ci: add regenerate-artifacts composite action and fix release branch workflow

.github/actions/regenerate-artifacts/action.yml

@@ -0,0 +1,28 @@
+name: Regenerate distribution artifacts
+description: Run the build scripts that regenerate config, lockfiles, Containerfile, and verify secrets
+
+inputs:
+  ogx-version:
+    description: 'OGX version to set (overrides OGX_VERSION from build.env)'
+    required: false
+    default: ''
+  working-directory:
+    description: 'Working directory for running build scripts'
+    required: false
+    default: '.'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Regenerate distribution artifacts
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        OGX_VERSION_OVERRIDE: ${{ inputs.ogx-version }}
+      run: |
+        if [ -n "$OGX_VERSION_OVERRIDE" ]; then
+          export OGX_VERSION="$OGX_VERSION_OVERRIDE"
+        fi
+        uv run build/gen_config.py
+        uv run build/gen_lockfile.py
+        uv run build/gen_containerfile.py

.github/workflows/create-or-update-release-branch.yml

@@ -84,24 +84,18 @@ jobs:
           fi
           echo "Updated OGX_VERSION to ${TAG}"
 
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          python-version: '3.11'
-          cache: pip
-          cache-dependency-path: |
-            **/requirements*.txt
-            .pre-commit-config.yaml
-
-      # Two-pass approach: the first run lets hooks autofix files (e.g., regenerating
-      # distribution/ artifacts). The second run verifies everything is clean.
-      - name: Run pre-commit (auto-fix pass)
-        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-        continue-on-error: true
-        env:
-          SKIP: no-commit-to-branch
+          python-version: 3.12
+          enable-cache: false
+
+      - name: Regenerate distribution artifacts
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.TAG }}
 
-      - name: Run pre-commit (verification pass)
+      - name: Run pre-commit
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         env:
           SKIP: no-commit-to-branch
@@ -127,6 +121,7 @@ jobs:
         id: commit
         run: |
           git add build/build.env Containerfile \
+            distribution/config.yaml \
             distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt \
             distribution/README.md
           if git diff --cached --quiet; then

.github/workflows/redhat-distro-container.yml

@@ -116,13 +116,9 @@ jobs:
 
       - name: Regenerate distribution artifacts from an arbitrary ogx commit (workflow_dispatch/schedule)
         if: contains(fromJSON('["workflow_dispatch", "schedule"]'), github.event_name)
-        env:
-          OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: |
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.OGX_COMMIT_SHA }}
 
       - name: Build image for testing (${{ matrix.arch }})
         id: build
@@ -393,13 +389,9 @@ jobs:
 
       - name: Regenerate distribution artifacts from an arbitrary ogx commit (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch'
-        env:
-          OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: |
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.OGX_COMMIT_SHA }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

.github/workflows/test-pr-in-showroom.yml

@@ -19,14 +19,15 @@ on:
         type: string
 
 jobs:
-  build-and-test:
+  build:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    concurrency:
-      group: openshift-cluster-1
-      cancel-in-progress: false
+    timeout-minutes: 15
     permissions:
       contents: read
+      pull-requests: read
+    outputs:
+      tag: ${{ steps.build.outputs.tag }}
+      sha: ${{ steps.pr-info.outputs.sha }}
 
     steps:
       - name: Get PR information
@@ -64,21 +65,20 @@ jobs:
         with:
           repository: ${{ steps.pr-info.outputs.repo }}
           ref: ${{ steps.pr-info.outputs.sha }}
-          path: ogx-distribution
           persist-credentials: false
 
