Update OWNERS for /charts/partners/atiwary-containers/12334555

.github/actions/get-ocp-range/action.yaml

@@ -0,0 +1,35 @@
+name: 'Get OCP range'
+description: 'Get the range of OCP versions corresponding to the provided range of Kubernetes versions'
+inputs:
+  kube-version-range:
+    description: 'Range of Kubernetes versions'
+    required: true
+outputs:
+  ocp-version-range:
+    description: "Corresponsing range of OCP versions"
+    value: ${{ steps.run-get-ocp-range.outputs.ocp-version-range }}
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: '>=1.20'
+
+    - name: Install get-ocp-range
+      shell: bash
+      run: go install github.com/opdev/getocprange/cmd/get-ocp-range@latest
+
+    - name: Run get-ocp-range
+      id: run-get-ocp-range
+      shell: bash
+      run: |
+        echo "::debug::Received kubeVersionRange to translate '${{ inputs.kube-version-range }}'"
+        OCP_VERSION_RANGE=$(get-ocp-range '${{ inputs.kube-version-range }}')
+        echo "ocp-version-range=$OCP_VERSION_RANGE" >> $GITHUB_OUTPUT
+        echo "::debug::Successfully translated kubeVersionRange to OCPVersionRange $OCP_VERSION_RANGE"
+
+    - name: Display error message if get-ocp-range failed
+      if: ${{ failure() && steps.run-get-ocp-range.outcome == 'failure' }}
+      shell: bash
+      run: echo "::error file=.github/actions/get-ocp-range/action.yaml::Error running get-ocp-range"

.github/labeler.yml

@@ -0,0 +1,4 @@
+allow/chart-changes:
+  - any: ['charts/partners/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/redhat/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/community/**/**/*', '!charts/partners/**/**/OWNERS']

.github/workflows/check-contributor.yml

@@ -0,0 +1,77 @@
+name: Check Contributor
+
+# Checks that the input user exists in the approvers section
+# of a given OWNERS file.
+#
+# Returns true/false at the is-repo-owner output.
+#
+# Can be configured to fail altogether for contexts where it makes sense,
+# but in cases where this needs to return a green check mark, it is the
+# the caller's responsibility to evaluate the is-repo-owner output to inform
+# whether to proceed with subsequent tasks.
+#
+# Intended for use with workflows triggered by pull_request_target (or similar)
+# events.
+
+on:
+  workflow_call:
+    inputs:
+      user:
+        type: string
+        required: true
+        description: 
+          the user to evaluate
+      fail-workflow-if-not:
+        type: boolean
+        required: false
+        default: false
+        description: |
+          fails this workflow if the contributor is not an owner, 
+          or the evaluation fails for any other reason
+    outputs:
+      is-repo-owner: # 'true' / 'false'
+        description: whether the input user is a repo owner
+        value: ${{ jobs.check-contributor.outputs.is-repo-owner }}
+jobs:
+  check-contributor:
+    outputs:
+      is-repo-owner: ${{ steps.populate-output.outputs.is-repo-owner }}
+    name: Contributor is repo owner
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout repository base
+        uses: actions/checkout@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+
+      - name: Install CI Scripts
+        run: |
+          # set up python scripts
+          echo "set up python script in $PWD"
+          python3 -m venv ve1
+          cd scripts
+          ../ve1/bin/pip3 install -r requirements.txt
+          ../ve1/bin/pip3 install .
+          cd ..
+
+      - name: Check contributor
+        # The return code from this script is what's important in this workflow.
+        id: check-contributor
+        continue-on-error: true
+        run: |
+          ./ve1/bin/user-is-repo-owner ${{ inputs.user }}
+
+      - name: Add result to output
+        id: populate-output
+        # Outcome is the result of the workflow before continue-on-error is applied.
+        run: |
+          echo "is-repo-owner=${{ steps.check-contributor.outcome == 'success' }}" >> $GITHUB_OUTPUT
+
+      - name: Fail if requested and the user is not a repo owner
+        if: inputs.fail-workflow-if-not && steps.populate-output.outputs.is-repo-owner != 'true'
+        run: |
+          echo "::error::Workflow is failing at the caller's request."
+          exit -1

.github/workflows/ci-enabled.yml

@@ -0,0 +1,41 @@
+name: Ensure CI is Enabled
+# This workflow allows a project to disable workflows based on a repository or
+# organizational environment variable. 
+#
+# Create a repo or org environment variable with its value set to 'true'
+# for this workflow to succeed. Any other value should cause this workflow
+# to fail.
+#
+# https://docs.github.com/en/actions/learn-github-actions/variables#creating-configuration-variables-for-a-repository
+#
+# Example usage, assuming this workflow is local to your repository:
+#
+# jobs:
+#   ensure_ci_enabled:
+#     uses: ./.github/workflows/check-ci-enabled.yml
+#     with:
+#       is-enabled: ${{ vars.CUSTOM_VAR_CI_ENABLED }}
+#
+#   next_task:
+#     needs: ensure_ci_enabled
+#     runs-on: ubuntu-latest
+#     steps:
+#     - ...
+
+on:
+  workflow_call:
+    inputs:
+      is-enabled:
+        type: string
+        required: true
+
+jobs:
+  fail_if_ci_disabled:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check enablement value
+      run: |
+        test "${{ inputs.is-enabled }}" = "true" \
+          || { echo "::error::Halting because this repo/org/env configuration has not explicitly enabled this CI."; \
+            exit 1 ;}
+        echo "::notice::CI is enabled!"

