[red-hat-konflux]

Image created from 'https://github.com/openshift/sandboxed-containers-operator?rev=6fc56c1684eb6b53e46122f912d32d8cafd90195'

This PR contains the following updates:

Package	Update	Change
quay.io/redhat-user-workloads/ose-osc-tenant/osc-operator	digest	d5fc416 -> 76d7401

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test
This is Konflux nudging PR, not Mintmaker.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 798b349
• Latest commit, not reviewed: 1402b96

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: openshift/sandboxed-containers-operator
• Branch: devel
• File: .coderabbit.yaml
• Commit: 5473abb
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 42ff6a99-10e6-4e64-b3db-b97c72a63f8e

Commits

Reviewing files that changed from the base of the PR and between 5bb322d and 798b349.

Files selected for processing: 1

• bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

The ClusterServiceVersion manifest changes the controller-manager image digest from d5fc4164ae1333d0abd898a37e205fbc915fd33760473a35fbe868f3b8fd0098 to a3af323746b0b77a868a62a64730e8ca958301583ea38a428534c9b1bbf8fb7b.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: Minimal · previous review 798b3

No actionable merge-blocking risk was found in this digest-only manifest update.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title names the change: a dependency update of osc-operator to commit a3af323. The raw summary confirms the only change is the controller-manager image digest moving from d5fc4164 to a3af3237 in t…
Description check		The description matches the changeset. It states that the osc-operator image digest changes from d5fc416 to a3af323 and names the source revision. It also gives the Renovate configuration and automerg…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS. The pull request changes only one image digest in the CSV manifest. It does not add or modify Ginkgo test titles, so no unstable or legacy metadata test name is introduced.
Test Structure And Quality		PASS: The pull request changes only one image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml. It adds no Ginkgo tests or test code, so the Test Structure and Qua…
Microshift Test Compatibility		PASS: The pull request changes only one image digest in the ClusterServiceVersion manifest. It adds no Ginkgo e2e tests, so the MicroShift test compatibility criteria do not apply.
Single Node Openshift (Sno) Test Compatibility		The pull request changes only one image digest in the CSV manifest. It adds no Ginkgo e2e tests or test code, so it introduces no SNO multi-node compatibility assumption.
Topology-Aware Scheduling Compatibility		The pull request changes only one container image digest in the CSV. The authoritative diff contains no deployment scheduling constraints, replica logic, affinity, topology spread, node selectors, tol…
Ote Binary Stdout Contract		PASS. The pull request changes only the controller-manager image digest in the CSV at line 445. It adds no OTE binary source, suite setup, initializer, logging, or stdout write. The deployment runs `/…
Ipv6 And Disconnected Network Test Compatibility		PASS: The pull request changes only one image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml. It adds no Ginkgo e2e tests and introduces no test networking or ex…
No-Weak-Crypto		PASS. The pull request changes only the operator image reference in the CSV manifest. The digest remains SHA-256 and no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB mode, custom crypto, or non-constant-t…
Container-Privileges		PASS. The pull request changes only the controller-manager image digest. The manifest keeps allowPrivilegeEscalation: false, drops ALL capabilities, and sets pod-level runAsNonRoot: true. The di…
No-Sensitive-Data-In-Logs		The pull request changes only the controller-manager container image digest in the CSV. It adds no logging code and no log-producing configuration, so it does not introduce sensitive data exposure in …

Full details: Title check

Explanation

The title names the change: a dependency update of osc-operator to commit a3af323. The raw summary confirms the only change is the controller-manager image digest moving from d5fc4164 to a3af3237 in the CSV manifest. The title is specific and accurate. It uses the conventional commit prefix chore(deps), which fits a Renovate/Konflux digest bump.

Full details: Description check

Explanation

The description matches the changeset. It states that the osc-operator image digest changes from d5fc416 to a3af323 and names the source revision. It also gives the Renovate configuration and automerge settings, which relate to how this update was produced.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only one image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml. It adds no Ginkgo tests or test code, so the Test Structure and Quality requirements do not apply.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes only one container image digest in the CSV. The authoritative diff contains no deployment scheduling constraints, replica logic, affinity, topology spread, node selectors, tolerations, or PDB changes. The topology-aware scheduling check is therefore not triggered.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes only the controller-manager image digest in the CSV at line 445. It adds no OTE binary source, suite setup, initializer, logging, or stdout write. The deployment runs /manager, not an openshift-tests extension binary, so the stated OTE stdout contract has no introduced violation.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only one image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml. It adds no Ginkgo e2e tests and introduces no test networking or external-connectivity behavior.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes only the operator image reference in the CSV manifest. The digest remains SHA-256 and no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB mode, custom crypto, or non-constant-time secret comparison is introduced.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only the controller-manager image digest. The manifest keeps allowPrivilegeEscalation: false, drops ALL capabilities, and sets pod-level runAsNonRoot: true. The diff adds no privileged: true, hostPID, hostNetwork, hostIPC, or SYS_ADMIN capability.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes only the controller-manager container image digest in the CSV. It adds no logging code and no log-producing configuration, so it does not introduce sensitive data exposure in logs.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

[littlejawa]

/ok-to-test

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.