chore(port): Port release scripts and renovate config to release

[mtodor]

Description

This PR ports scripts added to help with release and renovate configuration to release branch.

Validation

• CI pipeline only

[github-actions]

E2E Test Results

Commit: 275d461
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ list-clusters (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ~ cve-clusters-general (assertions: 2/3)
      - MaxToolCalls: Too many tool calls: expected <= 5, got 6

Tasks:      11/11 passed (100.00%)
Assertions: 31/32 passed (96.88%)
Tokens:     ~58312 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  15508 tokens
  Output: 22836 tokens
Judge used tokens:
  Input:  20330 tokens
  Output: 18562 tokens

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 96 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 96 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated Go module dependency update schedule from daily to weekly on Mondays
  • Modified Renovate configuration with adjusted update schedules for various dependency types and enabled auto-merge functionality
  • Added release automation scripts and templates for streamlined deployment processes

Walkthrough

Changes

Automation schedules

Layer / File(s)	Summary
Dependency update schedules .github/dependabot.yml, .github/renovate.json5	Dependabot now updates Go modules weekly on Mondays. Renovate uses updated fallback timing, manager-specific schedules, and automatic merging for Dockerfile, RPM lockfile, and Tekton updates.

Y-stream release automation

Layer / File(s)	Summary
Release resource templates scripts/templates/*	Adds Kustomize, staging and production ReleasePlanAdmission, and Release templates with release metadata, image tags, repository revisions, and release-note fields.
Y-stream release setup scripts/start-y-stream-release.sh	Adds validation, branch preparation, Tekton updates, Konflux configuration generation, Kustomize validation, and conditional commits.
Release preparation scripts/prepare-release.sh	Adds release-branch verification, patch-version discovery, chart metadata updates, and staging and production resource generation.

Estimated code review effort: 4 (Complex) | ~60 minutes

Suggested reviewers: janisz

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant start-y-stream-release.sh
  participant stackrox-mcp
  participant Konflux
  participant Kustomize
  Operator->>start-y-stream-release.sh: Supply version and Konflux repository
  start-y-stream-release.sh->>stackrox-mcp: Update release branch and Tekton configuration
  start-y-stream-release.sh->>Konflux: Generate release resources
  start-y-stream-release.sh->>Kustomize: Validate generated configuration
  start-y-stream-release.sh->>stackrox-mcp: Commit repository changes
  start-y-stream-release.sh->>Konflux: Commit release configuration

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the porting of release scripts and Renovate configuration to the release branch.
Description check	✅ Passed	The description accurately states that the pull request ports release scripts and Renovate configuration to the release branch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mtodor/port-release-script-and-renovate-config

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/prepare-release.sh`:
- Line 147: Update the RELEASE_AUTHOR assignment in the release preparation flow
to avoid directly expanding unset USER under set -u. Provide a safe fallback,
preferably deriving the author from the configured git identity, while
preserving the existing export behavior.

In `@scripts/start-y-stream-release.sh`:
- Around line 117-138: Update update_tekton_pipelines to discover all relevant
acs-mcp-server Tekton YAML files under tekton_dir using a glob instead of the
hardcoded files array. Preserve the existing per-file yq updates and
missing-file handling while ensuring newly added component pipeline files are
included automatically.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: fc4a7a8e-29b0-4e3d-afb4-8c68eba599a6

📥 Commits

Reviewing files that changed from the base of the PR and between 14f84a8 and 275d461.

📒 Files selected for processing (8)

• .github/dependabot.yml
• .github/renovate.json5
• scripts/prepare-release.sh
• scripts/start-y-stream-release.sh
• scripts/templates/release-kustomization.yaml
• scripts/templates/release-plan-admission-prod.yaml
• scripts/templates/release-plan-admission-stage.yaml
• scripts/templates/release-resource.yaml