base-images-and-rpms

Name: base-images-and-rpms
Author: redhat-developer

15stars31forks

How to install base-images-and-rpms?

redhat-developer/rhdh-skill/base-images-and-rpms

$npx -y skills add redhat-developer/rhdh-skill --skill base-images-and-rpms

Installs into the current project.

Summary

Updates base images with updateBaseImages.sh and regenerates rpms.lock.yaml with rpm-lockfile-prototype in redhat-developer/rhdh, rhdh-must-gather, and rhdh-operator. Use --analyze for read-only Containerfile/Dockerfile scan (current vs latest tags, UBI skew). Use for weekly upst

Files · 1

View on GitHub

SKILL.md

1	# Base images and RPMs
2
3	## Goal
4
5	Refresh base images and RPM lockfiles in the three upstream GitHub repos:
6
7	\| Repo \| Node / Go source \| RPM containerfile \|
8	\|------\|------------------\|-------------------\|
9	\| rhdh \| `build/containerfiles/Containerfile` or `docker/Dockerfile` (release-1.9) \| `build/containerfiles/Containerfile` or `.rhdh/docker/Dockerfile` \|
10	\| rhdh-operator \| `go.mod` aligned with `ubi9/go-toolset` on main only \| `.rhdh/docker/Dockerfile` \|
11	\| rhdh-must-gather \| — \| `Containerfile` \|
12
13	Upstream helper scripts live in GitLab midstream [rhidp/rhdh](https://gitlab.cee.redhat.com/rhidp/rhdh) on branch `rhdh-1-rhel-9` (see [updateBaseImages.sh](https://gitlab.cee.redhat.com/rhidp/rhdh/-/blob/rhdh-1-rhel-9/build/scripts/updateBaseImages.sh)).
14
15	## Prerequisites
16
17	- `jq`, `skopeo`, `curl`, `git`
18	- `podman` for rhdh node header version detection (see `.nvm/releases/README.adoc`)
19	- `gh` when `updateBaseImages.sh` opens PRs (`--pr`, the default)
20	- `python3` and `pip` when `rpm-lockfile-prototype` is not already installed
21	- Registry auth for base image queries: `docker login registry.redhat.io` (or `skopeo login`)
22
23	Install `rpm-lockfile-prototype` manually when needed:
24
25	```bash
26	python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip 2>/dev/null
27	```
28
29	On Fedora/RHEL hosts, `dnf install podman skopeo python3-dnf` may also be required for lockfile generation.
30
31	## Branch mapping
32
33	Accepted `-b` values: `main` or any `release-*` branch (e.g. `release-1.9`, `release-1.10`, `release-2.1`).
34
35	\| GitHub branch (`-b`) \| GitLab scripts branch (`-sb` for `updateBaseImages.sh`) \|
36	\|----------------------\|---------------------------------------------------------\|
37	\| `main` \| `rhdh-1-rhel-9` \|
38	\| `release-X.Y` \| `rhdh-X.Y-rhel-9` \|
39
40	Verify the target branch exists in each repo before running.
41
42	## Run the bundled script
43
44	Execute [scripts/base-images-and-rpms.sh](scripts/base-images-and-rpms.sh); do not reimplement the workflow inline.
