Skip to content

Make bump-version.sh hermetic and manually update bundle files #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AnnaZivkovic merged 2 commits into from
May 18, 2026
+134 −57
Merged

Make bump-version.sh hermetic and manually update bundle files #207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
42ef280
Make bump-version.sh hermetic and manually update bundle files
AnnaZivkovic May 16, 2026
53d7e33
Increase golangci-lint timeout to 10 minutes
AnnaZivkovic May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .golangci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,4 +73,4 @@ formatters:
- builtin$
- examples$
run:
timeout: 5m
timeout: 10m
58 changes: 38 additions & 20 deletions .tekton/single-arch-build-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,10 +73,6 @@ spec:
default: 'true'
description: Use the package registry proxy when prefetching dependencies
type: string
- name: sast-target-dirs
type: string
default: .
description: Target directories to scan with SAST tools. Multiple values should be separated with commas.
results:
- name: IMAGE_URL
value: $(tasks.build-image-index.results.IMAGE_URL)
Expand Down Expand Up @@ -185,6 +181,33 @@ spec:
workspace: git-auth
- name: netrc
workspace: netrc
- name: run-script
params:
- name: ociStorage
value: $(params.output-image).script
- name: ociArtifactExpiresAfter
value: $(params.image-expires-after)
- name: SCRIPT_RUNNER_IMAGE
value: registry.access.redhat.com/ubi9/go-toolset:1.25
Comment on lines +190 to +191
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, let's read the file to see the current state
cat -n .tekton/single-arch-build-pipeline.yaml | sed -n '180,200p'

Repository: openshift/multiarch-tuning-operator

Length of output: 881

🏁 Script executed:

# Check for SCRIPT_RUNNER_IMAGE usage throughout the codebase
rg "SCRIPT_RUNNER_IMAGE" -n

Repository: openshift/multiarch-tuning-operator

Length of output: 61

🏁 Script executed:

# Look for patterns of image references and how they're typically handled
rg "value: registry\." -n .tekton/ -A 1 -B 1 | head -50

Repository: openshift/multiarch-tuning-operator

Length of output: 556

🏁 Script executed:

# Check if there's documentation on hermetic builds or image pinning
fd -t f -name "*.md" | xargs rg -l "hermetic|digest|image.*pin" 2>/dev/null | head -5

Repository: openshift/multiarch-tuning-operator

Length of output: 529

🏁 Script executed:

# Search for SCRIPT_RUNNER_IMAGE_REFERENCE usage
rg "SCRIPT_RUNNER_IMAGE_REFERENCE" -n

Repository: openshift/multiarch-tuning-operator

Length of output: 61

🏁 Script executed:

# Look for the run-script task definition and how it handles SCRIPT_RUNNER_IMAGE
rg "run-script" -n .tekton/ -B 5 -A 10

Repository: openshift/multiarch-tuning-operator

Length of output: 12349

🏁 Script executed:

# Check how the downstream build task uses the image reference
rg "ADDITIONAL_BASE_IMAGES" -n .tekton/ -B 3 -A 3

Repository: openshift/multiarch-tuning-operator

Length of output: 668

🏁 Script executed:

# Look for other uses of digest pinning (sha256:) in the codebase
rg "`@sha256`:" -n .tekton/

Repository: openshift/multiarch-tuning-operator

Length of output: 10040

🏁 Script executed:

# Check if there's documentation about hermetic builds
cat -n README.md 2>/dev/null | head -50 || echo "No README in root"
rg -l "hermetic" . --type md

Repository: openshift/multiarch-tuning-operator

Length of output: 2982

🏁 Script executed:

# Check if there are other examples of mutable tags in runner images across .tekton files
rg "value: .*:" .tekton/ | grep -v "`@sha256`" | grep -v "params\." | grep -v "tasks\." | grep -v "results\." | head -20

Repository: openshift/multiarch-tuning-operator

Length of output: 1683

🏁 Script executed:

# Look for any documentation on image pinning or hermetic builds
find . -name "*.md" -o -name "*.txt" | xargs grep -l "image.*pin\|hermetic.*image" 2>/dev/null | head -5

Repository: openshift/multiarch-tuning-operator

Length of output: 61

🏁 Script executed:

# Check git history to see if SCRIPT_RUNNER_IMAGE was recently added or changed
git log --oneline -20 -- .tekton/single-arch-build-pipeline.yaml 2>/dev/null | head -10

