Keep main updated with commits on master

.fullsend/config.yaml

@@ -0,0 +1,13 @@
+# fullsend per-repo configuration
+# https://github.com/fullsend-ai/fullsend
+#
+# This file configures fullsend for per-repo installation mode.
+# See ADR 0033 for details.
+version: "1"
+roles:
+    - triage
+    - coder
+    - review
+    - fix
+    - retro
+    - prioritize

.github/workflows/fullsend.yaml

@@ -0,0 +1,85 @@
+# fullsend shim workflow (per-repo installation mode)
+# Routes events to agent workflows via reusable-dispatch.yml.
+# All agent execution happens in this repo's context — no external
+# config repo is needed.
+#
+# Security: pull_request_target runs the BASE branch version of this workflow,
+# preventing PRs from modifying it to exfiltrate credentials.
+# This shim never checks out PR code, so it is not vulnerable to "pwn request"
+# attacks.
+#
+# Routing: this shim forwards the raw event context to reusable-dispatch.yml,
+# which determines the stage and conditionally calls the appropriate
+# reusable-{stage}.yml workflow. Adding a new stage requires only a case
+# branch in reusable-dispatch.yml — zero changes to this repo.
+name: fullsend
+
+permissions:
+  actions: write
+  id-token: write
+  contents: write
+  issues: write
+  packages: read
+  pull-requests: write
+
+on:
+  issues:
+    types: [opened, edited, labeled]
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, ready_for_review, closed]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  dispatch:
+    concurrency:
+      group: fullsend-dispatch-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+    if: >-
+      github.event_name != 'issue_comment'
+      || github.event.comment.user.type != 'Bot'
+    uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@v0
+    with:
+      event_action: ${{ github.event.action }}
+      install_mode: per-repo
+      mint_url: ${{ vars.FULLSEND_MINT_URL }}
+      gcp_region: ${{ vars.FULLSEND_GCP_REGION }}
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+
+  stop-fix:
+    if: >-
+      github.event_name == 'issue_comment'
+        && github.event.issue.pull_request
+        && github.event.comment.user.type != 'Bot'
+        && github.event.comment.body == '/fs-fix-stop'
+        && (
+          github.event.comment.author_association == 'OWNER'
+          || github.event.comment.author_association == 'MEMBER'
+          || github.event.comment.author_association == 'COLLABORATOR'
+          || github.event.comment.author_association == 'CONTRIBUTOR'
+          || github.event.comment.user.login == github.event.issue.user.login
+        )
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Add fullsend-no-fix label and notify
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          gh label create "fullsend-no-fix" --repo "$REPO" \
+            --description "Skip bot-triggered fix agent runs" --color "FBCA04" \
+            --force 2>/dev/null || true
+          gh pr edit "$PR_NUMBER" --repo "$REPO" \
+            --add-label "fullsend-no-fix"
+          gh pr comment "$PR_NUMBER" --repo "$REPO" \
+            --body "Fix agent disabled for this PR. Remove the \`fullsend-no-fix\` label or use \`/fs-fix\` to re-engage."

.python-version

@@ -1 +1 @@
-3.14.0
+3.14.5

CHANGELOG.md

@@ -6,6 +6,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## 9.5.2
+
+* Update dependency urllib3 to v2.7.0 [SECURITY] by @renovate[bot] in https://github.com/release-engineering/iib/pull/1324
+* Update dependency mako to v1.3.12 [SECURITY] by @renovate[bot] in https://github.com/release-engineering/iib/pull/1323
+* Update dependency python-qpid-proton to v0.40.0 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1318
+* Update python Docker tag to v3.14.5 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1271
+* Update dependency coverage to v7.14.0 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1326
+* Update dependency googleapis-common-protos to v1.75.0 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1327
+* Update dependency requests to v2.34.1 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1329
+* Update dependency idna to v3.15 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1328
+
+## 9.5.1
+
+* Check for user in iib_no_ocp_label_allow_list by @MichalZelenak in https://github.com/release-engineering/iib/pull/1304
+* Update requirements by @lipoja in https://github.com/release-engineering/iib/pull/1314
+* CLOUDDST-32368 : Fix FBC remove by only passing  DB-backed packages to opm registry rm by @ashwgit in https://github.com/release-engineering/iib/pull/1312
+
 ## 9.5.0
 
 * chore(deps): update dependency google-auth to v2.43.0 by @renovate[bot] in https://github.com/release-engineering/iib/pull/1229

iib/workers/tasks/build.py

@@ -1166,7 +1166,7 @@ def handle_rm_request(
                 fbc_dir, _ = opm_registry_rm_fbc(
                     base_dir=temp_dir,
                     from_index=from_index_resolved,
-                    operators=operators,
+                    operators=operators_in_db,
                     index_db_path=index_db_path,
                 )