[main] ESO-569, ESO-570, ESO-571: Pin hack tools and harden Renovate

[bharath-b-rh]

Summary

• Pin shellcheck, hadolint, renovate, and skopeo image refs used by hack scripts to digests via hack/tool-images.sh
• Pin opm version with per-arch SHA-256 verification in hack/get-opm.sh (used for FBC/catalog updates)
• Harden renovate.json: default-deny Containerfile/Tekton docker updates, digest-only for already-pinned Containerfiles, Konflux Tekton catalog rules, and major/minor-only updates for hack tool images

Test plan

• make verify-shell-scripts
• make verify-containerfiles
• make validate-renovate-config
• make get-opm downloads and reports sha256 OK; rerunning is a no-op when the pin matches

[openshift-ci-robot]

@bharath-b-rh: No Jira issue with key ESO-569 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

Summary

• Pin shellcheck, hadolint, renovate, and skopeo image refs used by hack scripts to digests via hack/tool-images.sh
• Pin opm version with per-arch SHA-256 verification in hack/get-opm.sh (used for FBC/catalog updates)
• Harden renovate.json: default-deny Containerfile/Tekton docker updates, digest-only for already-pinned Containerfiles, Konflux Tekton catalog rules, and major/minor-only updates for hack tool images

Test plan

• make verify-shell-scripts
• make verify-containerfiles
• make validate-renovate-config
• make get-opm downloads and reports sha256 OK; rerunning is a no-op when the pin matches

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@bharath-b-rh: No Jira issue with key ESO-570 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

Summary

• Pin shellcheck, hadolint, renovate, and skopeo image refs used by hack scripts to digests via hack/tool-images.sh
• Pin opm version with per-arch SHA-256 verification in hack/get-opm.sh (used for FBC/catalog updates)
• Harden renovate.json: default-deny Containerfile/Tekton docker updates, digest-only for already-pinned Containerfiles, Konflux Tekton catalog rules, and major/minor-only updates for hack tool images

Test plan

• make verify-shell-scripts
• make verify-containerfiles
• make validate-renovate-config
• make get-opm downloads and reports sha256 OK; rerunning is a no-op when the pin matches

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@bharath-b-rh: No Jira issue with key ESO-571 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

Summary

• Pin shellcheck, hadolint, renovate, and skopeo image refs used by hack scripts to digests via hack/tool-images.sh
• Pin opm version with per-arch SHA-256 verification in hack/get-opm.sh (used for FBC/catalog updates)
• Harden renovate.json: default-deny Containerfile/Tekton docker updates, digest-only for already-pinned Containerfiles, Konflux Tekton catalog rules, and major/minor-only updates for hack tool images

Test plan

• make verify-shell-scripts
• make verify-containerfiles
• make validate-renovate-config
• make get-opm downloads and reports sha256 OK; rerunning is a no-op when the pin matches

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bharath-b-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bharath-b-rh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment