chore: should we use the RELEASED GA URIs in the stable branch, or their upstream/CI equivalents?

[nickboldt]

What does this PR do?

chore: should we use the RELEASED GA URIs in the stable branch, or their upstream/CI equivalents?

Signed-off-by: rhdh-bot service account rhdh-bot@redhat.com

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

N/A (or see commit message above for issue number)

How to test this PR?

N/A

PR Checklist

As the author of this Pull Request I made sure that:

• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• Relevant user documentation updated
• Relevant contributing documentation updated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🔒 No security concerns identified

⚡ Recommended focus areas for review Image Source The default image was switched from a public community image to registry.redhat.io. Confirm this is intended for all users of this compose setup, since registry.redhat.io commonly requires authentication/pull credentials and may break out-of-the-box local runs/CI. Also verify the chosen tag (1.9.1) matches the intended stability/support policy compared to the previous 1.9 floating tag. rhdh: container_name: rhdh image: ${RHDH_IMAGE:-registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1} env_file: Env Var Reuse Both the main rhdh service and the install-dynamic-plugins service use the same RHDH_IMAGE variable. If a user overrides RHDH_IMAGE, it will override both images, which may be undesirable if the plugin installer should be pinned differently or uses a different image. Validate that sharing the same override variable is intentional. install-dynamic-plugins: container_name: rhdh-plugins-installer image: ${RHDH_IMAGE:-registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1} # docker compose volumes are owned by root, so we need to run as root to write to them

📄 References redhat-developer/rhdh/rpms.in.yaml [1-11] redhat-developer/rhdh/rpms.lock.yaml [3416-3433] redhat-developer/rhdh/rpms.lock.yaml [91-104] redhat-developer/rhdh/rpms.lock.yaml [3470-3475] redhat-developer/rhdh/rpms.lock.yaml [4526-4537] redhat-developer/rhdh/rpms.lock.yaml [4592-4609] redhat-developer/rhdh/rpms.lock.yaml [4946-4963] redhat-developer/rhdh/rpms.lock.yaml [4730-4747]

[rhdh-qodo-merge]

PR Type

Enhancement

---

Description

• Update RHDH container images to use released GA versions

• Switch from community builds to Red Hat official registry images

• Update plugin catalog index image to released version

---

File Walkthrough

Relevant files

Configuration changes

compose.yaml Update RHDH images to released GA versions                              compose.yaml Updated RHDH service image from quay.io/rhdh-community/rhdh:1.9 to registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 Updated install-dynamic-plugins service image to the same released GA version Switched from community builds to Red Hat official registry for production use +2/-2      default.env Update plugin catalog index to released version                    default.env Updated CATALOG_INDEX_IMAGE from quay.io/rhdh/plugin-catalog-index:1.9 to registry.access.redhat.com/rhdh/plugin-catalog-index:1.9.1 Switched to Red Hat's official registry for plugin catalog index Updated to released version 1.9.1 +1/-1

---

[rhdh-qodo-merge]

CI Feedback 🧐

(Feedback updated until commit e693dbb)

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: docker compose - developer-lightspeed-minimal

Failed stage: Start app [❌]

Failed test name: ""

Failure summary: The action failed during docker compose ... up because it could not pull the image registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 from registry.redhat.io due to missing/invalid authentication. - Log shows: unauthorized: Please login to the Red Hat Registry... when requesting the manifest for rhdh/rhdh-hub-rhel9:1.9.1 (lines 877-882), causing docker compose to exit with code 1 (line 883). - Because the compose stack never started, the subsequent step docker exec rhdh ... failed with No such container: rhdh (line 892).

