fix(rhdh-base-images): push catalog builder edits when header resolution fails [main]

skills/ci/rhdh-base-images/scripts/base-images-and-rpms.sh

@@ -980,13 +980,19 @@ update_plugin_catalog_node() {
     catalog_image=$(rhdh_nodejs_builder_image "${catalog_cf}")
     if [[ -z "${catalog_image}" ]]; then
         warn "plugin-catalog: no ubi*/nodejs FROM in ${catalog_cf}"
+        # FROM / rhocp edits must be pushed before the next branch checkout.
+        commit_push_paths "${git_branch}" "chore: pin catalog builder" "${catalog_cf}"
         popd >/dev/null
         return 0
     fi
 
     node_plain=$(catalog_headers_plain_version "${catalog_cf}" "${catalog_image}")
     if [[ -z "${node_plain}" ]]; then
         warn "plugin-catalog: could not resolve a Node headers version from ${catalog_image}"
+        # Header resolution can fail after pin_catalog_builder_from already rewrote
+        # builder.Containerfile. Commit that rewrite so weekly can open a GitLab MR
+        # and the next branch checkout is not blocked by a dirty tree.
+        commit_push_paths "${git_branch}" "chore: pin catalog builder" "${catalog_cf}"
         popd >/dev/null
         return 0
     fi

skills/ci/rhdh-base-images/workflows/update-base-images.md

@@ -207,6 +207,7 @@ Do not downgrade. If `go.mod` already pins a newer toolchain (for example `go1.2
 - Treating `rpm-lockfile-prototype` `No sources found for` / "no matching sources" warnings as a failure or remaining risk. The source RPM is often unpublished; the lockfile is still valid.
 - Lowering `go.mod` `toolchain` (or `go`) to match an older UBI Go toolset image. Keep the newer pin.
 - Copying plugin-catalog `.nvm/` headers while leaving `builder.Containerfile` FROM on an older UBI Node tag, or leaving a stale `node-v*` in `konflux.additional-tags`.
+- Returning from a catalog update after `builder.Containerfile` changed but before that file is committed. The next branch checkout then aborts, and weekly never opens a GitLab MR. Push the Containerfile even when Node header resolution fails.
 - Setting catalog headers from the UBI image `node --version` when `builder.Containerfile` `dnf`-installs a newer `nodejs` RPM before the headers `RUN`. That is the 1.10 failure mode: image v24.19.0, module RPM 24.21.0, missing `node-v24.21.0-headers.tar.gz`.
 - Copying an older rhdh `.nvm/` onto a catalog builder whose `dnf` nodejs RPM is newer.
 - Handing catalog FROM / overlays `versions.json` to `/rhdh-konflux-tasks`. That skill invokes this one; it does not pin those files.

tests/unit/test_base_images_and_rpms.py

@@ -481,6 +481,10 @@ def test_skill_covers_openshift_el9_beta_rpm_bump(self) -> None:
         script = MAIN_SCRIPT.read_text(encoding="utf-8")
         assert "bump_openshift_rpm_repos" in script
         assert "bump_catalog_builder_rhocp" in script
+        unresolved = script.split(
+            'warn "plugin-catalog: could not resolve a Node headers version', 1
+        )[1][:500]
+        assert 'commit_push_paths "${git_branch}" "chore: pin catalog builder"' in unresolved
         assert (
             'commit_push_paths "${branch}" "chore: update rpms.lock.yaml [skip-build]" rpms.lock.yaml rpms.in.yaml'
             in script