Repository: openshift/multiarch-tuning-operator

Length of output: 151

🏁 Script executed:

# Check if there are comments or discussions around this image in the file
cat -n .tekton/single-arch-build-pipeline.yaml | grep -B 5 -A 5 "SCRIPT_RUNNER_IMAGE"

Repository: openshift/multiarch-tuning-operator

Length of output: 969

🏁 Script executed:

# Let's check if there's a .git directory and can see the actual commit details
git show f2582a50 --stat 2>/dev/null | head -20

Repository: openshift/multiarch-tuning-operator

Length of output: 791

🏁 Script executed:

# Search for any issue or PR references related to hermetic builds or image pinning
rg "hermetic|SCRIPT_RUNNER_IMAGE" -i . --type md 2>/dev/null | head -10

Repository: openshift/multiarch-tuning-operator

Length of output: 264

🏁 Script executed:

# Check if UBI 9 go-toolset:1.25 specifically is documented or if there's a known digest
web_search
UBI 9 go-toolset 1.25 registry.access.redhat.com image digest

Repository: openshift/multiarch-tuning-operator

Length of output: 172

🌐 Web query:

UBI 9 go-toolset 1.25 registry.access.redhat.com image digest sha256

💡 Result:

The registry.access.redhat.com/ubi9/go-toolset container image is a frequently updated, rolling-release image provided by Red Hat [1][2]. Because it is updated regularly to include the latest security patches and Go toolchain versions, there is no single, static SHA256 digest for the image [3][4][5]. To obtain the current, specific SHA256 digest for the ubi9/go-toolset image, you should query the Red Hat Container Registry directly using a tool like skopeo or podman. You can retrieve the digest for the latest version by running the following command: podman inspect registry.access.redhat.com/ubi9/go-toolset --format '{{.Digest}}' Alternatively, if you have skopeo installed, you can inspect the remote image without pulling it: skopeo inspect docker://registry.access.redhat.com/ubi9/go-toolset | grep Digest These commands will return the current, immutable digest for the image tag currently available in the registry [6]. For production environments, it is recommended to use this specific digest in your Dockerfiles or container manifests to ensure build reproducibility [3][4]. You can find further information and documentation on using these images in the Red Hat Ecosystem Catalog [1][7].

Citations:

Pin SCRIPT_RUNNER_IMAGE by digest.

The registry.access.redhat.com/ubi9/go-toolset:1.25 tag is mutable and receives rolling updates, so the run-script task can execute different code across builds despite HERMETIC=true. While the resolved reference is recorded in ADDITIONAL_BASE_IMAGES for tracking, this does not prevent the image from being re-pulled with different content. Pinning by digest is required to achieve true hermetic behavior and is consistent with the recent commit's goal of fixing hermetic compliance violations.

Proposed fix 
-    - name: SCRIPT_RUNNER_IMAGE
-      value: registry.access.redhat.com/ubi9/go-toolset:1.25
+    - name: SCRIPT_RUNNER_IMAGE
+      value: registry.access.redhat.com/ubi9/go-toolset@sha256:<pinned-digest>

Obtain the digest using: podman inspect registry.access.redhat.com/ubi9/go-toolset:1.25 --format '{{.Digest}}'

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/single-arch-build-pipeline.yaml around lines 190 - 191, Replace the
mutable tag value for the environment variable SCRIPT_RUNNER_IMAGE with an
immutable image reference pinned by digest: run podman inspect
registry.access.redhat.com/ubi9/go-toolset:1.25 --format '{{.Digest}}' (or use
equivalent registry API) to obtain the image digest, then update
SCRIPT_RUNNER_IMAGE's value to
registry.access.redhat.com/ubi9/go-toolset@sha256:<DIGEST>; ensure the pinned
reference matches what is recorded in ADDITIONAL_BASE_IMAGES so the run-script
task becomes hermetic.

