NO-ISSUE: Bump

[sk-ilya]

Summary by CodeRabbit

• Chores
  • Updated container image versions and deployment configurations to reference latest service component builds.

[openshift-ci-robot]

@sk-ilya: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sk-ilya
Once this PR has been reviewed and has the lgtm label, please assign omer-vishlitzky for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

Bumps the fulfillment-service image tag from sha-e5f93c5 to sha-ffdfd9f across base/kustomization.yaml, the base/osac-fulfillment-service submodule pointer, and the values/caas-ci.yaml and values/vmaas-ci.yaml CI values files (both main service and dbMigrate image references).

Changes

Fulfillment Service Image Bump

Layer / File(s)	Summary
Submodule pointer and kustomization image tag base/osac-fulfillment-service, base/kustomization.yaml	Advances the submodule reference and updates the newTag in the kustomization image override to sha-ffdfd9f.
CI values image tag updates values/caas-ci.yaml, values/vmaas-ci.yaml	Replaces sha-e5f93c5 with sha-ffdfd9f for the fulfillment-service image and dbMigrate image in both CaaS and VMaaS CI values files.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• osac-project/osac-installer#173: Overlaps with this PR on base/kustomization.yaml image override changes for fulfillment-service and the associated submodule pointer.
• osac-project/osac-installer#194: Same pattern of bumping the base/osac-fulfillment-service subproject reference and corresponding image tags to a new commit.

Suggested reviewers

• adriengentil
• omer-vishlitzky

Poem

🐘 A SHA has changed, the tag is new,
ffdfd9f now rolling through,
Kustomize, submodule, CI all aligned,
Four files updated, no code maligned.
Deploy with confidence — it's just a bump! 🚀

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'NO-ISSUE: Bump' is vague and generic, failing to convey what component or aspect is being bumped, making it unclear for future reference.	Consider a more descriptive title like 'Bump fulfillment-service to sha-ffdfd9f' that clearly identifies what is being updated and to which version.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found. The PR only updates image tags and submodule pointers; all credential references properly use Kubernetes secret resource references rather than embedded values.
No-Weak-Crypto	✅ Passed	PR modifies only YAML configuration files (kustomization and Helm values) updating container image tags. No cryptographic code, weak crypto algorithms (MD5/SHA1/DES/RC4/3DES/Blowfish/ECB), custom c...
No-Injection-Vectors	✅ Passed	No injection vectors found. Python code uses yaml.safe_load(); shell scripts use hardcoded eval arguments; no SQL concatenation, os.system with variables, pickle, yaml.load without SafeLoader, or d...
Container-Privileges	✅ Passed	PR only updates container image tags in config files; no privileged container settings (privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true) are introduced or...
No-Sensitive-Data-In-Logs	✅ Passed	PR introduces no logging statements exposing sensitive data. Changes are configuration updates (image tags, submodule pointers) and a utility script (sync-authconfig-rego.py) with appropriate error...
Ai-Attribution	✅ Passed	The PR commit "NO-ISSUE: Bump" (d8bdabd) shows no evidence of AI tool usage. The commit is authored by Red Hat employee Ilya Skornyakov with no AI generation mentioned. While the PR adds .ai-bot/ c...

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@base/kustomization.yaml`:
- Line 30: The newTag value in the kustomization.yaml file is out of sync with
the submodule commit pointer. The newTag is currently set to sha-ffdfd9f but the
submodule commit is d8bdabd. To fix this, either manually update the newTag
field value to match the current submodule commit hash (d8bdabd), or run the
scripts/sync-image-tags.sh script which is designed to automatically align image
tags with submodule pointers as per the AGENTS.md requirements. After making the
change, verify that the newTag and submodule commit are now in sync.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 4cdf54a5-ac78-4eb9-ad34-ae5c668b37f6

📥 Commits

Reviewing files that changed from the base of the PR and between 6942a64 and d8bdabd.

📒 Files selected for processing (4)

• base/kustomization.yaml
• base/osac-fulfillment-service
• values/caas-ci.yaml
• values/vmaas-ci.yaml

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify submodule commit SHA matches the image tag
cd base/osac-fulfillment-service 2>/dev/null && git rev-parse --short=7 HEAD

Repository: osac-project/osac-installer

Length of output: 79

---

Submodule pointer and image tag are out of sync.

Image tag sha-ffdfd9f does not match the submodule commit d8bdabd. Per AGENTS.md, these must match and CI enforces this via scripts/sync-image-tags.sh. Update one or both to align.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@base/kustomization.yaml` at line 30, The newTag value in the
kustomization.yaml file is out of sync with the submodule commit pointer. The
newTag is currently set to sha-ffdfd9f but the submodule commit is d8bdabd. To
fix this, either manually update the newTag field value to match the current
submodule commit hash (d8bdabd), or run the scripts/sync-image-tags.sh script
which is designed to automatically align image tags with submodule pointers as
per the AGENTS.md requirements. After making the change, verify that the newTag
and submodule commit are now in sync.

[sk-ilya]

/retest-required

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@sk-ilya: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vmaas	d8bdabd	link	true	/test e2e-vmaas

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.