       - name: Checkout pushed code
         if: inputs.pr_number == ''
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          path: ogx-distribution
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
+      - name: Regenerate distribution artifacts
+        uses: ./.github/actions/regenerate-artifacts
+
       - name: Build image
         id: build
-        working-directory: ogx-distribution
         env:
           PR_NUMBER: ${{ inputs.pr_number }}
           PR_SHA: ${{ steps.pr-info.outputs.sha }}
@@ -100,19 +100,53 @@ jobs:
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image: ogx-test:$TAG"
-
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
+      - name: Save image as artifact
+        env:
+          TAG: ${{ steps.build.outputs.tag }}
+        run: |
+          podman save "ogx-test:$TAG" | zstd -T0 -o ogx-test-image.tar.zst
+
+      - name: Upload image artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: ogx-test-image
+          path: ogx-test-image.tar.zst
+          retention-days: 1
+
+  test:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: openshift-cluster-1
+      cancel-in-progress: false
+    permissions:
+      contents: read
+    env:
+      REGISTRY_IMAGE: "image-registry.openshift-image-registry.svc:5000/redhat-ods-operator/ogx-test:${{ needs.build.outputs.tag }}"
+
+    steps:
+      - name: Download image artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: ogx-test-image
+
+      - name: Load image
+        env:
+          TAG: ${{ needs.build.outputs.tag }}
+        run: |
+          zstd -d ogx-test-image.tar.zst --stdout | podman load
+          rm ogx-test-image.tar.zst
+          podman image exists "ogx-test:$TAG"
+
       - name: Setup CI environment
         id: setup
         uses: derekhiggins/llama-stack-showroom@f32973c9b7389b14d1988b55abfe74dd98c2432f  # main as of 2026-06-05
         with:
           catalog_image: ${{ inputs.catalog_image }}
-          llama_stack_image: "image-registry.openshift-image-registry.svc:5000/redhat-ods-operator/ogx-test:${{ steps.build.outputs.tag }}"
+          llama_stack_image: ${{ env.REGISTRY_IMAGE }}
           operator_image: ${{ inputs.operator_image }}
           oc_server: ${{ secrets.OC_SERVER }}
           oc_token: ${{ secrets.OC_TOKEN }}
@@ -125,18 +159,13 @@ jobs:
             SHOWROOM_OPENAI_API_KEY=${{ secrets.SHOWROOM_OPENAI_API_KEY }}
 
       - name: Push image to OpenShift registry
-        id: push
+        env:
+          TAG: ${{ needs.build.outputs.tag }}
         run: |
-          # Push image to registry
           "${{ steps.setup.outputs.scripts_dir }}/push-image-to-registry.sh" \
-            ogx-test:${{ steps.build.outputs.tag }} \
+            "ogx-test:$TAG" \
             redhat-ods-operator \
-            ogx-test:${{ steps.build.outputs.tag }}
-
-          # Construct pull URL for cluster-internal access
-          PULL_IMAGE="image-registry.openshift-image-registry.svc:5000/redhat-ods-operator/ogx-test:${{ steps.build.outputs.tag }}"
-
-          echo "pull_image=${PULL_IMAGE}" >> "$GITHUB_OUTPUT"
+            "ogx-test:$TAG"
 
       - name: Run setup.sh
         run: |
@@ -181,9 +210,9 @@ jobs:
         if: always()
         env:
           PR_NUMBER: ${{ inputs.pr_number }}
-          PR_SHA: ${{ steps.pr-info.outputs.sha }}
+          PR_SHA: ${{ needs.build.outputs.sha }}
           PUSH_SHA: ${{ github.sha }}
-          IMAGE_TAG: ${{ steps.build.outputs.tag }}
+          IMAGE_TAG: ${{ needs.build.outputs.tag }}
           JOB_STATUS: ${{ job.status }}
         run: |
           {

.github/workflows/test-upstream-in-showroom.yml

@@ -34,21 +34,20 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
+      - name: Regenerate distribution artifacts
+        uses: ./ogx-distribution/.github/actions/regenerate-artifacts
+        with:
+          ogx-version: main
+          working-directory: ogx-distribution
+
       - name: Build image
         id: build
         working-directory: ogx-distribution
-        env:
-          OGX_VERSION: main
         run: |
           SHORT_SHA="${GITHUB_SHA:0:12}"
           TAG="upstream-main-${SHORT_SHA}"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image with OGX_VERSION=main: ogx-test:$TAG"
-
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
       - name: Setup CI environment

README.md

@@ -32,11 +32,11 @@ To regenerate lock files (requires Linux, or use the container wrapper on macOS)
 ```
 
 > [!WARNING]
-> Do not edit `distribution/config.yaml`, `distribution/requirements.txt`, or `distribution/README.md` manually — they are regenerated on every commit.
+> Do not edit `distribution/config.yaml`, `Containerfile`, or `distribution/README.md` manually — they are regenerated by pre-commit hooks. Lock files (`distribution/requirements-lock*.txt`) are regenerated in CI or via `./build/run_gen_lockfile.sh`.
 
 ### Editing the Containerfile
 
-The `Containerfile` at the repo root is hand-edited. Modify it directly.
+Edit `Containerfile.in` (the template at the repo root). The `Containerfile` is auto-generated from it by `build/gen_containerfile.py`.
 
 ## Run Instructions