ci: add regenerate-artifacts composite action and fix release branch workflow

[eoinfennessy]

Summary

Addresses review comments from #499:

• Composite action (.github/actions/regenerate-artifacts/): Extracts the duplicated uv run build/gen_*.py sequence into a reusable composite action, replacing inline commands across 4 workflow locations (redhat-distro-container.yml x2, test-pr-in-showroom.yml, test-upstream-in-showroom.yml)
• Release branch workflow: Switches from setup-python 3.11 to setup-uv 3.12 (pre-commit hooks need uv), adds a regenerate-artifacts step so lockfiles are regenerated before commit, adds distribution/config.yaml to the git add list, and simplifies pre-commit to a single pass
• README: Fixes stale references — distribution/requirements.txt → lockfiles, Containerfile hand-edited → edit Containerfile.in

Test plan

• pre-commit run --all-files passes (includes actionlint for workflow validation)
• CI build/test workflow passes on Linux runners
• Verify release branch workflow works with setup-uv + composite action

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added a reusable automation step for regenerating distribution artifacts with optional version and working-directory settings.
  • Standardized artifact regeneration across release, container, and image-build workflows.

• Documentation

  • Updated build guidance to clarify which distribution files are generated automatically.
  • Clarified that container changes should be made in Containerfile.in.

[coderabbitai]

📝 Walkthrough

Walkthrough

A reusable composite action now regenerates configuration, lockfile, and Containerfile artifacts with optional version and working-directory overrides. Release, Red Hat container, and showroom workflows use the action instead of duplicating generation commands. Release commits now include distribution/config.yaml. README guidance now identifies generated files and directs Containerfile edits to Containerfile.in.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 8 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Contribution Quality And Spam Detection	⚠️ Warning	PR body is a rigid Claude-generated template, and the new composite action omits verify_secrets.py despite claiming secret verification (CWE-693).	Restore verify_secrets.py or correct the action docs, and rewrite the PR body in plain repo-specific language with concrete tests/threat model.
No Injection Vectors	⚠️ Warning	.github/workflows/test-pr-in-showroom.yml runs a local composite action from the PR checkout in a secrets-bearing job; untrusted code execution (CWE-829).	Use a trusted action from the base branch or isolate PR checkout from any job with secrets; do not uses: paths under untrusted PR code.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Hardcoded Secrets	✅ Passed	Scanned all added lines in e9ee853/830fa976/5953b03b; no literal API keys, tokens, passwords, private keys, base64 blobs, or embedded URL creds found.
No Weak Cryptography	✅ Passed	Touched files are YAML/docs only; scans found no banned primitives or secret comparisons, and line review shows only workflow orchestration.
No Privileged Containers	✅ Passed	No changed manifest/Dockerfile sets privileged=true, hostPID/Network/IPC, allowPrivilegeEscalation, SYS_ADMIN, or USER root; no CWE-250 issue.
No Sensitive Data In Logs	✅ Passed	Only README prose changed in the actual diff; no new logging statements or raw secret/body dumps, so no CWE-532 exposure.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	It accurately reflects the new composite action and the release-branch workflow changes in this CI/CD supply-chain surface.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/regenerate-artifacts/action.yml:
- Around line 26-28: Restore execution of build/verify_secrets.py in the
artifact regeneration command sequence in the composite action, alongside
gen_config.py, gen_lockfile.py, and gen_containerfile.py, so secret
synchronization is validated during regeneration.

In @.github/workflows/test-pr-in-showroom.yml:
- Around line 79-83: Update the “Regenerate distribution artifacts” step so it
does not execute the composite action or scripts from the PR checkout. Invoke a
trusted action definition from the base repository, or isolate this regeneration
in an unprivileged workflow without access to OC_TOKEN or
SHOWROOM_VLLM_API_TOKEN, while preserving the required artifact-generation
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d1d5bfeb-4e10-4be4-a643-57bdff7a8c27

📥 Commits

Reviewing files that changed from the base of the PR and between 3580a95 and 5953b03.

📒 Files selected for processing (6)

• .github/actions/regenerate-artifacts/action.yml
• .github/workflows/create-or-update-release-branch.yml
• .github/workflows/redhat-distro-container.yml
• .github/workflows/test-pr-in-showroom.yml
• .github/workflows/test-upstream-in-showroom.yml
• README.md

[skamenan7]

LGTM.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[rhods-ci-bot]

@eoinfennessy: The following test has Succeeded:

OCI Artifact Browser URL

View in Artifact Browser

Inspecting Test Artifacts Manually

To inspect your test artifacts manually, follow these steps:

1. Install ORAS (see the ORAS installation guide).
2. Download artifacts with the following commands:

mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/opendatahub/odh-ci-artifacts:ogx-core-functional-its-xncv5