WINC-2014: [ci] Enable auto-merge for ubi-minimal digest update PRs - #4430
WINC-2014: [ci] Enable auto-merge for ubi-minimal digest update PRs#4430jira-solve-bot wants to merge 1 commit into
Conversation
![splat-sdlc-agent[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Add a Renovate/MintMaker packageRule in renovate.json to auto-approve and auto-merge PRs that update the registry.access.redhat.com/ubi9/ubi-minimal digest in Containerfile and Containerfile.bundle. The new rule adds approved and lgtm labels so Tide merges the PR after CI passes, following the existing pattern used for Tekton catalog reference updates. Ref: WINC-2014
openshift-ci-robot
added
the
jira/valid-reference
|
@jira-solve-bot: This pull request references WINC-2014 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
📝 WalkthroughWalkthroughAdded a Renovate package rule for digest updates of Suggested reviewers: 🚥 Pre-merge checks | ✅ 20✅ Passed checks (20 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jira-solve-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@renovate.json`:
- Around line 132-137: Update the Renovate rule containing autoApprove,
automerge, and addLabels to remove the unsupported/platform-conflicting
autoApprove and automerge options. Keep addLabels with approved and lgtm so Tide
controls approval and merging through its existing hold-label flow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: ef7023e7-d77a-4739-8133-6bafbaa7e65b
📒 Files selected for processing (1)
renovate.json
| "autoApprove": true, | ||
| "automerge": true, | ||
| "addLabels": [ | ||
| "approved", | ||
| "lgtm" | ||
| ] |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq empty renovate.json
jq -c '
.. | objects
| select(has("autoApprove") or has("automerge") or has("addLabels"))
| {
matchFileNames,
matchPackageNames,
matchUpdateTypes,
autoApprove,
automerge,
addLabels
}
' renovate.json
rg -n -C 5 \
'missingLabels|reviewApprovedRequired|do-not-merge/hold|approved|lgtm|tide' \
--glob '!vendor/**' \
--glob '!node_modules/**' .Repository: openshift/windows-machine-config-operator
Length of output: 19907
🌐 Web query:
Renovate GitHub automerge platform native automerge autoApprove option
💡 Result:
The Renovate autoApprove option is not supported for the GitHub platform [1][2]. It is specifically designed for use on Azure, Gerrit, and GitLab platforms [1]. On GitHub, the autoApprove configuration setting does nothing [2]. Instead, to handle Renovate pull requests that require approval or bypass branch protection rules, you should use one of the following recommended approaches: 1. Bypass Branch Protection: Configure your repository's branch protection rules to allow the Renovate bot (or the specific app/user account Renovate uses) to bypass mandatory pull request reviews [3][4][2]. This is the preferred method as it requires no additional tools or bots [4]. 2. Use Approval Helper Apps: If you are using the Mend Renovate App on GitHub, you can install dedicated helper apps, such as renovate-approve or renovate-approve-2, which automatically mark Renovate-created pull requests as approved [3][2]. Renovate uses platform-native automerge by default on GitHub [3][1]. When platform-native automerge is enabled (platformAutomerge=true), Renovate delegates the actual merging process to GitHub's own automerge or merge queue functionality once all status checks have passed [1][5]. If you need to disable this native behavior to use Renovate's internal merge logic, you can set platformAutomerge to false [3][1].
Citations:
- 1: https://docs.renovatebot.com/configuration-options/
- 2: How to Enable autoApprove and Automerge renovate PR in github private repositories renovatebot/renovate#25886
- 3: https://docs.renovatebot.com/key-concepts/automerge/
- 4: docs: suggest to let Renovate bypass mandatory Pull Request reviews renovatebot/renovate#16370
- 5: Should Renovate use `enqueuePullRequest` when enabling GitHub native auto-merge? renovatebot/renovate#31315
🌐 Web query:
Renovate configuration option autoApprove supported platforms Azure Gerrit GitLab
💡 Result:
The Renovate configuration option autoApprove is explicitly supported for the Azure, Gerrit, and GitLab platforms [1][2][3]. When set to true, this option enables Renovate to automatically approve its own pull requests (or equivalent changes) on these platforms [1][4]. Originally introduced as azureAutoApprove specifically for Azure, the option was renamed to autoApprove and expanded to include support for Gerrit and GitLab to unify configuration [1][5]. You can apply this setting globally or selectively using packageRules [1][6]. For further context on platform-specific implementation: - Gerrit: Users must ensure the bot account has permission to assign the Code-Review label with +2 for automerge to function correctly when autoApprove is enabled [7]. - GitLab/Azure: The feature functions by automatically approving pull requests created by the bot [1][8].