- name: SCRIPT
value: |
export COMMIT_SHA="$(tasks.clone-repository.results.commit)"
exec ./hack/bump-version.sh
- name: HERMETIC
value: "true"
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
runAfter:
- prefetch-dependencies
taskRef:
params:
- name: name
value: run-script-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-run-script-oci-ta:0.1@sha256:0e13a74cc02c945e7119ecd4cc0c9148e7591b50f87e415b212154caad0479c0
- name: kind
value: task
resolver: bundles
- name: build-container
params:
- name: IMAGE
Expand Down Expand Up @@ -217,11 +240,14 @@ spec:
- name: NO_PROXY
value: $(tasks.init.results.no-proxy)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: ADDITIONAL_BASE_IMAGES
value:
- $(tasks.run-script.results.SCRIPT_RUNNER_IMAGE_REFERENCE)
runAfter:
- prefetch-dependencies
- run-script
taskRef:
params:
- name: name
Expand Down Expand Up @@ -261,7 +287,7 @@ spec:
- name: BINARY_IMAGE_DIGEST
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
Expand Down Expand Up @@ -352,11 +378,9 @@ spec:
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: TARGET_DIRS
value: $(params.sast-target-dirs)
runAfter:
- build-image-index
taskRef:
Expand Down Expand Up @@ -422,11 +446,9 @@ spec:
- name: BUILD_ARGS_FILE
value: $(params.build-args-file)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: TARGET_DIRS
value: $(params.sast-target-dirs)
runAfter:
- coverity-availability-check
taskRef:
Expand Down Expand Up @@ -472,11 +494,9 @@ spec:
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: TARGET_DIRS
value: $(params.sast-target-dirs)
runAfter:
- build-image-index
taskRef:
Expand All @@ -501,11 +521,9 @@ spec:
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
- name: TARGET_DIRS
value: $(params.sast-target-dirs)
runAfter:
- build-image-index
taskRef:
Expand Down Expand Up @@ -551,7 +569,7 @@ spec:
- name: CONTEXT
value: $(params.path-context)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
value: $(tasks.run-script.results.SCRIPT_ARTIFACT)
runAfter:
- build-image-index
taskRef:
Expand Down
131 changes: 95 additions & 36 deletions hack/bump-version.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,50 +2,109 @@

set -e

# Accept version as first argument, fall back to VERSION env var, or show usage
# Generate or accept version
# Priority: 1) command line arg, 2) OPERATOR_VERSION env var, 3) generate from Makefile + commit
if [ -n "$1" ]; then
VERSION="$1"
elif [ -z "$VERSION" ]; then
echo "Usage: $0 <version>"
echo " or set VERSION environment variable"
echo "Example: $0 1.2.1"
exit 1
echo "Using version from argument: $VERSION"
elif [ -n "$OPERATOR_VERSION" ]; then
VERSION="$OPERATOR_VERSION"
echo "Using version from OPERATOR_VERSION environment: $VERSION"
else
# Generate version from Makefile + commit SHA
echo "Generating version dynamically..."

# Read base version from Makefile
if [ -f Makefile ]; then
BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}')
Comment on lines +17 to +19
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 16, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep Makefile's base version stable.

Makefile is now both the source of BASE_VERSION and the target for the derived BASE_VERSION-<sha> value. A second run against the same checkout will compound the suffix and produce versions like 1.3.0-abc1234-def5678, which breaks the intended format.

Proposed fix 
-        BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}')
+        BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}' | sed -E 's/-[0-9a-f]{7}$//')

Also applies to: 87-88

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@hack/bump-version.sh` around lines 17 - 19, The script reads and then
rewrites the Makefile's VERSION causing compound suffixes; change the
BASE_VERSION extraction (the BASE_VERSION assignment that uses grep/awk) to
strip any existing -<sha> suffix (e.g., remove anything from the first '-'
onward or match only the semver part) so you always start from the pure base
version before appending a new suffix; apply the same sanitization wherever
BASE_VERSION is re-read or used later (refer to the BASE_VERSION variable and
the grep/awk extraction around that block and the similar logic at the later
BASE_VERSION uses on lines referenced 87-88).

Copy link
Copy Markdown
Author

@AnnaZivkovic AnnaZivkovic May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not actually modifying the code it is just modifying the code in the pipeline

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

@AnnaZivkovic, that's a fair point — since the script runs inside an ephemeral pipeline workspace with a fresh clone each time, the Makefile will always contain the original base version (e.g., 1.3.0) at the start of every build. The compound-suffix scenario I described (e.g., 1.3.0-abc1234-def5678) would only occur if the script were re-run on a persistent checkout where the Makefile had already been modified. This concern doesn't apply here. I'll dismiss the comment.

