ci: add regenerate-artifacts composite action and fix release branch workflow

.github/actions/regenerate-artifacts/action.yml

@@ -0,0 +1,28 @@
+name: Regenerate distribution artifacts
+description: Run the build scripts that regenerate config, lockfiles, Containerfile, and verify secrets
+
+inputs:
+  ogx-version:
+    description: 'OGX version to set (overrides OGX_VERSION from build.env)'
+    required: false
+    default: ''
+  working-directory:
+    description: 'Working directory for running build scripts'
+    required: false
+    default: '.'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Regenerate distribution artifacts
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        OGX_VERSION_OVERRIDE: ${{ inputs.ogx-version }}
+      run: |
+        if [ -n "$OGX_VERSION_OVERRIDE" ]; then
+          export OGX_VERSION="$OGX_VERSION_OVERRIDE"
+        fi
+        uv run build/gen_config.py
+        uv run build/gen_lockfile.py
+        uv run build/gen_containerfile.py

.github/workflows/create-or-update-release-branch.yml

@@ -84,24 +84,18 @@ jobs:
           fi
           echo "Updated OGX_VERSION to ${TAG}"
 
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
-          python-version: '3.11'
-          cache: pip
-          cache-dependency-path: |
-            **/requirements*.txt
-            .pre-commit-config.yaml
-
-      # Two-pass approach: the first run lets hooks autofix files (e.g., regenerating
-      # distribution/ artifacts). The second run verifies everything is clean.
-      - name: Run pre-commit (auto-fix pass)
-        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
-        continue-on-error: true
-        env:
-          SKIP: no-commit-to-branch
+          python-version: 3.12
+          enable-cache: false
+
+      - name: Regenerate distribution artifacts
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.TAG }}
 
-      - name: Run pre-commit (verification pass)
+      - name: Run pre-commit
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         env:
           SKIP: no-commit-to-branch
@@ -127,6 +121,7 @@ jobs:
         id: commit
         run: |
           git add build/build.env Containerfile \
+            distribution/config.yaml \
             distribution/requirements-lock.txt distribution/requirements-lock-konflux.txt \
             distribution/README.md
           if git diff --cached --quiet; then

.github/workflows/redhat-distro-container.yml

@@ -116,13 +116,9 @@ jobs:
 
       - name: Regenerate distribution artifacts from an arbitrary ogx commit (workflow_dispatch/schedule)
         if: contains(fromJSON('["workflow_dispatch", "schedule"]'), github.event_name)
-        env:
-          OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: |
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.OGX_COMMIT_SHA }}
 
       - name: Build image for testing (${{ matrix.arch }})
         id: build
@@ -393,13 +389,9 @@ jobs:
 
       - name: Regenerate distribution artifacts from an arbitrary ogx commit (workflow_dispatch)
         if: github.event_name == 'workflow_dispatch'
-        env:
-          OGX_VERSION: ${{ env.OGX_COMMIT_SHA }}
-        run: |
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
+        uses: ./.github/actions/regenerate-artifacts
+        with:
+          ogx-version: ${{ env.OGX_COMMIT_SHA }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

.github/workflows/test-pr-in-showroom.yml

@@ -88,6 +88,11 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
+      - name: Regenerate distribution artifacts
+        uses: ./ogx-distribution/.github/actions/regenerate-artifacts
+        with:
+          working-directory: ogx-distribution
+
       - name: Build image
         id: build
         working-directory: ogx-distribution
@@ -112,11 +117,6 @@ jobs:
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image: ogx-test:$TAG"
-
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
       - name: Save image as artifact

.github/workflows/test-upstream-in-showroom.yml

@@ -34,21 +34,20 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
+      - name: Regenerate distribution artifacts
+        uses: ./ogx-distribution/.github/actions/regenerate-artifacts
+        with:
+          ogx-version: main
+          working-directory: ogx-distribution
+
       - name: Build image
         id: build
         working-directory: ogx-distribution
-        env:
-          OGX_VERSION: main
         run: |
           SHORT_SHA="${GITHUB_SHA:0:12}"
           TAG="upstream-main-${SHORT_SHA}"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building image with OGX_VERSION=main: ogx-test:$TAG"
-
-          uv run build/gen_config.py
-          uv run build/gen_lockfile.py
-          uv run build/gen_containerfile.py
-          uv run build/verify_secrets.py
           podman build -f Containerfile -t "ogx-test:$TAG" .
 
       - name: Setup CI environment

README.md

@@ -32,11 +32,11 @@ To regenerate lock files (requires Linux, or use the container wrapper on macOS)
 ```
 
 > [!WARNING]
-> Do not edit `distribution/config.yaml`, `distribution/requirements.txt`, or `distribution/README.md` manually — they are regenerated on every commit.
+> Do not edit `distribution/config.yaml`, `Containerfile`, or `distribution/README.md` manually — they are regenerated by pre-commit hooks. Lock files (`distribution/requirements-lock*.txt`) are regenerated in CI or via `./build/run_gen_lockfile.sh`.
 
 ### Editing the Containerfile
 
-The `Containerfile` at the repo root is hand-edited. Modify it directly.
+Edit `Containerfile.in` (the template at the repo root). The `Containerfile` is auto-generated from it by `build/gen_containerfile.py`.
 
 ## Run Instructions