Citations:
- 1: https://docs.renovatebot.com/configuration-options/
- 2: https://github.com/renovatebot/renovate/blob/main/lib/config/options/index.ts
- 3: https://github.com/renovatebot/renovate/blob/ac197b21/lib/config/options/index.ts
- 4: https://docs.renovatebot.com/key-concepts/automerge/
- 5: feat(config): rename
azureAutoApprovetoautoApproverenovatebot/renovate#21576 - 6: https://github.com/renovatebot/renovate/blob/68f623b5/docs/usage/configuration-options.md
- 7: https://docs.renovatebot.com/modules/platform/gerrit/
- 8: feat(platform/gitlab): support autoApprove option renovatebot/renovate#23460
🌐 Web query:
Tide prow missingLabels do-not-merge/hold config
💡 Result:
In Prow's Tide component, the missingLabels field is a configuration setting used to define a list of GitHub labels that must be absent from a Pull Request (PR) for it to be eligible for automated merging [1][2]. If a PR has any of the labels specified in this list, Tide will exclude it from the merge pool [1][3]. The do-not-merge/hold label is commonly included in the missingLabels configuration [1][4][5]. It is a conventional label used to manually prevent Tide from merging a PR [6]. This label is typically applied by the Prow bot in response to a user triggering the /hold command on a PR [6]. A standard configuration entry in a Prow config.yaml file typically looks like this: tide: queries: - repos: - org/repo labels: - lgtm - approved missingLabels: - do-not-merge - do-not-merge/hold - do-not-merge/work-in-progress - needs-rebase By listing do-not-merge/hold in the missingLabels section, you explicitly instruct Tide to ignore any PRs marked with that label, effectively acting as a pause button for automated merges [1][6]. To allow the merge to proceed, a user must issue the /hold cancel command, which removes the label and allows the PR to re-enter the merge pool [6].
Citations:
- 1: https://docs.prow.k8s.io/docs/components/core/tide/config/
- 2: https://docs.prow.k8s.io/docs/components/core/tide/
- 3: https://docs.prow.k8s.io/docs/components/core/tide/pr-authors/
- 4: https://github.com/kubernetes-sigs/prow/blob/main/config/prow/cluster/starter/starter-gcs.yaml
- 5: https://github.com/feast-dev/feast/blob/1e1f5d94/.prow/config.yaml
- 6: https://github.com/peopleforrester/k8s-staying-current/blob/main/walkthroughs/bot-commands-cheatsheet.md
🌐 Web query:
Renovate automerge option default true on GitHub platform native automerge platformAutomerge
💡 Result:
On the GitHub platform, Renovate's platform-native automerge feature (configured via the platformAutomerge option) is enabled by default [1][2]. Here is a breakdown of how these settings function together: 1. Platform-Native Automerge (platformAutomerge): By default, Renovate uses the platform's native automerge functionality (e.g., GitHub's auto-merge feature) to handle PR merging when available [1][3]. This defaults to true [2][4]. 2. Explicit Automerge Requirement (automerge): While platformAutomerge is enabled by default, Renovate will not perform any merging unless you explicitly enable the automerge option (which defaults to false) in your configuration [1][2][5]. In summary, you must opt-in to automerging by setting automerge to true in your Renovate configuration [1][3]. Once enabled, Renovate will automatically use the GitHub native automerge by default because platformAutomerge is set to true [1][2][4]. If you prefer to use Renovate's internal merge mechanism instead of the GitHub-native one, you must explicitly set platformAutomerge to false [1][3][4].
