NO-ISSUE: Bump osac-operator to b613d8d

[DakCrowder]

Summary

• Bumps osac-operator submodule from cc4e026 to b613d8d
• Updates image tag to sha-b613d8d

Included PRs

• OSAC-1534: Replace docker.io/envoyproxy/envoy with ghcr.io mirror #277: Bump the go-dependencies group with 10 updates
• bump submodules #274: Add rgolangh to OWNERS and reviewers list
• OSAC-1526: Replace bitnami/kubectl with origin-cli in validation hook #276: Run make test-kustomize in build-image workflow
• NO-ISSUE: Pass OC_IMPERSONATE to osac login token-script #269: OSAC-179: remove deprecated storageclass
• OSAC-1085: Auto-generate secrets for bundled Postgres #267: OSAC-837: feedback RBAC
• NO-ISSUE: Add aud claim to tokens issued by Keycloak #273: Helm CRD drift check
• docs: document local dev OSAC_AAP_URL value #271: 1.26 toolchain
• Add PublicIPPools/Get and /List to OPA allowed methods in all overlays #268: OSAC-1071: remove bump-osac-installer workflow
• bump submodules #264: Run go fix after update to go 1.26

Test plan

• CI kustomize build passes for all overlays
• e2e vmaas test job passes
• Manual deployment updates osac-operator

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated operator component to reference a newer build.

[coderabbitai]

Walkthrough

This PR updates the osac-operator dependency to a new commit hash (b613d8d). Both the git submodule pointer in base/osac-operator and the Kustomize image tag override in base/kustomization.yaml are updated synchronously to maintain consistency.

Changes

Operator Version Update

Layer / File(s)	Summary
Synchronized operator version references base/osac-operator, base/kustomization.yaml	The base/osac-operator submodule commit reference and the ghcr.io/osac-project/osac-operator image tag in Kustomize are updated together from sha-cc4e026 to sha-b613d8d.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Security note: This is a dependency version bump. Reviewers should verify that the new commit hash represents an intentional, tested upgrade and confirm whether this commit includes any security patches or breaking changes for the operator.

Possibly related PRs

• osac-project/osac-installer#163: Updates both the osac-operator submodule pin and the corresponding Kustomize image tag override in a similar synchronized manner.
• osac-project/osac-installer#97: Also updates base/osac-operator submodule and the matching ghcr.io/osac-project/osac-operator newTag in Kustomize to keep versions in sync.
• osac-project/osac-installer#170: Modifies the ghcr.io/osac-project/osac-operator image tag override in base/kustomization.yaml to update the operator version.

Suggested labels

lgtm, approved

Suggested reviewers

• adriengentil
• trewest

Poem

🚀 A version bump, so clean and neat,
Two refs aligned in sync complete,
From cc4e to b613d,
The operator stands on steady ground,
Security and consistency found! ✨

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (2 errors, 1 warning)

Check name	Status	Explanation	Resolution
No-Injection-Vectors	❌ Error	Sed metacharacter injection found in scripts/sync-image-tags.sh line 61: unescaped variables in sed replacement string allow injection of special characters like & that sed interprets.	Escape sed metacharacters in variables before use in replacement: replace ampersands and backslashes in ${current} and ${expected} before passing to sed.
No-Sensitive-Data-In-Logs	❌ Error	OSAC-CLI-HOWTO.md logs sensitive tokens: line 558 echoes $HUB_TOKEN, line 762 logs token expiry, and line 1714 outputs raw tokens to stdout, exposing authentication credentials.	Remove or redact sensitive logging: replace 'echo "Hub token: $HUB_TOKEN"' with a comment, replace token logging with documentation-only comments, and remove 'echo "$token"' that outputs raw credentials.
Ai-Attribution	⚠️ Warning	Commit uses Co-Authored-By trailer for Claude AI tool, which violates the check. Missing required Assisted-by or Generated-by trailers for Red Hat attribution.	Update commit trailer from Co-Authored-By to Assisted-by or Generated-by format with appropriate Red Hat attribution per contribution guidelines.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found. PR only updates image tags and submodule pointers with public commit SHAs. All sensitive references use GitHub Actions ${{ secrets.* }} syntax.
No-Weak-Crypto	✅ Passed	PR only updates osac-operator submodule pointer and image tag in kustomization.yaml. Pre-existing MD5/SHA1 usage in scripts/realm.json were not introduced by this PR; no new weak crypto added.
Container-Privileges	✅ Passed	No privileged containers, host namespace access, SYS_ADMIN capabilities, or allowPrivilegeEscalation settings found. NFS SCC explicitly disables all privilege flags.
Title check	✅ Passed	The title 'NO-ISSUE: Bump osac-operator to b613d8d' clearly and specifically describes the main change: updating the osac-operator submodule and image tag to commit b613d8d.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@DakCrowder: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Bumps osac-operator submodule from cc4e026 to b613d8d
• Updates image tag to sha-b613d8d

Included PRs

• OSAC-1534: Replace docker.io/envoyproxy/envoy with ghcr.io mirror #277: Bump the go-dependencies group with 10 updates
• bump submodules #274: Add rgolangh to OWNERS and reviewers list
• OSAC-1526: Replace bitnami/kubectl with origin-cli in validation hook #276: Run make test-kustomize in build-image workflow
• NO-ISSUE: Pass OC_IMPERSONATE to osac login token-script #269: OSAC-179: remove deprecated storageclass
• OSAC-1085: Auto-generate secrets for bundled Postgres #267: OSAC-837: feedback RBAC
• NO-ISSUE: Add aud claim to tokens issued by Keycloak #273: Helm CRD drift check
• docs: document local dev OSAC_AAP_URL value #271: 1.26 toolchain
• Add PublicIPPools/Get and /List to OPA allowed methods in all overlays #268: OSAC-1071: remove bump-osac-installer workflow
• bump submodules #264: Run go fix after update to go 1.26

Test plan

• CI kustomize build passes for all overlays
• vmaas-ci e2e tests pass with new operator image

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
• Updated operator component to reference a newer build.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[akshaynadkarni]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akshaynadkarni, DakCrowder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [akshaynadkarni]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[DakCrowder]

/retest