Add workflow in each repo to apply Konflux manifests on changes

.github/workflows/apply-konflux-manifests.yaml

@@ -6,6 +6,8 @@ on:
   push:
     paths:
       - ".konflux/**"
+    branches:
+      - 'main'
 defaults:
   run:
     shell: bash

cmd/konflux-apply/README.md

@@ -34,4 +34,11 @@ As we use by default Tokens with a validity of 6 months, we need to recreate the
 3. Create a new Token for 6 months and [update the `KONFLUX_SA_TOKEN` secret](https://github.com/openshift-knative/hack/settings/secrets/actions) with its value:
    ```shell
    kubectl create token gh-action --duration $((6*30*24))h
-   ```
+   ```
+
+## Manually apply all Konflux Manifests
+
+In case you want to manually apply all Konflux manifests across all repos, do the following:
+
+1. Make sure, you're logged in to Konflux via the CLI and have access to the `ocp-serverless` workspace. Check for example the [Konflux kickstart recording](https://drive.google.com/drive/u/0/folders/0AB3Zk0vHI6ulUk9PVA) or the [Konflux docs](https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/getting-access.md#accessing-konflux-via-cli)
+2. Run `make konflux-apply`. This will clone all repos and checkout the branches which have Konflux enabled and apply their Konflux manifests.

cmd/konflux-gen/main.go

@@ -18,6 +18,7 @@ const (
 	fbcBuilderImagesFlag     = "fbc-images"
 	outputFlag               = "output"
 	pipelineOutputFlag       = "pipeline-output"
+	workflowsPathFlag        = "workflows-path"
 )
 
 func main() {
@@ -34,6 +35,7 @@ func run() error {
 	pflag.StringVar(&cfg.ApplicationName, applicationNameFlag, "", "Konflux application name")
 	pflag.StringVar(&cfg.ResourcesOutputPath, outputFlag, "", "output path")
 	pflag.StringVar(&cfg.PipelinesOutputPath, pipelineOutputFlag, ".tekton", "output path for pipelines")
+	pflag.StringVar(&cfg.WorkflowsPath, workflowsPathFlag, ".github/workflows", "output path for Github workflows")
 	pflag.StringArrayVar(&cfg.Includes, includesFlag, nil, "Regex to select CI config files to include")
 	pflag.StringArrayVar(&cfg.Excludes, excludesFlag, nil, "Regex to select CI config files to exclude")
 	pflag.StringArrayVar(&cfg.ExcludesImages, excludeImagesFlag, nil, "Regex to select CI config images to exclude")

pkg/konfluxgen/apply-konflux-manifests-workflow.yaml

@@ -0,0 +1,25 @@
+name: Apply Konflux Manifests
+on:
+  workflow_dispatch: # Manual workflow trigger
+  push:
+    paths:
+      - ".konflux/**"
+    branches:
+    - 'main'
+    - 'release-v*'
+jobs:
+  trigger-konflux-apply:
+    name: Trigger Konflux Apply
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Konflux Apply
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.SERVERLESS_QE_ROBOT }}
+          script: |
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: 'hack',
+              workflow_id: 'apply-konflux-manifests.yaml',
+              ref: 'main',
+            })

pkg/konfluxgen/konfluxgen.go

@@ -38,6 +38,8 @@ const (
 	registryRepoName  = "openshift-serverless-1"
 	prodRegistry      = prodRegistryHost + "/" + registryRepoName
 	stageRegistry     = stageRegistryHost + "/" + registryRepoName
+
+	triggerKonfluxApplyManifestsWorkflowFile = "apply-konflux-manifests.yaml"
 )
 
 //go:embed application.template.yaml
@@ -64,6 +66,9 @@ var PipelineFBCBuildTemplate embed.FS
 //go:embed integration-test-scenario.template.yaml
 var EnterpriseContractTestScenarioTemplate embed.FS
 
+//go:embed apply-konflux-manifests-workflow.yaml
+var ApplyKonfluxManifestsWorkflow []byte
+
 //go:embed releaseplanadmission-component.template.yaml
 var ComponentReleasePlanAdmissionsTemplate embed.FS
 
@@ -91,6 +96,7 @@ type Config struct {
 
 	PipelinesOutputPathSkipRemove bool
 	PipelinesOutputPath           string
+	WorkflowsPath                 string
 
