SRVKP-12864: updated refresh-yarn-lock workflow to run for all release branches

[arvindk-softwaredev]

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix - GH Workflow

Summary

• updated the refresh-yarn-lock workflow to run for all release branches from the workflow schedule trigger
• manual trigger will take an input of the branch name and run the workflow for that single branch alone

[openshift-ci-robot]

@arvindk-softwaredev: This pull request references SRVKP-12864 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

• updated the refresh-yarn-lock workflow to run for all release branches from the workflow schedule trigger
• manual trigger will take an input of the branch name and run the workflow for that single branch alone

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[anwesha-palit-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anwesha-palit-redhat, arvindk-softwaredev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anwesha-palit-redhat,arvindk-softwaredev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Command injection: The user-controlled inputs.branch value is embedded directly into a privileged Bash step, and the workflow has contents: write and pull-requests: write permissions. A crafted manual-dispatch input could break out of the quoted JSON assignment and execute commands using the workflow token. Use an env variable and safely serialize the matrix value rather than injecting the GitHub expression into the script.

⚡ Recommended focus areas for review Command Injection The manually supplied branch is interpolated directly into a Bash script. A crafted value containing quotes or command substitutions could execute arbitrary commands and also produce invalid matrix JSON. Pass the input through an environment variable and generate the JSON with a safe encoder such as jq. if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then echo 'branches=["${{ inputs.branch }}"]' >> "$GITHUB_OUTPUT" Schedule Mismatch The cron expression runs at 10:30 UTC, while the comment says 10:00 UTC and 8:30 AM IST; neither description matches the configured schedule. Confirm the intended execution time and update the cron or comment. # Every Tuesday at 10:00 UTC (8:30AM IST) - cron: "30 10 * * 2"