feat: add update-base-image skill

[josephca]

fixes https://redhat.atlassian.net/browse/RHIDP-12154

Assisted-by: Cursor

[durandom]

---

[durandom]

---

[durandom]

Review (updated)

What does this PR do?

New skill for analyzing and updating UBI/RHEC base images in Containerfiles (rhdh + rhdh-operator). The core is a Bash script (analyze-base-images.sh) that scans FROM lines, queries registry tags, and detects UBI version skew. The actual update is delegated to the existing updateBaseImages.sh from rhidp/rhdh. The SKILL.md is thorough and well-structured.

Feedback

Version conflict with PR #38: Both PRs bump from 0.3.1 — #38 to 0.3.2, #39 to 0.4.0. Whoever merges second will need a rebase. Please coordinate merge order.

License mismatch: The script has SPDX-License-Identifier: EPL-2.0, but the repo is Apache-2.0 (pyproject.toml). Should be aligned.

Repo references duplicated: The SKILL.md lists rhdh and rhdh-operator with paths inline. skills/rhdh/references/rhdh-repos.md already has this info centrally — a cross-reference would avoid duplication and keep data consistent.

No tests: Other skills have pytest coverage. For a Bash script that's harder, but at least a smoke test (e.g. --help exit code, invalid flags) would be worthwhile.

Consider a broader rhdh-maintenance or release-prep skill: This skill does one specific thing — scan pinned image references, compare against latest, update, create PR. That's the same pattern as konflux-tekton-updates (Tekton task digests) and potentially future dependency-bump workflows. If you already have similar maintenance/update skills in the pipeline, it might be worth creating a shared rhdh-maintenance or release-prep skill now and housing this as a workflow inside it, rather than accumulating standalone single-workflow skills that will need consolidation later. The skill-maker skill could help scaffold that structure quickly.

If this is truly the only such workflow for now, standalone is fine — but worth keeping in mind for the next one.

Positives

• SKILL.md is thorough: setup gates as a table, gotchas section, clear agent workflow steps
• Clean disable-model-invocation: true usage for a procedural skill
• UBI mismatch warning is a useful feature
• Version bump to 0.4.0 (minor) is correct for a new skill

🤖 Generated with Claude Code

[josephca]

Review (updated)

What does this PR do?

New skill for analyzing and updating UBI/RHEC base images in Containerfiles (rhdh + rhdh-operator). The core is a Bash script (analyze-base-images.sh) that scans FROM lines, queries registry tags, and detects UBI version skew. The actual update is delegated to the existing updateBaseImages.sh from rhidp/rhdh. The SKILL.md is thorough and well-structured.

Feedback

Version conflict with PR #38: Both PRs bump from 0.3.1 — #38 to 0.3.2, #39 to 0.4.0. Whoever merges second will need a rebase. Please coordinate merge order.

License mismatch: The script has SPDX-License-Identifier: EPL-2.0, but the repo is Apache-2.0 (pyproject.toml). Should be aligned.

Repo references duplicated: The SKILL.md lists rhdh and rhdh-operator with paths inline. skills/rhdh/references/rhdh-repos.md already has this info centrally — a cross-reference would avoid duplication and keep data consistent.

No tests: Other skills have pytest coverage. For a Bash script that's harder, but at least a smoke test (e.g. --help exit code, invalid flags) would be worthwhile.

Consider a broader rhdh-maintenance or release-prep skill: This skill does one specific thing — scan pinned image references, compare against latest, update, create PR. That's the same pattern as konflux-tekton-updates (Tekton task digests) and potentially future dependency-bump workflows. If you already have similar maintenance/update skills in the pipeline, it might be worth creating a shared rhdh-maintenance or release-prep skill now and housing this as a workflow inside it, rather than accumulating standalone single-workflow skills that will need consolidation later. The skill-maker skill could help scaffold that structure quickly.

If this is truly the only such workflow for now, standalone is fine — but worth keeping in mind for the next one.

Positives

• SKILL.md is thorough: setup gates as a table, gotchas section, clear agent workflow steps
• Clean disable-model-invocation: true usage for a procedural skill
• UBI mismatch warning is a useful feature
• Version bump to 0.4.0 (minor) is correct for a new skill

🤖 Generated with Claude Code

Updated the code to address the review suggestions.

[durandom]

Looks good — all prior review items addressed (license, tests, repo ref dedup, version conflict resolved after #38 merge).

One minor nit: usage() in analyze-base-images.sh calls exit 1, so --help returns a failure code. Convention is exit 0 for help requests. Can be fixed in a follow-up.