[HYPERSHELL-46] Automated PRs to update OpenShell gateway and supervisor images via Renovate

[bsquizz]

Summary

• Adds a Renovate customManagers regex manager that detects OpenShell gateway and supervisor image references pinned as GATEWAY_IMAGE / GATEWAY_SUPERVISOR_IMAGE env var values in deploy/base/ deployment manifests
• Uses a regex versioning template to filter 3000+ noisy tags (commit SHAs, arch-specific, build artifacts) down to the 20 official releases matching v{major}.{minor}.{patch}-rhaiv.{build}
• Groups both images into a single "OpenShell images" PR
• Adds the auto-update spec at specs/platform/openshell-image-auto-update.spec.md documenting watched sources, version filtering, validation gate, and merge policy

Test plan

• Renovate config is valid JSON
• Regex tested against deploy/base/controller.yaml and deploy/base/control-plane/deployment.yaml — matches all 4 image references with correct capture groups
• fileMatch correctly includes deploy/base/ and excludes IBM/Kind overlays
• Version regex tested against live quay.io tags — filters 3232 tags to 20 releases, correctly identifies v0.0.113-rhaiv.2 as latest
• Renovate dry-run detects the pinned images and proposes the expected bump

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: 0ae93bab-c727-4e82-9de4-38e9d2058c38

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[jsell-rh]

Amber review

Status: Complete

View the submitted review.

[jsell-rh]

Verdict

This is a clean, well-documented CI/config change that wires a Renovate custom regex manager to keep the GATEWAY_IMAGE/GATEWAY_SUPERVISOR_IMAGE pins in deploy/base/ up to date, gated behind the e2e suite. The spec is accurate against the code (StaticImageDefaults reads both env vars; the referenced config.go TODO exists), the regex matches all four real references, and the forbidden-terms hook passes with the whitelisted em dash on CLAUDE.md:125. I have no blocking findings, only a few minor items and one policy decision worth a maintainer's explicit sign-off.

Details

Confidence: High on the config/spec correctness, Medium on the Renovate-version-specific notes (no pinned Renovate version to check against).

• Digest-required regex is brittle (Minor). matchStrings requires @sha256:<digest>. Any future reference pinned tag-only (no digest) is silently skipped: no update, no error. The spec's "both must be updated together" invariant is only enforced by convention. Consider a CI guard (or a second matchString) so a tag-only pin fails loudly rather than dropping out of auto-update coverage.
• Automerge of third-party images is a policy decision (Discussion). automerge: true on external OpenShell images is a supply-chain posture. It is reasonably mitigated by minimumReleaseAge: 14 days and the full e2e gate, but unattended merging of upstream container images should be an explicit maintainer choice, not an implicit one.
• fileMatch is deprecated in recent Renovate (Minor, low confidence). Newer Renovate renamed fileMatch to managerFilePatterns. Depending on the Renovate version this org runs, fileMatch may only emit a deprecation warning today. Worth confirming.
• En dash inconsistent with the new convention (Minor). specs/platform/openshell-image-auto-update.spec.md:91 uses an en dash (U+2013) in 00:00–07:00. The hook only rejects em dashes (U+2014), so CI passes, but this contradicts the intent of the "use hyphens" convention this same PR introduces.

Cross-PR coordination

An open pull request that adopts the upstream OpenShell Helm chart for gateway deployments rewrites the exact GATEWAY_IMAGE/GATEWAY_SUPERVISOR_IMAGE values in deploy/base/controller.yaml that this PR's Renovate regex depends on, changing them to a different registry/org, dropping the @sha256: digest, and dropping the -rhaiv.{build} version scheme. That is a material design conflict, not a text merge conflict: it moves the source of truth for gateway images (env-var pins vs. Helm chart values) and would silently disable this PR's auto-update regex (no digest, no matching package name, no matching versioning template), so Renovate would stop detecting bumps without any error. Because both changes are authored by the same person, the author and maintainers need to decide the merge order and reconcile the pinning scheme - specifically whether Renovate should track the pinned env-var images or the Helm chart reference, and update this spec/regex accordingly. Coordination required with PR #194.

