docs(#3503): document RPM lockfile scope for UBI bump PRs - #3575
fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
Add a UBI Base Image Updates section to AGENTS.md that explains the relationship between hack/ubi-base-image-bump.sh, hack/update-rpm-lock.sh, and the scope of rpms.lock.yaml. The section documents that rpms.lock.yaml is regenerated from rpms.in.yaml and only tracks the explicitly listed packages (ca-certificates, jq, gzip). RPMs that live inside the ubi-minimal base image are not tracked, so a digest bump that only ships updates to base-image-bundled RPMs produces no diff in the lockfile even when regeneration ran successfully. The absence of documentation for this behavior led to a false-positive review finding on PR #3499 that claimed the lockfile was not regenerated, costing ~1.5 hours of reviewer back-and-forth. The added section gives reviewers (human and automated) enough context to dismiss the same finding on future UBI bump PRs. Also carries the release-v* branch guidance so all UBI-bump review context lives in one place. Note: pre-commit hooks were not run. `pre-commit` could not fetch the conforma/hooks repository (HTTP 403 from the sandbox), and the only configured hook (check-commit-message) runs at the commit-msg stage, not against files. The 'resolves: #3503' trailer below is formatted to satisfy that hook when it runs in CI. resolves: #3503
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Risk Assessment: moderate (2/5) DetailsPurely additive documentation change to AGENTS.md tightly scoped to a well-defined issue; the only elevated signals are bot authorship and modification of a protected agent-instructions file. |
ReviewFindingsMedium
|
fullsend-ai-review
Bot
added
the
requires-manual-review
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
|
||
| ### RPM lockfile scope | ||
|
|
||
| `rpms.lock.yaml` is generated from `rpms.in.yaml` and only tracks the packages |
There was a problem hiding this comment.
/fs-fix The lockfile also contains resolved dependencies (for example, oniguruma), not only packages explicitly listed in rpms.in.yaml. Please clarify the scope accordingly.
|
/fs-fix The lockfile also contains resolved dependencies (for example, oniguruma), not only packages explicitly listed in rpms.in.yaml. Please clarify the scope accordingly. |
This branch has not been deployed
1 participant
What:
Add a UBI Base Image Updates section to
AGENTS.mdthat documents:ubi-minimaldigest and the bumpworkflow (
hack/ubi-base-image-bump.sh→hack/update-rpm-lock.sh).rpms.lock.yaml— it is generated fromrpms.in.yamland only tracks the packages listed there (
ca-certificates,jq,gzip). RPMs that live inside the base image itself(
curl-minimal,glib2,libcurl-minimal,libnghttp2, etc.) arenot tracked.
rpms.lock.yamlafter a UBIdigest bump is the expected outcome when no tracked package's version
changed, and should not be flagged as "lockfile was not regenerated."
release-v*branches, bumps mayintentionally skip the acceptance Dockerfile.
Why:
On PR #3499, an automated reviewer flagged
rpms.lock.yamlas notregenerated after a UBI base image digest bump. The lockfile was
regenerated but produced no diff because the updated RPMs
(
curl-minimal,glib2,libcurl-minimal,libnghttp2) live insidethe base image and are not tracked in
rpms.in.yaml. The trackedpackages (
ca-certificates,jq,gzip) were unaffected. Dismissingthis false positive cost ~1.5 hours of reviewer back-and-forth.
The root cause is a documentation gap: nothing in the repo explained
what
rpms.lock.yamlactually tracks or why a no-diff regeneration isexpected. Documenting this in
AGENTS.mdgives both automatedreviewers and humans enough context to dismiss the same finding on
future UBI bump PRs without contacting the author.
Related work: PR #3504 adds a broader UBI Base Image Updates section
covering release-branch behavior. This PR focuses on the RPM lockfile
scope. If both land, the sections should be reconciled — the topics
are complementary.
Tickets:
Issue #3503.
Testing:
Documentation-only change to
AGENTS.md; no code paths are affected.Verified the added section renders as intended in the diff and that
the file has no other changes.
Closes #3503
Post-script verification
agent/3503-document-rpm-lockfile-scope)65cf118af7ebe9efb68a3fd396d0eb249a001ca5..HEAD)