From 3bd6ab038ba06e12ab73c36bd557b0445a9e0be7 Mon Sep 17 00:00:00 2001 From: Adam Piasecki Date: Fri, 7 Aug 2026 11:13:42 +0100 Subject: [PATCH] renovate: run update_artifacts_lockfile as postUpgradeTasks When Renovate bumps the openshift-client version in ci/hermetic/artifacts.lock.yaml it only updates the download_url, leaving stale sha256 checksums that break hermetic builds. Configure postUpgradeTasks to run update_artifacts_lockfile after each version bump so the checksums are refreshed in the same PR. Also add command-line argument support to update_artifacts_lockfile so it can be called from the repo root with the lockfile path as an argument rather than requiring the caller to cd into ci/hermetic/ first. Depends on KONFLUX-9132 to add update_artifacts_lockfile to the mintmaker-renovate-image and its allowedCommands list. Assisted-by: Claude Sonnet 4.6 --- ci/hermetic/update_artifacts_lockfile | 3 ++- renovate.json | 11 ++++++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/ci/hermetic/update_artifacts_lockfile b/ci/hermetic/update_artifacts_lockfile index ff9c280cc3..514521bf1a 100755 --- a/ci/hermetic/update_artifacts_lockfile +++ b/ci/hermetic/update_artifacts_lockfile @@ -21,6 +21,7 @@ from ruamel.yaml import YAML import requests import hashlib import os +import sys from typing import List, Dict, Any, Optional @@ -149,5 +150,5 @@ if __name__ == "__main__": # This script will attempt to load and update 'artifacts.lock.yaml' # in the current directory. Make sure this file exists and is # correctly formatted before running. - artifacts_lock_filename: str = "artifacts.lock.yaml" + artifacts_lock_filename: str = sys.argv[1] if len(sys.argv) > 1 else "artifacts.lock.yaml" update_artifact_checksums(artifacts_lock_filename) diff --git a/renovate.json b/renovate.json index 2000dd8642..575e133ea5 100644 --- a/renovate.json +++ b/renovate.json @@ -44,7 +44,16 @@ "matchDatasources": [ "custom.oc" ], - "extractVersion": "openshift-client-linux-(?.+)\\.tar\\.gz" + "extractVersion": "openshift-client-linux-(?.+)\\.tar\\.gz", + "postUpgradeTasks": { + "commands": [ + "update_artifacts_lockfile ci/hermetic/artifacts.lock.yaml" + ], + "executionMode": "branch", + "fileFilters": [ + "ci/hermetic/artifacts.lock.yaml" + ] + } } ], "customManagers": [