45
46	```bash
47	SKILL=skills/base-images-and-rpms # under 1-rhdh-skill checkout
48	chmod +x "${SKILL}/scripts/base-images-and-rpms.sh"
49
50	# All three repos under a parent directory
51	"${SKILL}/scripts/base-images-and-rpms.sh" -b release-1.10 --parent-dir ~/RHDH
52
53	# Explicit paths and on-disk tools
54	"${SKILL}/scripts/base-images-and-rpms.sh" -b main \
55	--update-base-images-script ~/RHDH/rhdh/build/scripts/updateBaseImages.sh \
56	--rpm-lockfile-prototype ~/.local/bin/rpm-lockfile-prototype \
57	~/RHDH/rhdh \
58	~/RHDH/rhdh-operator \
59	~/RHDH/rhdh-must-gather
60	```
61
62	### Flags
63
64	\| Flag \| Purpose \|
65	\|------\|---------\|
66	\| `-b`, `--branch` \| Required. `main` or `release-*` \|
67	\| `--update-base-images-script PATH` \| Use local `updateBaseImages.sh` (expects `createPR.sh` alongside; fetches if missing) \|
68	\| `--rpm-lockfile-prototype PATH` \| Use local binary; otherwise `~/.local/bin/rpm-lockfile-prototype` or pip install \|
69	\| `--parent-dir PATH` \| Auto-discover `1-rhdh`, `1-rhdh-operator`, `1-must-gather` (and common aliases) \|
70	\| `REPO_DIR ...` \| Explicit repo checkouts \|
71	\| `--skip-base` / `--skip-rpm` \| Run only one half of the workflow \|
72	\| `--dirty` \| Allow dirty trees for `updateBaseImages.sh` \|
73	\| `--push` \| Let `updateBaseImages.sh` push when branch policy allows (still uses `--pr` fallback) \|
74	\| `--no-pr` \| Commit locally with `--no-push` only \|
75	\| `--dry-run` \| Print commands without executing \|
76	\| `--analyze` \| Read-only scan via `analyze-base-images.sh` (no `-b` required; defaults scripts to `main`) \|
77
78	Default: base image updates use `--pr --no-push` (local commits + PR creation, no push). RPM lockfile and node header changes are committed and *pushed to the same open `chore/automated-update-base-images-` PR branch** when one exists; otherwise a `chore/automated-update-rpm-lockfile/<branch>` PR is opened.
79
80	## Analyze without updating
81
82	Use `--analyze` to scan Containerfiles and Dockerfiles without checkout, commits, or registry writes:
83
84	```bash
85	"${SKILL}/scripts/base-images-and-rpms.sh" --analyze --parent-dir ~/RHDH
86
87	# Optional: match GitLab scripts branch to a release line
88	"${SKILL}/scripts/base-images-and-rpms.sh" --analyze -b release-1.10 --parent-dir ~/RHDH
89	```
90
91	Or run the analyzer directly:
92
93	```bash
94	"${SKILL}/scripts/analyze-base-images.sh" \
95	-s /path/to/rhidp/rhdh/build/scripts \
96	-w ~/RHDH/rhdh \
97	-w ~/RHDH/rhdh-operator
98	```
99
100	The analyzer reports current vs latest per `FROM` line, flags malformed tags, and warns on UBI minor skew within a file. Tags mu

