ISV-7520: verify checksum of opm version, update deps

[JakubDurkac]

Verified checksum of installed opm version in apps/worker/Containerfile.

Also updated dependencies across the project as it seemed like a good opportunity.

Small update to README.md as I saw there was an outdated/inaccurate part.

[qodo-redhat-openshift-ecosystem]

PR Summary by Qodo

Verify opm download checksum and refresh project dependencies

✨ Enhancement ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Pin opm download in the worker image and verify it via SHA256 during build.
• Update Python and Node dependencies across apps and regenerate Poetry/pnpm lockfiles.
• Adjust tox configuration and a web chart date cast to stay compatible with upgraded tooling.

Diagram

graph TD
  CI(["CI / local build"]) --> DEP[/"Deps manifests"/] --> LOCK[/"Lockfiles"/]
  CI --> WCF[/"apps/worker/Containerfile"/] --> OPM{{"opm release"}} --> SHA["sha256 verify"]
  CI --> WEB[/"apps/web/Containerfile"/] --> PNPM["pnpm pinned"]
  subgraph Legend
    direction LR
    _ci(["Build runner"]) ~~~ _file[/"File"/] ~~~ _step["Process"] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Split into two PRs (security hardening vs dependency bumps)

• ➕ Much smaller review surface for the opm checksum change
• ➕ Simpler rollback if upgraded deps introduce regressions
• ➖ Requires coordinating merges across PRs
• ➖ May temporarily leave deps out of sync between branches

2. Adopt Renovate/Dependabot-style automated dependency PRs

• ➕ Regular, smaller dependency updates reduce upgrade risk
• ➕ Better traceability of which dependency caused a regression
• ➖ Initial setup/maintenance overhead
• ➖ Can generate noisy PR volume without good grouping rules

3. Install opm from a packaged source (if available) instead of curl

• ➕ Avoids manual checksum management
• ➕ Leverages distro/package-signing trust chain
• ➖ May not provide the desired opm version across all build environments
• ➖ Less control over pinning to a specific upstream release

Recommendation: Keep the checksum verification approach for opm (it materially improves supply-chain integrity). If possible, consider separating the broad dependency refresh into a dedicated PR (or follow-up) to make regressions easier to isolate; otherwise ensure CI covers runtime compatibility for the Python 3.12 minimum and the upgraded frontend stack.

Files changed (12) +3845 / -3398

Enhancement (1) +6 / -1

ContainerfilePin opm version and verify downloaded binary checksum +6/-1

Pin opm version and verify downloaded binary checksum

• Adds build args for the opm version and expected SHA256, downloads the opm binary from the versioned release URL, and validates it with sha256sum before marking it executable.

apps/worker/Containerfile

Bug fix (1) +1 / -2

UsageLineChart.tsxHarden date sorting by normalizing to string +1/-2

Harden date sorting by normalizing to string

• Changes date casting in the chart sort comparator to use String(...) to avoid type issues with updated dependencies and ensure consistent Date parsing.

apps/web/src/components/UsageLineChart.tsx

Other (10) +3838 / -3395

poetry.lockRegenerate API Poetry lockfile with updated dependency resolution +844/-558

Regenerate API Poetry lockfile with updated dependency resolution

• Updates the lockfile format/version (Poetry 2.3.3) and refreshes resolved package versions and hashes for the API app.

apps/api/poetry.lock

pyproject.tomlBump API runtime/tooling versions and set Python >=3.12 +8/-11

Bump API runtime/tooling versions and set Python >=3.12

• Raises the API minimum Python version to 3.12 and bumps key runtime/dev dependencies (FastAPI, Uvicorn, numpy, ruff/pytest/mypy, pytest-cov). Removes the previously defined Poetry script entry for running tests via tox.

apps/api/pyproject.toml

tox.iniAllowlist external tools in API tox env +5/-0

Allowlist external tools in API tox env

• Adds tox allowlist_externals entries for poetry/pytest/ruff/mypy so tox can execute these commands under stricter settings.

apps/api/tox.ini

ContainerfileUpdate pinned pnpm version used in web image build +1/-1

Update pinned pnpm version used in web image build

• Bumps the globally installed pnpm version in the web builder container stage.