.github/workflows/mercury_bot.yml

@@ -0,0 +1,102 @@
+name: OWNERS PR Check
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited, ready_for_review, labeled]
+
+jobs:
+  owners-file-check:
+    name: OWNERS file PR checker
+    runs-on: ubuntu-20.04
+    if: github.event.pull_request.draft == false && github.actor == 'redhat-mercury-bot'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Set up Python 3.x Part 1
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+
+      - name: Set up Python 3.x Part 2
+        run: |
+          # set up python
+          python3 -m venv ve1
+          cd scripts
+          ../ve1/bin/pip3 install -r requirements.txt
+          ../ve1/bin/pip3 install .
+          cd ..
+
+      - name: get files changed
+        id: get_files_changed
+        env:
+          BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
+        run: |
+          # get files in PR
+          ./ve1/bin/pr-artifact --api-url=${{ github.event.pull_request._links.self.href }} \
+                                --get-files
+
+      - name: check if only an OWNERS file is pushed
+        id: check_for_owners
+        env:
+          pr_files_py: "${{ steps.get_files_changed.outputs.pr_files }}"
+        run: |
+          # check if PR contains just one partner OWNERS file
+          pr_files=($(echo "$pr_files_py" | tr -d '[],'))
+          echo "Files in PR: ${pr_files[@]}"
+          eval first_file=${pr_files[0]}
+          if [ ${#pr_files[@]} == 1 ]; then
+            eval first_file=${pr_files[0]}
+            if [[ $first_file == "charts/partners/"*/*"/OWNERS" ]] ; then
+                echo "An OWNERS file has been modified or added"
+                echo "merge_pr=true" >> $GITHUB_OUTPUT
+            else
+              echo "The file in the PR is not a partner OWNERS file"
+              echo "merge_pr=false" >> $GITHUB_OUTPUT
+              echo "msg=ERROR: PR does not include a partner OWNERS file." >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "The PR contains multiple files."
+            echo "msg=ERROR: PR contains multiple files." >> $GITHUB_OUTPUT
+            echo "merge_pr=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment on PR
+        if: ${{ steps.check_for_owners.outputs.merge_pr == 'false' }}
+        uses: actions/github-script@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+              var issue_number = ${{ github.event.number }};
+              var comment = "${{ steps.check_for_owners.outputs.msg }}";
+              github.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: Number(issue_number),
+                body: comment
+              });
+
+      - name: Reflect on check for OWNERS file result
+        if: ${{ steps.check_for_owners.outputs.merge_pr == 'false' }}
+        run: |
+          # exit with failure if PR is not for a single partner OWNERS file
+          echo "The PR was not for a single partner OWNERS file."
+          exit 1
+
+      - name: Approve PR
+        id: approve_pr
+        if: ${{ steps.check_for_owners.outputs.merge_pr == 'true' }}
+        uses: hmarr/auto-approve-action@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge PR
+        id: merge_pr
+        if: ${{ steps.approve_pr.conclusion == 'success' }}
+        uses: pascalgn/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGE_METHOD: squash
+          MERGE_LABELS: ""
+
+

.github/workflows/python-style.yml

@@ -0,0 +1,29 @@
+name: Python Style
+
+on:
+  pull_request:
+    paths:
+    # Only trigger on core script changes
+    - 'scripts/**.py'
+
+jobs:
+  enforce:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Set up Python 3.x Part 1
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.10"
+    - name: Install style tooling
+      working-directory: scripts
+      run: make venv.codestyle
+    - name: Run formatter
+      working-directory: scripts
+      run: make ci.format
+      # Temporarily auto-pass linting until we are able to manually review and
+      # address.
+    - name: Run linter
+      working-directory: scripts
+      run: make lint || true

.github/workflows/test-ci-enabled.yml

@@ -0,0 +1,14 @@
+name: Test CERTIFICATION_ENABLED
+
+# A developer convenience workflow.
+# Tests to see if the CERTIFICATION_ENABLED value indicates
+# certification is enabled.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test_certification_enabled:
+    uses: ./.github/workflows/ci-enabled.yml
+    with:
+      is-enabled: ${{ vars.CERTIFICATION_ENABLED }}

.github/workflows/test-cluster-access.yml

@@ -0,0 +1,28 @@
+name: Test Cluster Access
+
+# Intended to be used when cluster secrets change (e.g. when transitioning to
+# new clusters), this workflow confirms access to the cluster.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test-cluster-access:
+    name: Test Cluster Access
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Install oc
+      uses: redhat-actions/openshift-tools-installer@v1
+      with:
+        oc: latest
+    - name: Read API_SERVER endpoint
+      id: login-params
+      run: |
+        API_SERVER=$( echo -n ${{ secrets.API_SERVER }} | base64 -d)
+        echo "API_SERVER=${API_SERVER}" >> $GITHUB_OUTPUT
+    - uses: redhat-actions/oc-login@v1
+      id: oc_login
+      with:
+        openshift_server_url: ${{ steps.login-params.outputs.API_SERVER }}
+        openshift_token: ${{ secrets.CLUSTER_TOKEN }}
+        insecure_skip_tls_verify: true