[red-hat-konflux]

Image created from 'https://github.com/confidential-devhub/coco-podvm-scripts?rev=a4aca658cb2cf528c51cb4cee4dcdd444d673e29'

This PR contains the following updates:

Package	Update	Change
quay.io/redhat-user-workloads/ose-osc-tenant/osc-dm-verity-image	digest	157c7af -> bc3869d

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test
This is Konflux nudging PR, not Mintmaker.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The RELATED_IMAGE_PODVM_OCI image reference now uses digest bc3869d116cee14da88d88ee014cf43316e610661158076a635faa82a1ea0b96 in the manager configuration and CSV deployment environment variable. The CSV podvm-oci related image entry also uses this digest.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: littlejawa

Merge Risk: Minimal · up to 5e1c6

The digest-only update is internally consistent and ready to merge.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title names the change: a dependency update of osc-dm-verity-image to digest bc3869d. The raw summary confirms the digest change in the CSV and manager.yaml RELATED_IMAGE_PODVM_OCI references. The…
Description check		The description states the source image, the package and digest change from 157c7af to bc3869d, and the Renovate/Konflux configuration. It relates directly to the digest update in the changeset.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names		PASS: The pull request changes only two YAML image references from one fixed digest to another. The diff introduces no Ginkgo test declarations or test titles, so it does not introduce unstable or ove…
Test Structure And Quality		The pull request changes only two YAML manifests and updates the RELATED_IMAGE_PODVM_OCI image digest. It adds no Ginkgo test code or It() blocks, so the listed test-structure requirements do not …
Microshift Test Compatibility		PASS: The pull request changes only two YAML image references for RELATED_IMAGE_PODVM_OCI and podvm-oci. The authoritative diff adds no Ginkgo e2e tests, so it introduces no MicroShift-incompatibl…
Single Node Openshift (Sno) Test Compatibility		The pull request changes only the osc-dm-verity-image digest in two YAML manifests. It adds no Ginkgo e2e tests or other test code, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility		The pull request changes only the osc-dm-verity-image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no scheduling c…
Ote Binary Stdout Contract		The pull request changes only two YAML image digests: RELATED_IMAGE_PODVM_OCI and the podvm-oci related image. It does not change process-level code or add any stdout writes. The OTE Binary Stdout…
Ipv6 And Disconnected Network Test Compatibility		PASS: The pull request changes only two YAML image references for RELATED_IMAGE_PODVM_OCI and podvm-oci. The authoritative diff adds no Ginkgo tests or test code, so the IPv4 and disconnected-netw…
No-Weak-Crypto		The pull request changes only two container image references, replacing one SHA-256 image digest with another in deployment configuration and the CSV manifest. It adds no MD5, SHA-1, DES, RC4, 3DES, B…
Container-Privileges		The pull request changes only the osc-dm-verity-image digest in two manifest locations. It does not add or modify privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root execution, or `…
No-Sensitive-Data-In-Logs		The pull request changes only two image digest references in deployment manifests. It adds no logging code and does not expose passwords, tokens, API keys, PII, hostnames, session IDs, or customer dat…

Full details: Title check

Explanation

The title names the change: a dependency update of osc-dm-verity-image to digest bc3869d. The raw summary confirms the digest change in the CSV and manager.yaml RELATED_IMAGE_PODVM_OCI references. The title is specific and matches the main change.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only two YAML image references from one fixed digest to another. The diff introduces no Ginkgo test declarations or test titles, so it does not introduce unstable or overly specific test names.

Full details: Test Structure And Quality

Explanation

The pull request changes only two YAML manifests and updates the RELATED_IMAGE_PODVM_OCI image digest. It adds no Ginkgo test code or It() blocks, so the listed test-structure requirements do not apply.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only two YAML image references for RELATED_IMAGE_PODVM_OCI and podvm-oci. The authoritative diff adds no Ginkgo e2e tests, so it introduces no MicroShift-incompatible API or feature use.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes only the osc-dm-verity-image digest in bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml and config/manager/manager.yaml. It adds no scheduling constraints, replica logic, affinity, topology spread, node selectors, tolerations, or PDBs.

Full details: Ote Binary Stdout Contract

Explanation

The pull request changes only two YAML image digests: RELATED_IMAGE_PODVM_OCI and the podvm-oci related image. It does not change process-level code or add any stdout writes. The OTE Binary Stdout Contract is therefore not violated.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only two YAML image references for RELATED_IMAGE_PODVM_OCI and podvm-oci. The authoritative diff adds no Ginkgo tests or test code, so the IPv4 and disconnected-network test compatibility conditions do not apply.

Full details: No-Weak-Crypto

Explanation

The pull request changes only two container image references, replacing one SHA-256 image digest with another in deployment configuration and the CSV manifest. It adds no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB usage, custom crypto implementation, or secret/token comparison.

Full details: Container-Privileges

Explanation

The pull request changes only the osc-dm-verity-image digest in two manifest locations. It does not add or modify privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root execution, or allowPrivilegeEscalation: true. The manager container retains runAsNonRoot: true, allowPrivilegeEscalation: false, and drops all capabilities.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes only two image digest references in deployment manifests. It adds no logging code and does not expose passwords, tokens, API keys, PII, hostnames, session IDs, or customer data in logs.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Recent review info

Run configuration

• Source mode: Auto
• Repository: openshift/sandboxed-containers-operator
• Branch: devel
• File: .coderabbit.yaml
• Commit: e3b49eb
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: ee055f9a-3a2c-4ad5-be37-5c76c9ff8d02

Commits

Reviewing files that changed from the base of the PR and between e3b49eb and 5e1c662.

Files selected for processing: 2

• bundle/manifests/sandboxed-containers-operator.clusterserviceversion.yaml
• config/manager/manager.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[openshift-merge-bot]

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

[openshift-ci]

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[littlejawa]

/ok-to-test

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.