[jkopriva]

Validate changed graph and catalog sources in repository CI and prevent automated workflows from pushing invalid catalog content.

Assisted-by: Codex

[qodo-for-securesign]

PR Summary by Qodo

Validate FBC catalog sources in CI and before automated commits

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Validate changed catalog sources on pull requests and pushes, with full validation when tooling
 changes.
• Check generated catalogs before release and nightly workflows create signed commits.
• Document local validation and the required check for release snapshots.

Diagram

graph TD
  CI["PR push dispatch"] --> Scope["Select catalog scope"] --> Sources["Catalog sources"] --> Validator["OPM graph validation"] --> Pass["Passing CI check"]
  Auto["Release nightly sync"] --> Sources
  Validator -->|automation succeeds| Signed["Signed commit"]
  Validator -->|failure| Halt["Stop workflow"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Validate every catalog on every CI run

• ➕ Simpler scope selection
• ➕ Detects unrelated, pre-existing catalog failures
• ➖ More OPM work on routine catalog changes
• ➖ Unrelated failures could block focused changes

Recommendation: Keep selective CI validation with full-validation fallbacks for tooling changes and unavailable base revisions. Reusing the existing graph-sync validator in automated workflows avoids separate validation standards while preventing their invalid catalog commits.

Files changed (5) +142 / -4

Documentation (1) +13 / -2

README.mdDocument CI validation and release-check expectations +13/-2

Document CI validation and release-check expectations

• Explains when changed or all catalogs are validated, where automated workflows validate, and the successful-check requirement for a Release CR's snapshot source.

README.md

Other (4) +129 / -2

create-release.yamlValidate requested catalog versions before signing +11/-0

Validate requested catalog versions before signing

• Validates each generated catalog source after rendering and before staging changes for the signed release commit.

.github/workflows/create-release.yaml

sync-catalog.yamlUse full source validation during nightly synchronization +1/-2

Use full source validation during nightly synchronization

• Replaces catalog-only OPM validation with the shared check that also verifies graph and catalog synchronization before artifacts reach the commit job.

.github/workflows/sync-catalog.yaml

validate-fbc-catalogs.yamlAdd repository CI check for FBC sources +41/-0

Add repository CI check for FBC sources

• Runs validation on pull requests, pushes to main and release branches, and manual dispatch. Installs OPM and passes event revisions to the catalog-selection script.

.github/workflows/validate-fbc-catalogs.yaml

validate_changed_fbc_catalogs.shSelect catalog contexts and run shared validation +76/-0

Select catalog contexts and run shared validation

• Derives affected contexts from a Git diff, validates all contexts for tooling changes or unavailable base revisions, and supports an explicit all-catalog mode. Skips removed contexts and reports failure if any remaining catalog fails validation.

utils/validate_changed_fbc_catalogs.sh

[qodo-for-securesign]

Code Review by Qodo

Nice, no open findings for this group

Nice, no open findings for this group

Nice, no open findings for this group

[bot-securesign-pr-manager]

⚠️ Out of Sync: This branch is behind its target branch (main) after the catalog update. Please rebase or merge.

[bot-securesign-pr-manager]

⚠️ Out of Sync: This branch is behind its target branch (main) after the catalog update. Please rebase or merge.

[bot-securesign-pr-manager]

⚠️ Out of Sync: This branch is behind its target branch (main) after the catalog update. Please rebase or merge.

[bot-securesign-pr-manager]

⚠️ Out of Sync: This branch is behind its target branch (main) after the catalog update. Please rebase or merge.