Findings Summary (ordered by severity, highest first)

1. [Minor] Digest-required matchStrings silently skips any tag-only pin - no update, no error - Maintainability (renovate.json L14)
2. [Minor] automerge: true on external OpenShell images is an unattended supply-chain merge policy that should be an explicit maintainer decision - Security / Policy (renovate.json L62)
3. [Minor] fileMatch is deprecated in recent Renovate in favor of managerFilePatterns - Convention (renovate.json L12)
4. [Minor] En dash (U+2013) contradicts the "use hyphens" convention this PR adds - Spec Consistency (spec L91)

Convention Checklist

Convention	Result
Forbidden-terms hook passes (em dash whitelisted)	Pass
JSON config valid (renovate.json, whitelist)	Pass
Spec claims match code (StaticImageDefaults, env vars, config.go TODO)	Pass
Image references consistent across manifests	Pass
Conventional commit messages	Pass
Config separated from code	Pass

[jsell-rh]

[Minor] Digest-required regex is brittle. This matchStrings only matches references that carry an @sha256:<digest>. If a future GATEWAY_IMAGE/GATEWAY_SUPERVISOR_IMAGE value is ever pinned tag-only, it is silently skipped - no update proposed and no error raised - so it quietly falls out of auto-update coverage. Consider a CI guard (or a second, digest-optional matchString) so a tag-only pin fails loudly instead of disappearing from Renovate's view.

[jsell-rh]

[Minor / Policy] Unattended merge of third-party images. automerge: true on external OpenShell images is a supply-chain posture. It is reasonably mitigated by the inherited minimumReleaseAge: 14 days and the full e2e gate, but auto-merging upstream container images without human review should be an explicit maintainer decision. Please confirm that is intended.

[jsell-rh]

[Minor] fileMatch deprecation. Recent Renovate renamed fileMatch to managerFilePatterns for custom managers. Depending on the Renovate version this repo runs, fileMatch may only emit a deprecation warning today. Worth confirming against the deployed version to avoid the manager silently no-op'ing on a future upgrade.

[jsell-rh]

[Minor] En dash contradicts the new convention. 00:00–07:00 uses an en dash (U+2013). The forbidden-terms hook only rejects em dashes (U+2014), so CI passes, but this contradicts the intent of the "use hyphens" convention introduced by this same PR. Suggest 00:00-07:00.

[jsell-rh]

Amber review

Status: Complete

View the submitted review.

[jsell-rh]

Verdict

This is a clean, well-scoped CI/config change: the Renovate customManagers regex, the version-filtering template, and the matchPackageNames grouping all match the real image pins in deploy/base/controller.yaml and deploy/base/control-plane/deployment.yaml, and both renovate.json and the forbidden-terms check pass locally. I found no blockers or security issues; the notes below are minor robustness/coordination items, plus one cross-PR conflict that needs a maintainer decision.

What I verified

• renovate.json is valid JSON and the new custom.regex manager keys are well-formed.
• The matchStrings regex matches all four GATEWAY_IMAGE / GATEWAY_SUPERVISOR_IMAGE references in deploy/base/ with correct depName / currentValue / currentDigest capture groups.
• managerFilePatterns (^deploy/base/.*\.yaml$) correctly includes the base manifests and excludes the IBM overlay (deploy/ibm/kustomization.yaml), which uses an internal-mirror reference and is documented as out of scope.
• The current pinned tag v0.0.109-rhaiv.0 satisfies the regex: versioning template, so Renovate can resolve the current version and order future bumps.
• python3 scripts/check_forbidden_terms.py passes: the em-dash whitelist entry points at CLAUDE.md line 125, which is exactly where the new "No em dashes" rule (which must contain a literal em dash) lives.