 	AdditionalTektonCELExpressionFunc func(cfg cioperatorapi.ReleaseBuildConfiguration, ib cioperatorapi.ProjectDirectoryImageBuildStepConfiguration) string
 	NudgesFunc                        func(cfg cioperatorapi.ReleaseBuildConfiguration, ib cioperatorapi.ProjectDirectoryImageBuildStepConfiguration) []string
@@ -108,6 +114,8 @@ type Config struct {
 
 	ComponentReleasePlanConfig *ComponentReleasePlanConfig
 	AdditionalComponentConfigs []TemplateConfig
+
+	SkipApplyKonfluxWorkflowCreation bool
 }
 
 type PrefetchDeps struct {
@@ -473,9 +481,23 @@ func Generate(cfg Config) error {
 		}
 	}
 
+	if !cfg.SkipApplyKonfluxWorkflowCreation {
+		if err := addApplyKonfluxManifestsWorkflow(cfg); err != nil {
+			return fmt.Errorf("failed to add apply-konflux-manifests workflow: %w", err)
+		}
+	}
+
 	return nil
 }
 
+func addApplyKonfluxManifestsWorkflow(cfg Config) error {
+	if err := os.MkdirAll(cfg.WorkflowsPath, 0755); err != nil {
+		return fmt.Errorf("failed to create %s: %w", cfg.WorkflowsPath, err)
+	}
+
+	return os.WriteFile(filepath.Join(cfg.WorkflowsPath, triggerKonfluxApplyManifestsWorkflowFile), ApplyKonfluxManifestsWorkflow, 0644)
+}
+
 func collectConfigurations(openshiftReleasePath string, includes []*regexp.Regexp, excludes []*regexp.Regexp, additionalConfigs []TemplateConfig) ([]TemplateConfig, error) {
 	configs := make([]TemplateConfig, 0, 8)
 	err := filepath.WalkDir(openshiftReleasePath, func(path string, info fs.DirEntry, err error) error {

pkg/prowgen/prowgen_konflux.go

@@ -150,6 +150,7 @@ func GenerateKonflux(ctx context.Context, openshiftRelease Repository, configs [
 						JavaImages:          b.Konflux.JavaImages,
 						ResourcesOutputPath: fmt.Sprintf("%s/.konflux", r.RepositoryDirectory()),
 						PipelinesOutputPath: fmt.Sprintf("%s/.tekton", r.RepositoryDirectory()),
+						WorkflowsPath:       fmt.Sprintf("%s/.github/workflows", r.RepositoryDirectory()),
 						Nudges:              nudges,
 						// Preserve the version tag as first tag in any instance since SO, when bumping the patch version
 						// will change it before merging the PR.
@@ -304,6 +305,7 @@ func GenerateKonfluxServerlessOperator(ctx context.Context, openshiftRelease Rep
 			ResourcesOutputPathSkipRemove: true,
 			ResourcesOutputPath:           resourceOutputPath,
 			PipelinesOutputPath:           fmt.Sprintf("%s/.tekton", r.RepositoryDirectory()),
+			WorkflowsPath:                 fmt.Sprintf("%s/.github/workflows", r.RepositoryDirectory()),
 			Nudges:                        b.Konflux.Nudges,
 			NudgesFunc: func(cfg cioperatorapi.ReleaseBuildConfiguration, ib cioperatorapi.ProjectDirectoryImageBuildStepConfiguration) []string {
 				if strings.Contains(string(ib.To), "serverless-bundle") {
@@ -320,6 +322,9 @@ func GenerateKonfluxServerlessOperator(ctx context.Context, openshiftRelease Rep
 			// will change it before merging the PR.
 			// See `openshift-knative/serverless-operator/hack/generate/update-pipelines.sh` for more details.
 			Tags: []string{soMetadata.Project.Version},
+			// We can skip the GH workflow creation to apply the Konflux manifests, as the SO
+			// manifests are stored in the hack repo and the workflow is anyhow present in there
+			SkipApplyKonfluxWorkflowCreation: true,
 		}
 		if len(cfg.ExcludesImages) == 0 {
 			cfg.ExcludesImages = []string{
@@ -413,6 +418,9 @@ func generateFBCApplications(soMetadata *project.Metadata, openshiftRelease Repo
 			// will change it before merging the PR.
 			// See `openshift-knative/serverless-operator/hack/generate/update-pipelines.sh` for more details.
 			Tags: []string{soMetadata.Project.Version},
+			// We can skip the GH workflow creation to apply the Konflux manifests, as the SO
+			// manifests are stored in the hack repo and the workflow is anyhow present in there
+			SkipApplyKonfluxWorkflowCreation: true,
 		}
 
 		if err := konfluxgen.Generate(c); err != nil {