People who liked this also viewed

6 picks

Type

base-images-and-rpms

15stars31forks

View on GitHub

How to install base-images-and-rpms?

redhat-developer/rhdh-skill/base-images-and-rpms

$npx -y skills add redhat-developer/rhdh-skill --skill base-images-and-rpms

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Base images and RPMs
2
3	## Goal
4
5	Refresh base images and RPM lockfiles in the three upstream GitHub repos:
6
7	\| Repo \| Node / Go source \| RPM containerfile \|
8	\|------\|------------------\|-------------------\|
9	\| rhdh \| `build/containerfiles/Containerfile` or `docker/Dockerfile` (release-1.9) \| `build/containerfiles/Containerfile` or `.rhdh/docker/Dockerfile` \|
10	\| rhdh-operator \| `go.mod` aligned with `ubi9/go-toolset` on main only \| `.rhdh/docker/Dockerfile` \|
11	\| rhdh-must-gather \| — \| `Containerfile` \|
12
13	Upstream helper scripts live in GitLab midstream [rhidp/rhdh](https://gitlab.cee.redhat.com/rhidp/rhdh) on branch `rhdh-1-rhel-9` (see [updateBaseImages.sh](https://gitlab.cee.redhat.com/rhidp/rhdh/-/blob/rhdh-1-rhel-9/build/scripts/updateBaseImages.sh)).
14
15	## Prerequisites
16
17	- `jq`, `skopeo`, `curl`, `git`
18	- `podman` for rhdh node header version detection (see `.nvm/releases/README.adoc`)
19	- `gh` when `updateBaseImages.sh` opens PRs (`--pr`, the default)
20	- `python3` and `pip` when `rpm-lockfile-prototype` is not already installed
21	- Registry auth for base image queries: `docker login registry.redhat.io` (or `skopeo login`)
22
23	Install `rpm-lockfile-prototype` manually when needed:
24
25	```bash
26	python3 -m pip install --user https://github.com/konflux-ci/rpm-lockfile-prototype/archive/refs/heads/main.zip 2>/dev/null
27	```
28
29	On Fedora/RHEL hosts, `dnf install podman skopeo python3-dnf` may also be required for lockfile generation.
30
31	## Branch mapping
32
33	Accepted `-b` values: `main` or any `release-*` branch (e.g. `release-1.9`, `release-1.10`, `release-2.1`).
34
35	\| GitHub branch (`-b`) \| GitLab scripts branch (`-sb` for `updateBaseImages.sh`) \|
36	\|----------------------\|---------------------------------------------------------\|
37	\| `main` \| `rhdh-1-rhel-9` \|
38	\| `release-X.Y` \| `rhdh-X.Y-rhel-9` \|
39
40	Verify the target branch exists in each repo before running.
41
42	## Run the bundled script
43
44	Execute [scripts/base-images-and-rpms.sh](scripts/base-images-and-rpms.sh); do not reimplement the workflow inline.
45
46	```bash
47	SKILL=skills/base-images-and-rpms # under 1-rhdh-skill checkout
48	chmod +x "${SKILL}/scripts/base-images-and-rpms.sh"
49
50	# All three repos under a parent directory
51	"${SKILL}/scripts/base-images-and-rpms.sh" -b release-1.10 --parent-dir ~/RHDH
52
53	# Explicit paths and on-disk tools
54	"${SKILL}/scripts/base-images-and-rpms.sh" -b main \
55	--update-base-images-script ~/RHDH/rhdh/build/scripts/updateBaseImages.sh \
56	--rpm-lockfile-prototype ~/.local/bin/rpm-lockfile-prototype \
57	~/RHDH/rhdh \
58	~/RHDH/rhdh-operator \
59	~/RHDH/rhdh-must-gather
60	```
61
62	### Flags
63
64	\| Flag \| Purpose \|
65	\|------\|---------\|
66	\| `-b`, `--branch` \| Required. `main` or `release-*` \|
67	\| `--update-base-images-script PATH` \| Use local `updateBaseImages.sh` (expects `createPR.sh` alongside; fetches if missing) \|
68	\| `--rpm-lockfile-prototype PATH` \| Use local binary; otherwise `~/.local/bin/rpm-lockfile-prototype` or pip install \|
69	\| `--parent-dir PATH` \| Auto-discover `1-rhdh`, `1-rhdh-operator`, `1-must-gather` (and common aliases) \|
70	\| `REPO_DIR ...` \| Explicit repo checkouts \|
71	\| `--skip-base` / `--skip-rpm` \| Run only one half of the workflow \|
72	\| `--dirty` \| Allow dirty trees for `updateBaseImages.sh` \|
73	\| `--push` \| Let `updateBaseImages.sh` push when branch policy allows (still uses `--pr` fallback) \|
74	\| `--no-pr` \| Commit locally with `--no-push` only \|
75	\| `--dry-run` \| Print commands without executing \|
76	\| `--analyze` \| Read-only scan via `analyze-base-images.sh` (no `-b` required; defaults scripts to `main`) \|
77
78	Default: base image updates use `--pr --no-push` (local commits + PR creation, no push). RPM lockfile and node header changes are committed and *pushed to the same open `chore/automated-update-base-images-` PR branch** when one exists; otherwise a `chore/automated-update-rpm-lockfile/<branch>` PR is opened.
79
80	## Analyze without updating
81
82	Use `--analyze` to scan Containerfiles and Dockerfiles without checkout, commits, or registry writes:
83
84	```bash
85	"${SKILL}/scripts/base-images-and-rpms.sh" --analyze --parent-dir ~/RHDH
86
87	# Optional: match GitLab scripts branch to a release line
88	"${SKILL}/scripts/base-images-and-rpms.sh" --analyze -b release-1.10 --parent-dir ~/RHDH
89	```
90
91	Or run the analyzer directly:
92
93	```bash
94	"${SKILL}/scripts/analyze-base-images.sh" \
95	-s /path/to/rhidp/rhdh/build/scripts \
96	-w ~/RHDH/rhdh \
97	-w ~/RHDH/rhdh-operator
98	```
99
100	The analyzer reports current vs latest per `FROM` line, flags malformed tags, and warns on UBI minor skew within a file. Tags mu

People who liked this also viewed

6 picks

Type