Cross-PR coordination

Another open pull request adopts the upstream OpenShell Helm chart for gateway deployments and, as part of that work, rewrites the GATEWAY_IMAGE / GATEWAY_SUPERVISOR_IMAGE values in deploy/base/controller.yaml from quay.io/opendatahub/odh-openshell-*:v0.0.109-rhaiv.0@sha256:<digest> to quay.io/bsquizza/openshell-*:16112bc (a different registry/repository, no digest, and a tag that does not follow the v{major}.{minor}.{patch}-rhaiv.{build} convention). This is a direct assumption conflict with this PR: the Renovate manager here is keyed to the opendatahub package names, the tag@digest pin format, and the rhaiv versioning regex. If that PR merges, this manager silently tracks nothing (custom regex managers emit no error when they match no dependency). That PR also shifts image selection toward Helm chart values, which raises the question of whether the deploy/base env-var pins remain the authoritative source Renovate should watch. Maintainers should decide the authoritative image reference/registry/format for deploy/base/controller.yaml and coordinate merge order between that pull request and this one. This is a design decision, not a text merge conflict (the two PRs do not even touch the same files).

Findings

• [Minor] Silent no-match risk (renovate.json matchStrings) - Renovate custom regex managers do not error when a matchStrings pattern matches nothing; if the image reference format in deploy/base ever changes, the auto-update stops silently with no signal. Consider a lightweight CI guard (a test that asserts the regex still matches the current deploy/base manifests) or completing the still-unchecked "Renovate dry-run" item in the test plan. Observability
• [Minor] depName capture assumes no registry port (renovate.json matchStrings) - (?<depName>[^:\s]+) stops at the first colon, so a registry:port/... reference would be mis-parsed. This is safe for deploy/base today (no ports there; the port-bearing IBM mirror is excluded), so it's only worth a comment for future robustness. Robustness
• [Minor] Line-pinned whitelist is fragile (.forbidden-terms-whitelist.json / CLAUDE.md L125) - the em-dash exemption is keyed to CLAUDE.md line 125; any future insertion above that line shifts the rule and trips check-forbidden-terms until the whitelist is re-pinned. This follows the existing line-based convention, so it's acceptable, but a brief inline note by the rule would reduce future churn. Maintainability

Findings Summary (ordered by severity, highest first):

1. [Minor] Custom regex manager fails silently if the deploy/base image format changes; no CI guard - Observability (renovate.json matchStrings)
2. [Minor] depName regex assumes no registry port - Robustness (renovate.json matchStrings)
3. [Minor] Line-pinned forbidden-terms whitelist entry is fragile - Maintainability (CLAUDE.md L125)

Convention Checklist:

Convention	Result
Valid Renovate JSON config	Pass
Regex matches actual deploy/base image pins	Pass
managerFilePatterns scoping (base in, overlays out)	Pass
Versioning template matches current pinned tag	Pass
Forbidden-terms check passes / whitelist correct	Pass
Image references consistent across manifests	Pass
Conventional commit messages	Pass
Spec added and indexed (specs/index.spec.md)	Pass

[jsell-rh]

Robustness note (Minor): Renovate custom regex managers do not raise an error when a matchStrings pattern matches nothing - they simply produce zero dependencies. If the GATEWAY_IMAGE / GATEWAY_SUPERVISOR_IMAGE reference format in deploy/base ever changes (registry, env-var name, or a move into Helm values), this auto-update will silently stop with no signal. Consider a small CI guard that asserts the regex still matches the current deploy/base manifests, or complete the unchecked "Renovate dry-run" item in the test plan.

Separately: (?<depName>[^:\s]+) stops at the first colon, so a registry:port/... reference would be mis-parsed. Safe for deploy/base today (no ports; the port-bearing IBM mirror is excluded), but worth noting for future robustness.

[jsell-rh]

Maintainability note (Minor): the em-dash exemption in .forbidden-terms-whitelist.json is pinned to CLAUDE.md line 125. Any future line inserted above this rule shifts it and will trip check-forbidden-terms until the whitelist is re-pinned. This matches the existing line-based whitelist convention so it's acceptable, but the coupling is fragile.