🏁 Script executed:

#!/bin/bash
# Resolve the comment ID so we can dismiss it
gh api repos/openshift/multiarch-tuning-operator/pulls/207/comments --jq '.[] | select(.user.login == "coderabbitai[bot]") | {id: .id, body: .body[0:80]}'

Length of output: 244

🏁 Script executed:

#!/bin/bash
# Resolve the review comment thread for comment ID 3251643924
gh api \
  --method PUT \
  repos/openshift/multiarch-tuning-operator/pulls/207/comments/3251643924/resolve \
  2>&1 || true

# Alternative: mark thread as resolved via GraphQL
COMMENT_NODE_ID=$(gh api repos/openshift/multiarch-tuning-operator/pulls/207/comments --jq '.[] | select(.id == 3251643924) | .node_id')
echo "Node ID: $COMMENT_NODE_ID"

gh api graphql -f query='
mutation ResolveThread($threadId: ID!) {
  resolveReviewThread(input: {threadId: $threadId}) {
    thread {
      isResolved
    }
  }
}' -f threadId="$COMMENT_NODE_ID" 2>&1 || true

Length of output: 508

🏁 Script executed:

#!/bin/bash
# Get the review thread node IDs for the PR
gh api graphql -f query='
{
  repository(owner: "openshift", name: "multiarch-tuning-operator") {
    pullRequest(number: 207) {
      reviewThreads(first: 20) {
        nodes {
          id
          isResolved
          comments(first: 1) {
            nodes {
              databaseId
              body
            }
          }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.comments.nodes[0].databaseId == 3251643924) | {threadId: .id, isResolved: .isResolved}'

Length of output: 56

🏁 Script executed:

#!/bin/bash
# Resolve the review thread using the correct thread node ID
gh api graphql -f query='
mutation ResolveThread($threadId: ID!) {
  resolveReviewThread(input: {threadId: $threadId}) {
    thread {
      id
      isResolved
    }
  }
}' -f threadId="PRRT_kwDOOukHvs6CgbDS"

Length of output: 43

🏁 Script executed:

#!/bin/bash
# Retry resolving the review thread
gh api graphql --input - <<'EOF'
{
  "query": "mutation ResolveThread($threadId: ID!) { resolveReviewThread(input: {threadId: $threadId}) { thread { id isResolved } } }",
  "variables": { "threadId": "PRRT_kwDOOukHvs6CgbDS" }
}
EOF

Length of output: 43

@AnnaZivkovic, I wasn't able to programmatically resolve the thread due to a persistent network issue with the GitHub GraphQL API in this environment. You're welcome to resolve it manually — the concern doesn't apply given the ephemeral pipeline context you described.

else
echo "❌ ERROR: Makefile not found and VERSION not provided"
echo "Usage: $0 <version>"
echo " or set OPERATOR_VERSION environment variable"
exit 1
fi

if [ -z "$BASE_VERSION" ]; then
echo "❌ ERROR: Could not read VERSION from Makefile"
exit 1
fi

# Get commit SHA from environment variable (set by pipeline) or git
COMMIT_SHA_VALUE="${COMMIT_SHA:-}"
if [ -z "$COMMIT_SHA_VALUE" ] && command -v git &> /dev/null && [ -d .git ]; then
COMMIT_SHA_VALUE=$(git rev-parse HEAD 2>/dev/null || echo "")
fi

# If we have a commit SHA, append it to the version
if [ -n "$COMMIT_SHA_VALUE" ]; then
COMMIT_SHORT="${COMMIT_SHA_VALUE:0:7}"
VERSION="${BASE_VERSION}-${COMMIT_SHORT}"
echo "Generated version: $VERSION (from Makefile: $BASE_VERSION + commit: $COMMIT_SHORT)"
else
VERSION="$BASE_VERSION"
echo "Using base version from Makefile: $VERSION (no commit SHA available)"
fi
fi

echo "Bumping version to: $VERSION"

