Update OWNERS for /charts/partners/atiwary-containers/sfsf

.github/actions/check-chart-locks/action.yml

@@ -0,0 +1,63 @@
+name: Check For Lock
+description: |
+  Checks for the existence of chart-name in a given chart lock file. If a chart
+  is found to be locked at the URL searched, the lockpath is returned should the
+  caller need it for further evaluation.
+
+  Designed to work with OWNERS file merges to prevent chart naming conflicts.
+inputs:
+  # e.g. vault
+  chart-name:
+    required: true
+    description:
+      Check the lock status of this chart by name.
+  fail-workflow-if-locked:
+    required: false
+    default: 'false'
+    description: |
+      Forces a failure of this action when the chart is locked. Must explicitly
+      be set to the value 'true'. All other values (even a boolean true) are
+      considered false.
+outputs:
+  # e.g. true/false
+  chart-is-locked:
+    description: Whether the chart provided via the chart-name input is locked
+    value: ${{ steps.set-lock-state.outputs.chart-is-locked }}
+  # e.g. charts/category/vendor/chartname if package-is-locked is true, else null
+  locked-to-path:
+    description: The path to which a locked chart is locked.
+    value: ${{ steps.check-for-chart-lock.outputs.locked-to-path }}
+runs:
+  using: composite
+  steps:
+  - name: Generate Locks
+    id: generate-locks
+    uses: ./.github/actions/generate-chart-locks
+  - name: Check lockfile for chart lock
+    id: check-for-chart-lock
+    shell: bash
+    run: |
+      set -e
+      echo "Ensuring expected key exists in lock JSON."
+      jq --exit-status .packages < ${{ steps.generate-locks.outputs.lockfile-path }}
+
+      echo "Checking if chart '${{ inputs.chart-name }}' is locked."
+      LOCK_PATH=$(jq -r '.packages."${{ inputs.chart-name }}"' < ${{ steps.generate-locks.outputs.lockfile-path }})
+
+      echo "locked-to-path=${LOCK_PATH}" | tee -a $GITHUB_OUTPUT
+
+  # Defaults to a locked state as a safeguard.
+  - name: Set lock state output
+    shell: bash
+    id: set-lock-state
+    run: |
+      echo "chart-is-locked=${{ steps.check-for-chart-lock.outputs.locked-to-path != 'null' }}" | tee -a $GITHUB_OUTPUT
+
+  - name: Fail if requested and the chart is locked
+    shell: bash
+    if: |
+      inputs.fail-workflow-if-locked == 'true' &&
+      steps.set-lock-state.outputs.chart-is-locked == 'true'
+    run: |
+      echo "::error::Workflow is failing at the caller's request."
+      exit -1

.github/actions/generate-chart-locks/action.yaml

@@ -0,0 +1,78 @@
+name: Generate Chart Locks
+description: |
+  Generates chart locks at runtime and places the generated contents on the
+  filesystem.
+
+  For pull_request / pull_request_target events, this will pull down the branch
+  receiving the changes as the source of truth.
+
+  In the production repository, this will always pull the main branch, regardless
+  of which branch is receiving the pull request.
+
+  It is expected that the CI scripts have already been installed at call time.
+inputs:
+  to-file:
+    description: Where to write the chart-locks.json file.
+    default: "/tmp/chart-locks.json"
+    required: false
+  generator-cmd-path:
+    description: |
+      The path to the generate-chart-locks command. This action expects CI
+      scripts to be installed by the caller, and so it stands to reason the
+      caller may install scripts at various locations.
+    default: "../ve1/bin/generate-chart-locks"
+    required: false
+outputs:
+  lockfile-path:
+    description: |
+      Where the lock file was written. Mostly placed as an output to simplify
+      workflows for callers.
+    value: ${{ steps.generate-chart-locks.outputs.lockfile-path }}
+runs:
+  using: composite
+  steps:
+  - name: Resolve repository ref
+    id: resolve
+    shell: bash
+    run: |
+      set -e
+
+      # PRs to the production repository will always use main.
+      if [ "${GITHUB_REPOSITORY}" == "openshift-helm-charts/charts" ]; then
+        echo "Running in the production repository."
+        echo "The only allowed ref is 'refs/heads/main'."
+        echo "ref=refs/heads/main" | tee -a $GITHUB_OUTPUT
+        exit 0
+      fi
+
+      echo "GITHUB_EVENT_NAME = '${GITHUB_EVENT_NAME}'"
+      echo "GITHUB_BASE_REF = '${GITHUB_BASE_REF}'"
+
+      # GITHUB_BASE_REF is set for pull_requests/pull_requests_targets, but empty for
+      # workflow_dispatch. We'll set it to main if it's not set.
+      resolvedRef="refs/heads/${GITHUB_BASE_REF:-"main"}"
+      echo "ref=${resolvedRef}" | tee -a $GITHUB_OUTPUT
+  - name: Checkout
+    id: clone-repository
+    uses: actions/checkout@v4
+    with:
+      ref: ${{ steps.resolve.outputs.ref }}
+      path: temp-gen-chart-lock-repo
+  - name: Setting up python
+    uses: actions/setup-python@v5
+    with:
+      python-version: "3.10"
+  - name: Generate lock file JSON from existing charts
+    working-directory: temp-gen-chart-lock-repo
+    id: generate-chart-locks
+    shell: bash
+    run: |
+      set -eo pipefail
+      ${{ inputs.generator-cmd-path }} | jq | tee ${{ inputs.to-file }}
+      echo "lockfile-path=$(realpath ${{ inputs.to-file }})" | tee -a $GITHUB_OUTPUT
+  - name: Cleanup
+    id: cleanup
+    if: always()
+    shell: bash
+    run: |
+      rm -rf temp-gen-chart-lock-repo

.github/actions/get-ocp-range/action.yaml

@@ -0,0 +1,35 @@
+name: 'Get OCP range'
+description: 'Get the range of OCP versions corresponding to the provided range of Kubernetes versions'
+inputs:
+  kube-version-range:
+    description: 'Range of Kubernetes versions'
+    required: true
+outputs:
+  ocp-version-range:
+    description: "Corresponsing range of OCP versions"
+    value: ${{ steps.run-get-ocp-range.outputs.ocp-version-range }}
+runs:
+  using: "composite"
+  steps:
+    - name: Setup Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '>=1.20'
+
+    - name: Install get-ocp-range
+      shell: bash
+      run: go install github.com/opdev/getocprange/cmd/get-ocp-range@latest
+
+    - name: Run get-ocp-range
+      id: run-get-ocp-range
+      shell: bash
+      run: |
+        echo "::debug::Received kubeVersionRange to translate '${{ inputs.kube-version-range }}'"
+        OCP_VERSION_RANGE=$(get-ocp-range '${{ inputs.kube-version-range }}')
+        echo "ocp-version-range=$OCP_VERSION_RANGE" >> $GITHUB_OUTPUT
+        echo "::debug::Successfully translated kubeVersionRange to OCPVersionRange $OCP_VERSION_RANGE"
+
+    - name: Display error message if get-ocp-range failed
+      if: ${{ failure() && steps.run-get-ocp-range.outcome == 'failure' }}
+      shell: bash
+      run: echo "::error file=.github/actions/get-ocp-range/action.yaml::Error running get-ocp-range"

.github/labeler.yml

@@ -0,0 +1,4 @@
+allow/chart-changes:
+  - any: ['charts/partners/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/redhat/**/**/*', '!charts/partners/**/**/OWNERS']
+  - any: ['charts/community/**/**/*', '!charts/partners/**/**/OWNERS']