apps/web/Containerfile

package.jsonRefresh web dependencies and devDependencies +35/-35

Refresh web dependencies and devDependencies

• Updates versions for Radix UI, TanStack router/query tooling, React ecosystem libraries, and build/lint toolchain packages (Vite, ESLint, Tailwind/PostCSS, TypeScript ESLint).

apps/web/package.json

poetry.lockRegenerate worker Poetry lockfile with updated dependency resolution +1016/-694

Regenerate worker Poetry lockfile with updated dependency resolution

• Updates the lockfile format/version (Poetry 2.3.3) and refreshes resolved package versions and hashes for the worker app.

apps/worker/poetry.lock

pyproject.tomlSet worker Python >=3.12 and bump dev tooling versions +5/-5

Set worker Python >=3.12 and bump dev tooling versions

• Raises the worker minimum Python version to 3.12 and bumps dev tooling dependencies (ruff/pytest/mypy, pytest-cov).

apps/worker/pyproject.toml

tox.iniAllowlist external tools in worker tox env +5/-0

Allowlist external tools in worker tox env

• Adds tox allowlist_externals entries for poetry/pytest/ruff/mypy so tox can execute these commands under stricter settings.

apps/worker/tox.ini

package.jsonUpdate monorepo tool versions (pnpm, turbo) +14/-15

Update monorepo tool versions (pnpm, turbo)

• Bumps the pinned pnpm version and upgrades turbo; also normalizes JSON formatting/indentation.

package.json

pnpm-lock.yamlRegenerate pnpm lockfile for updated JS toolchain +1905/-2076

Regenerate pnpm lockfile for updated JS toolchain

• Updates resolved versions across the workspace to match the bumped pnpm/turbo and web dependency updates.

pnpm-lock.yaml

[qodo-redhat-openshift-ecosystem]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. CI Python version unpinned ⊘ Outdated 🐞 Bug ☼ Reliability

Description

The PR raises requires-python to ">=3.12" (api and worker), but the GitHub Actions workflow runs
poetry install without explicitly setting up/selecting a Python version, so CI can become
non-deterministic and may fail on runners whose default Python is <3.12.

Code

apps/api/pyproject.toml[10]

+requires-python = ">=3.12"

Relevance

●●● Strong

Team has precedent tightening CI determinism/supply-chain pinning; pinning Python for Poetry
installs is a straightforward reliability fix.

PR-#18

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both Python projects now declare requires-python = ">=3.12", while the CI workflow installs Poetry
and runs poetry install for each app without any explicit Python toolchain setup, making CI
dependent on the runner’s default Python interpreter.

apps/api/pyproject.toml[8-12]
apps/worker/pyproject.toml[9-13]
.github/workflows/ci-cd.yaml[12-44]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
This PR increases the minimum supported Python version for the api and worker projects to 3.12+, but the CI workflow does not explicitly set a Python version before installing/running Poetry. Poetry evaluates the project’s Python constraints against the interpreter used to run Poetry, so the workflow is dependent on whatever Python happens to be default on the runner.

### Issue Context
- Both apps now require Python >=3.12.
- CI installs Poetry and runs `poetry install` for both apps without an explicit `actions/setup-python` step.

### Fix Focus Areas
- Add `actions/setup-python` (e.g., `python-version: '3.12'`) before installing Poetry and before any `poetry install` steps in the workflow.
- Ensure the same pinned Python version is used consistently for both `apps/api` and `apps/worker` steps.

#### Code locations
- .github/workflows/ci-cd.yaml[12-45]
- apps/api/pyproject.toml[8-12]
- apps/worker/pyproject.toml[9-13]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[JakubDurkac]

Deployed changes into pullsar-stage namespace on stage OCP cluster (uses the same clusters as operator-pipelines). Seems to be running fine. Ran the worker manually. For new OPM version I had to set default policy.json and changed the way registry authfile is pointed to. Seems to work fine now, you can check the latest logs of component pullsar-worker-redhat-marketplace-index to see the successful worker run.

You can also check the UI if you want:

1. oc login --token= --server=
2. oc project pullsar-stage
3. oc port-forward service/web 8080:8080-tcp
4. UI is running at localhost:8080

cc @mantomas

[mantomas]

LGTM