Citations:
- 1: https://docs.renovatebot.com/key-concepts/automerge/
- 2: https://github.com/renovatebot/renovate/blob/68f623b5/docs/usage/configuration-options.md
- 3: https://github.com/renovatebot/renovate/blob/ac197b21/docs/usage/key-concepts/automerge.md
- 4: https://github.com/renovatebot/renovate/blob/main/docs/usage/configuration-options.md
- 5: https://docs.renovatebot.com/configuration-options/
🌐 Web query:
Renovate automerge GitHub automerge branch protection required pull request review automerge
💡 Result:
To enable Renovate automerge when GitHub branch protection rules require pull request reviews, you must address the conflict where Renovate cannot automatically approve its own pull requests [1][2]. There are two primary solutions: 1. Bypass Required Reviews: In your GitHub repository's branch protection rules, use the "Allow specified actors to bypass required pull requests" option to add the Renovate App [1][2]. This allows Renovate to merge its own pull requests even when reviews are mandatory [1][2]. 2. Use an Approval Bot: If you cannot or do not wish to bypass the requirement, you can install a helper app such as renovate-approve or renovate-approve-2 [1][2]. These apps are designed to automatically provide the required approval on pull requests created by the Renovate App [3]. Important Considerations for Branch Protection: - Platform Automerge: By default, Renovate uses "platform automerge" [4][5], which instructs GitHub to perform the merge once all conditions (like status checks and required reviews) are met [6]. - Status Checks: When using platform automerge with the "Require status checks to pass before merging" branch protection rule, ensure you have explicitly selected at least one status check in the GitHub branch protection settings [4][5]. If no specific check is selected, GitHub may merge pull requests even if other (non-required) checks fail [4][7]. - General Limitation: If you have enabled the "Require a pull request before merging" setting, Renovate generally cannot merge branches directly; it must use pull requests [1][2]. Renovate is also currently conservative and will typically only attempt to automerge when all checks have passed [8]. For further details, consult the official Renovate documentation on automerge configuration [1][4].
Citations:
- 1: https://docs.renovatebot.com/key-concepts/automerge/
- 2: https://github.com/renovatebot/renovate/blob/ac197b21/docs/usage/key-concepts/automerge.md
- 3: https://github.com/renovatebot/renovate-approve-bot
- 4: https://docs.renovatebot.com/configuration-options/
- 5: https://github.com/renovatebot/renovate/blob/main/docs/usage/configuration-options.md
- 6: docs(config options):
automergeand GitHub branch protection rule renovatebot/renovate#25810 - 7: Renovate PRs do not honor required checks renovatebot/renovate#34967
- 8: Automerge despite failing or pending checks renovatebot/renovate#31783
🌐 Web query:
Prow Tide missingLabels hold label required review pull request merge pool
💡 Result:
In Prow's Tide component, the missingLabels configuration parameter defines a list of labels that a pull request (PR) must not possess to be considered for the merge pool [1]. If a PR has any of these labels, it is excluded from the pool [1]. The do-not-merge/hold label (or similar variations like do-not-merge or do-not-merge/work-in-progress) is commonly included in the missingLabels list in config.yaml to prevent Tide from merging PRs that are explicitly blocked by maintainers [1][2][3]. If your PR is not entering the merge pool despite appearing to meet all criteria, consider the following troubleshooting steps: 1. Check the Tide Status Context: The tide status on your PR will typically explain why it is not in the merge pool [4][5]. If it is pending, the status or the associated PR dashboard link will detail which requirements are missing [5]. 2. Verify Merge Requirements: Use the "Merge Requirements" section on the Tide status/PR dashboard page to see a direct comparison of your PR's state against the configured criteria [5][6]. 3. GitHub Search Indexing Issues: Occasionally, GitHub's search index (which Tide relies on) can become corrupted, causing Tide to incorrectly believe a PR is missing a required label or possesses a forbidden one [6]. If you are certain your PR meets all criteria, adding a new comment to the PR can trigger a re-indexing by GitHub, which often resolves the issue [6]. 4. Configuration Review: Ensure your tide configuration correctly specifies the required labels (which must be present) and missingLabels (which must be absent) [1]. Verify that there are no overlapping labels in these lists [1]. For further debugging, you can check the Tide dashboard (typically found at /tide on your Prow instance), which displays the state of all merge pools and the position of your PR in the retest queue [5][7].
Citations:
- 1: https://docs.prow.k8s.io/docs/components/core/tide/config/
- 2: https://github.com/kubernetes-sigs/prow/blob/main/config/prow/cluster/starter/starter-gcs.yaml
- 3: https://github.com/GoogleCloudPlatform/oss-test-infra/blob/master/prow/oss/config.yaml
- 4: https://docs.prow.k8s.io/docs/components/core/tide/
- 5: https://docs.prow.k8s.io/docs/components/core/tide/pr-authors/
- 6: https://docs.prow.k8s.io/docs/components/core/tide/maintainers/
- 7: https://pkg.go.dev/github.com/kubernetes/test-infra/prow/cmd/tide
Let Tide own the merge and approval gate.
automerge: true opts this Renovate rule into platform-based mergers; on GitHub that uses the platform’s automerge/merge queue when status requirements pass. autoApprove: true is unsupported on GitHub, so these Renovate approvals still depend on platform/app review gates. Keep only addLabels and rely on approved/lgtm plus Tide’s hold-label flow, unless this MintMaker setup explicitly disables Renovate’s merge path and enforces do-not-merge/hold.