# Extract major.minor version for CPE label (e.g., 1.3.4 -> 1.3)
# Extract major.minor version for CPE label (e.g., 1.3.4 -> 1.3, 1.3.0-abc1234 -> 1.3)
MAJOR_MINOR=$(echo "$VERSION" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
echo "CPE version (major.minor): $MAJOR_MINOR"

yq -i ".spec.version=\"${VERSION}\"" config/manifests/bases/multiarch-tuning-operator.clusterserviceversion.yaml
yq -i ".metadata.name=\"multiarch-tuning-operator.v${VERSION}\"" config/manifests/bases/multiarch-tuning-operator.clusterserviceversion.yaml
yq -i ".spec.startingCSV=\"multiarch-tuning-operator.v${VERSION}\"" deploy/base/operators.coreos.com/subscriptions/openshift-multiarch-tuning-operator/subscription.yaml
yq eval-all -i "(select(.schema==\"olm.channel\").entries[0].name)=\"multiarch-tuning-operator.v${VERSION}\"" index.base.yaml


if [[ "$(uname)" == "Darwin" ]]; then
# macOS BSD sed
sed -i '' "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" Dockerfile
sed -i '' "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" Dockerfile
sed -i '' "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" Dockerfile
sed -i '' "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" konflux.Dockerfile
sed -i '' "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" konflux.Dockerfile
sed -i '' "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" konflux.Dockerfile
sed -i '' "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.Dockerfile
sed -i '' "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.konflux.Dockerfile
sed -i '' "s/^VERSION ?= .*/VERSION ?= ${VERSION}/" Makefile
# Escape version for use in sed (handles dots and dashes)
VERSION_ESCAPED=$(echo "$VERSION" | sed 's/[.]/\\./g')

echo "Updating version references..."

# Update config/manifests/bases/multiarch-tuning-operator.clusterserviceversion.yaml
sed -i "s/^ version: .*/ version: ${VERSION}/" config/manifests/bases/multiarch-tuning-operator.clusterserviceversion.yaml
sed -i "s/^ name: multiarch-tuning-operator\.v.*/ name: multiarch-tuning-operator.v${VERSION}/" config/manifests/bases/multiarch-tuning-operator.clusterserviceversion.yaml

# Update deploy/base/operators.coreos.com/subscriptions/openshift-multiarch-tuning-operator/subscription.yaml
sed -i "s/^ startingCSV: multiarch-tuning-operator\.v.*/ startingCSV: multiarch-tuning-operator.v${VERSION}/" deploy/base/operators.coreos.com/subscriptions/openshift-multiarch-tuning-operator/subscription.yaml

# Update index.base.yaml (channel entry name)
sed -i "s/^ name: multiarch-tuning-operator\.v.*/ name: multiarch-tuning-operator.v${VERSION}/" index.base.yaml

# Update Dockerfiles
sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" Dockerfile

sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" konflux.Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" konflux.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" konflux.Dockerfile

sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" bundle.Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" bundle.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.Dockerfile

sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" bundle.konflux.Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" bundle.konflux.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.konflux.Dockerfile

# Update Makefile
sed -i "s/^VERSION ?= .*/VERSION ?= ${VERSION}/" Makefile

# Update bundle files directly (instead of running make bundle)
echo "Updating bundle files..."

# Update bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml
if [ -f bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml ]; then
sed -i "s/^ version: .*/ version: ${VERSION}/" bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml
sed -i "s/^ name: multiarch-tuning-operator\.v.*/ name: multiarch-tuning-operator.v${VERSION}/" bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml
else
# Linux GNU sed
sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" Dockerfile
sed -i "s/^LABEL release=.*/LABEL release=\"${VERSION}\"/" konflux.Dockerfile
sed -i "s/^LABEL version=.*/LABEL version=\"${VERSION}\"/" konflux.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" konflux.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.Dockerfile
sed -i "s/^LABEL cpe=.*/LABEL cpe=\"cpe:\/a:redhat:multiarch_tuning_operator:${MAJOR_MINOR}::el9\"/" bundle.konflux.Dockerfile
sed -i "s/^VERSION ?= .*/VERSION ?= ${VERSION}/" Makefile
echo "⚠️ Warning: bundle/manifests/multiarch-tuning-operator.clusterserviceversion.yaml not found, skipping"
fi
echo "make bundle"
make bundle

# Update bundle/metadata/annotations.yaml
if [ -f bundle/metadata/annotations.yaml ]; then
# The annotations.yaml has version in several places, update all
sed -i "s/operators\.operatorframework\.io\.bundle\.channels\.v1: .*/operators.operatorframework.io.bundle.channels.v1: stable/" bundle/metadata/annotations.yaml
else
echo "⚠️ Warning: bundle/metadata/annotations.yaml not found, skipping"
fi

echo "✅ Version bumped to: $VERSION"
echo "✅ All version references updated"