RHOAIENG-21668: chore(gha): run GitHub Actions CI for our RHEL-based workbenches

[jiridanek]

https://issues.redhat.com/browse/RHOAIENG-21668

previously discussed on slack

• https://redhat-internal.slack.com/archives/C060A5FJEAD/p1741022594961149

depends on @andyatmiami 's rstudio work in

• feat(containers): Remove reliance on "chained builds" architecture for rhel9 image builds #517

How tested

• https://github.com/jiridanek/notebooks/actions/runs/13907732646
• Trial PR to check pr action for https://github.com/red-hat-data-services/notebooks/pull/514 jiridanek/notebooks#10

Notes

There does not seem a way to prevent the build to invalidate the stored secret by mistake, and then I get

[3/3] STEP 8/38: RUN subscription-manager status && touch /var/tmp/.subscription-initially-present
+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Consumer profile "4064ef48-aa03-49c2-b449-8dffc941015c" has been deleted from the server. You can use command clean or unregister to remove local profile.
Error: building at STEP "RUN subscription-manager status && touch /var/tmp/.subscription-initially-present": while running runtime: exit status 69

docs

• https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/builds_using_buildconfig/index#builds-create-imagestreamtag_running-entitled-builds

subscription-manager usage in containers

• https://redhat-internal.slack.com/archives/C06NKAPNJRX/p1720635466075499?thread_ts=1720634314.342279&cid=C06NKAPNJRX
• https://redhat-internal.slack.com/archives/C060A5FJEAD/p1734972809129399?thread_ts=1734726658.813289&cid=C060A5FJEAD
• https://redhat-internal.slack.com/archives/C060A5FJEAD/p1734987478025129?thread_ts=1734726658.813289&cid=C060A5FJEAD

UBI and RHEL subscription considerations discussions

• https://redhat-internal.slack.com/archives/C06B3AVCJ64/p1720079270728929
• https://redhat-internal.slack.com/archives/C05NXTEHLGY/p1720013666757209

[jiridanek]

After andy's unchaining of build gets into RHDS, I'll update the pr; for now it builds, runs some tests, but deploy9 fails https://github.com/jiridanek/notebooks/actions/runs/13636395252/job/38116170177

[jiridanek]

The main magic there is

      - name: Unlock encrypted secrets with git-crypt
        if: ${{ inputs.subscription }}
        run: |
          sudo apt-get update
          sudo apt-get install git-crypt
          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
          git-crypt unlock ./git-crypt-key
          rm ./git-crypt-key
        env:
          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}

and then

      - name: Add subscriptions from GitHub secret
        if: ${{ inputs.subscription }}
        run: |
          sudo mkdir -p /etc/pki/
          sudo cp -R ${PWD}/ci/secrets/pki/* /etc/pki/
          printf "${PWD}/ci/secrets/pki/consumer:/etc/pki/consumer\n${PWD}/ci/secrets/pki/entitlement:/etc/pki/entitlement" | sudo tee /usr/share/containers/mounts.conf

          mkdir -p $HOME/.config/containers/
          sudo cp ${PWD}/ci/secrets/pull-secret.txt $HOME/.config/containers/auth.json

[atheo89]

Hey @jiridanek in case that we include that pr on main could you fix the commits before?

[jiridanek]

I'll be taking a look later today as i do the necessary rebase

[andyatmiami]

ℹ️
will (likely/possibly) be "obvious" when it comes time to do the rebase...

but a lot of the "leaf" logic in the gen matrix script can be discarded - and instead the all-images Makefile target simply needs updated to add the targets we want to build..

[jiridanek]

but a lot of the "leaf" logic in the gen matrix script can be discarded - and instead the all-images Makefile target simply needs updated to add the targets we want to build..

all of it can be discarded and the gha "matrix" can build everything

now there is no reason to build pushes and prs differently, the way it used to be the case

fixed, thanks!

[jstourac]

/lgtm

[jiridanek]

Did one final check in cluster, rstudio workbench seems to be unharmed by these changes,

[jiridanek]

/approve

but that won't work since we don't have tide any more?

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jiridanek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jiridanek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jiridanek]

They key is in Bitwarden