Proposed fix
"matchUpdateTypes": [
"digest"
],
- "autoApprove": true,
- "automerge": true,
"addLabels": [📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "autoApprove": true, | |
| "automerge": true, | |
| "addLabels": [ | |
| "approved", | |
| "lgtm" | |
| ] | |
| "matchUpdateTypes": [ | |
| "digest" | |
| ], | |
| "addLabels": [ | |
| "approved", | |
| "lgtm" | |
| ] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@renovate.json` around lines 132 - 137, Update the Renovate rule containing
autoApprove, automerge, and addLabels to remove the
unsupported/platform-conflicting autoApprove and automerge options. Keep
addLabels with approved and lgtm so Tide controls approval and merging through
its existing hold-label flow.
Source: MCP tools
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq empty renovate.json
jq '
.dockerfile.packageRules[]
| select(
(.matchPackageNames // []) | index("registry.access.redhat.com/ubi9/ubi-minimal")
)
' renovate.json
rg -n -C 4 \
'do-not-merge/hold|missingLabels|labels:|approved|lgtm|tide' \
--glob '!vendor/**' \
--glob '!node_modules/**' \
--glob '!renovate.json' \
.Length of output: 64050
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
jq empty renovate.json
rule="$(
jq -c '
.dockerfile.packageRules[]
| select(
(.matchPackageNames // [])
| index("registry.access.redhat.com/ubi9/ubi-minimal")
)
' renovate.json
)"
test "$(jq -r 'has("autoApprove") or has("automerge")' <<<"$rule")" = "false"
test "$(jq -r '.addLabels == ["approved", "lgtm"]' <<<"$rule")" = "true"
test "$(jq -r '.matchFileNames == ["Containerfile", "Containerfile.bundle"]' <<<"$rule")" = "true"
test "$(jq -r '.matchUpdateTypes == ["digest"]' <<<"$rule")" = "true"Length of output: 882
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- working-tree diff for renovate.json ---'
git diff -- renovate.json
echo '--- matched UBI-minimal rule ---'
jq '
.dockerfile.packageRules[]
| select(
(.matchPackageNames // [])
| index("registry.access.redhat.com/ubi9/ubi-minimal")
)
' renovate.json
echo '--- validation fields ---'
jq -r '
.dockerfile.packageRules[]
| select(
(.matchPackageNames // [])
| index("registry.access.redhat.com/ubi9/ubi-minimal")
)
| {
hasAutoApprove: has("autoApprove"),
hasAutomerge: has("automerge"),
addLabels,
matchFileNames,
matchUpdateTypes
}
' renovate.jsonLength of output: 1425
@jrvaldes, the change is not present in the current PR branch.
git diff -- renovate.json is empty. The UBI-minimal rule still contains:
"autoApprove": true,
"automerge": trueThe finding remains valid and unresolved. Remove those two keys only. Keep approved, lgtm, and all match criteria unchanged. Then rerun the JSON and rule validation.
You are interacting with an AI system.
| "autoApprove": true, | ||
| "automerge": true, |
There was a problem hiding this comment.
@jira-solve-bot Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @renovate.json around lines 132 - 137, Update the Renovate rule containing
autoApprove, automerge, and addLabels to remove the
unsupported/platform-conflicting autoApprove and automerge options. Keep
addLabels with approved and lgtm so Tide controls approval and merging through
its existing hold-label flow.
|
/test address-review-comments |
|
@jrvaldes: The specified target(s) for The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Summary
Enable automatic merging of MintMaker/Renovate PRs that update the
registry.access.redhat.com/ubi9/ubi-minimal:latestDocker digest inContainerfileandContainerfile.bundle.Problem
PRs such as #4356 that bump the pinned digest of the UBI minimal base image
are mechanical, low-risk, single-line changes that currently require a human
to
/lgtmand/approvebefore Tide merges them.Solution
Add a new
packageRulesentry in thedockerfilemanager section ofrenovate.jsonthat:registry.access.redhat.com/ubi9/ubi-minimaldigest updatesContainerfileandContainerfile.bundleautoApprove: trueandautomerge: trueapprovedandlgtmlabels automaticallyThis follows the same pattern already used for Tekton catalog reference
updates in the same file.
Opt-out
The standard
do-not-merge/holdProw label can still be applied to anyindividual PR to prevent auto-merge.
Acceptance Criteria
lgtmandapprovedwithout manual intervention/lgtmor/approverequired for these digest-update PRsdo-not-merge/holdlabel remains functional (standard Prow behavior)Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin
Summary by CodeRabbit
approvedandlgtmlabels to qualifying updates.