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 862: name: rhdh-local_rag_vector_db 863: ##[group]Run docker compose -f compose.yaml -f developer-lightspeed/compose.yaml up --detach --quiet-pull 864: �[36;1mdocker compose -f compose.yaml -f developer-lightspeed/compose.yaml up --detach --quiet-pull�[0m 865: �[36;1mdocker compose -f compose.yaml -f developer-lightspeed/compose.yaml ps�[0m 866: shell: /usr/bin/bash -e {0} 867: env: 868: DOCKER_COMPOSE_VERSION: v5.0.1 869: PODMAN_IMAGE: quay.io/podman/stable:v5 870: CORPORATE_PROXY_IMAGE: docker.io/ubuntu/squid:latest 871: ##[endgroup] 872: Image quay.io/redhat-ai-dev/rag-content:release-1.8-lcs Pulling 873: Image registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 Pulling 874: Image quay.io/lightspeed-core/lightspeed-stack:dev-20251021-ee9f08f Pulling 875: Image registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 Pulling 876: Image quay.io/redhat-ai-dev/llama-stack:6b98aa4ac2178e35d33ef0078bb948202e7dfabc Pulling 877: Image registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 Error Head "https://registry.redhat.io/v2/rhdh/rhdh-hub-rhel9/manifests/1.9.1": unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication 878: Image registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1 Interrupted 879: Image quay.io/lightspeed-core/lightspeed-stack:dev-20251021-ee9f08f Interrupted 880: Image quay.io/redhat-ai-dev/llama-stack:6b98aa4ac2178e35d33ef0078bb948202e7dfabc Interrupted 881: Image quay.io/redhat-ai-dev/rag-content:release-1.8-lcs Interrupted 882: Error response from daemon: Head "https://registry.redhat.io/v2/rhdh/rhdh-hub-rhel9/manifests/1.9.1": unauthorized: Please login to the Red Hat Registry using your Customer Portal credentials. Further instructions can be found here: https://access.redhat.com/RegistryAuthentication 883: ##[error]Process completed with exit code 1. 884: ##[group]Run docker exec rhdh curl -i --head --fail http://localhost:7007 885: �[36;1mdocker exec rhdh curl -i --head --fail http://localhost:7007�[0m 886: shell: /usr/bin/bash -e {0} 887: env: 888: DOCKER_COMPOSE_VERSION: v5.0.1 889: PODMAN_IMAGE: quay.io/podman/stable:v5 890: CORPORATE_PROXY_IMAGE: docker.io/ubuntu/squid:latest 891: ##[endgroup] 892: Error response from daemon: No such container: rhdh 893: ##[error]Process completed with exit code 1. 894: ##[group]Run for svc in $(docker compose -f compose.yaml -f developer-lightspeed/compose.yaml config --services | sort); do

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Align registry host for plugin image Change the registry host for CATALOG_INDEX_IMAGE from registry.access.redhat.com to registry.redhat.io to match the host used for the RHDH_IMAGE. default.env [16] -CATALOG_INDEX_IMAGE=registry.access.redhat.com/rhdh/plugin-catalog-index:1.9.1 +CATALOG_INDEX_IMAGE=registry.redhat.io/rhdh/plugin-catalog-index:1.9.1 Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out an inconsistency between registry hosts (registry.access.redhat.com vs. registry.redhat.io) for related images, which could cause pull issues. Aligning them improves the configuration's robustness and consistency.	Medium
	Update outdated comments and examples Update the comments and the commented-out RHDH_IMAGE example in default.env to align with the new default image version 1.9.1 and its commercial nature. default.env [10-16] -# configure image to use: default to using the latest stable tag of the community builds, which are built for both amd64 and arm64 architectures -# to use bleeding edge :next images or commercially supported images, see README.md for details -# RHDH_IMAGE=quay.io/rhdh-community/rhdh:1.9 +# configure image to use: default to using the latest stable tag of the commercially supported images. +# to use bleeding edge :next images or community builds, see README.md for details +# RHDH_IMAGE=quay.io/rhdh-community/rhdh:1.9.1 # Default plugin catalog index image # Requires RHDH 1.9+ to be handled. CATALOG_INDEX_IMAGE=registry.access.redhat.com/rhdh/plugin-catalog-index:1.9.1 [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 5 __ Why: The suggestion correctly identifies that comments and a commented-out example in default.env are outdated after the PR changes, which could lead to user confusion and configuration errors. Updating them improves consistency and usability.	Low
	Pin images by digest Pin the Docker image to a specific digest using @sha256:<...> instead of relying on the 1.9.1 tag to ensure immutable and reproducible deployments. compose.yaml [26] -image: ${RHDH_IMAGE:-registry.redhat.io/rhdh/rhdh-hub-rhel9:1.9.1} +image: ${RHDH_IMAGE:-registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:<INSERT_DIGEST>} Apply / Chat Suggestion importance[1-10]: 4 __ Why: The suggestion proposes a good practice for ensuring reproducible builds by pinning the image to a digest. However, for an example repository, using a floating tag like 1.9.1 is a reasonable approach to automatically pick up patch releases.	Low
Update

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud