_COMPONENT_NAME}-push.yaml
 
+          #Declare SBOM metadata config path
+          METADATA_CONFIG_PATH=${BRANCH}/bundle/metadata-config.yaml
+          METADATA_CONFIG_FLAG=""
+          if [ -f "${METADATA_CONFIG_PATH}" ]; then
+            METADATA_CONFIG_FLAG="-mc ${METADATA_CONFIG_PATH}"
+          fi
+
           #Invoke Bundle processor to patch the catalog
           python3 utils/utils/processors/bundle-processor.py \
             -op bundle-patch \
             -b ${BUILD_CONFIG_PATH} \
             -c ${BUNDLE_CSV_PATH} \
             -p ${PATCH_YAML_PATH} \
             -o ${OUTPUT_FILE_PATH} \
-            -v ${BRANCH} \
+            -v rhoai-${RHOAI_VERSION} \
             -a ${ANNOTATION_YAML_PATH} \
             -xhp ${XKS_HELM_PATCH_YAML_PATH} \
             -xhv ${XKS_HELM_VALUES_YAML_PATH} \
@@ -119,7 +149,8 @@ jobs:
             -ohpp ${OPENSHIFT_HELM_PUSH_PIPELINE_PATH} \
             -y ${BUNDLE_PUSH_PIPELINE_PATH} \
             -x disable \
-            -t nightly
+            -t nightly \
+            ${METADATA_CONFIG_FLAG}
 
           cp -r ${RAW_INPUTS_DIR}/* ${BRANCH}/bundle
           cp -r ${HELM_RAW_INPUTS_DIR}/* ${BRANCH}/helm/
@@ -144,4 +175,8 @@ jobs:
           git config user.name "Openshift-AI DevOps"
           git config user.email "openshift-ai-devops@redhat.com"
           git add -A
-          git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images" && git push origin ${{ steps.get_branch.outputs.branch }})
+          PUSH_BRANCH="${{ inputs.dry_run == true && format('{0}-dry-run-nightly-bundle', steps.get_branch.outputs.branch) || steps.get_branch.outputs.branch }}"
+          FORCE_FLAG="${{ inputs.dry_run == true && '--force' || '' }}"
+          git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images
+
+          ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" && git push ${FORCE_FLAG} origin HEAD:${PUSH_BRANCH})

bundle/metadata-config.yaml

@@ -0,0 +1,9 @@
+sbom-metadata:
+  - env_vars:
+      - "RELATED_IMAGE_RHAII_VLLM_CUDA_IMAGE"
+      - "RELATED_IMAGE_RHAII_VLLM_ROCM_IMAGE"
+      - "RELATED_IMAGE_RHAII_VLLM_SPYRE_IMAGE"
+      - "RELATED_IMAGE_RHAII_VLLM_CPU_IMAGE"
+      - "RELATED_IMAGE_RHAII_VLLM_GAUDI_IMAGE"
+    package: "vllm"
+    suffix: "_UPSTREAM_VERSION"