fix(ci): temporarily pin catalog index image in CI to 1.10-51 to work around wrong lightspeed OCI refs [RHDHBUGS-3095]

[rm3l]

Description of the change

The latest 1.10 catalog index image contains incorrect OCI references for the lightspeed plugins (pointing to ghcr instead of registry.access.redhat.com).
To unblock PR and Nightly checks in this repo, this PR pins to 1.10-51 (containing the expected refs) in CI workflows until this issue is resolved.

Which issue(s) does this PR fix or relate to

Relates to https://redhat.atlassian.net/browse/RHDHBUGS-3095

How to test changes / Special notes to the reviewer

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Run pre-commit run --all-files to run the hooks and then push any resulting changes. The pre-commit Workflow will enforce this and warn you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0)

Context used

✅ Tickets: 🎫 Lightspeed Plugins Using ghcr instead of registry.access.redhat.com in DPDY

1. Release CI uses wrong index 🐞 Bug ≡ Correctness

Description

The workflows now unconditionally force global.catalogIndex.image.tag=1.10-51 even when running
tests for release branches (nightly matrix includes release-1.8/1.9; PR workflow applies the pin for
non-main bases too). This makes CI for release branches validate a pinned 1.10 catalog index rather
than the branch’s intended catalog index configuration.

Code

.github/workflows/nightly.yaml[R49-50]

+          # TODO([RHDHBUGS-3095](https://redhat.atlassian.net/browse/RHDHBUGS-3095)): Remove the catalogIndex.image.tag pin once the lightspeed plugins OCI refs are fixed in the latest catalog index image.
+          extra_helm_args: '--set upstream.backstage.image.repository=rhdh-community/rhdh --set upstream.backstage.image.tag=${{ steps.image.outputs.tag }} --set upstream.backstage.image.pullPolicy=Always --set global.catalogIndex.image.tag=1.10-51'

Evidence

Nightly tests run for main, release-1.9, and release-1.8, and the same pinned catalog index
tag is passed for all of them. The PR workflow similarly applies the pin for non-main PR base
branches. The repo documentation also shows that catalog index tags are expected to vary by version
(example shows 1.9), so overriding release-branch runs to a fixed 1.10-51 can diverge from what
those branches are meant to exercise.

.github/workflows/nightly.yaml[14-24]
.github/workflows/nightly.yaml[44-50]
.github/workflows/test.yaml[32-38]
docs/catalog-index-configuration.md[5-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
CI now pins `global.catalogIndex.image.tag=1.10-51` for *all* tested branches (including release branches), which overrides the catalog-index version those release branches are intended to validate.

### Issue Context
- Nightly workflow tests multiple branches via a matrix.
- PR workflow runs for PRs targeting `main` and `release-1.y`.
- Catalog index tags are versioned (docs show examples like `1.9`), so forcing a `1.10-*` tag on release branches can make CI non-representative.

### Fix Focus Areas
- .github/workflows/nightly.yaml[14-50]
- .github/workflows/test.yaml[32-38]

### Suggested fix approach
- Apply the `global.catalogIndex.image.tag=1.10-51` override only when testing `main` (and/or only the branch(es) that actually use the floating `1.10` tag).
- For other branches, either omit the override (let the branch’s chart defaults apply) or compute an appropriate branch-aligned pin (if needed) based on the target branch.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Duplicate pin value 🐞 Bug ⚙ Maintainability

Description

The hard-coded tag 1.10-51 is duplicated across both workflows, which increases the chance of
inconsistent updates/removal. A single shared env/variable would reduce drift.

Code

.github/workflows/test.yaml[R37-38]

+          # TODO([RHDHBUGS-3095](https://redhat.atlassian.net/browse/RHDHBUGS-3095)): Remove the catalogIndex.image.tag pin once the lightspeed plugins OCI refs are fixed in the latest catalog index image.
+          extra_helm_args: ${{ github.event.pull_request.base.ref == 'main' && format('--set upstream.backstage.image.repository={0} --set upstream.backstage.image.tag={1} --set global.catalogIndex.image.tag=1.10-51', env.RHDH_IMAGE_REPOSITORY, env.RHDH_IMAGE_TAG) || '--set global.catalogIndex.image.tag=1.10-51' }}

Evidence

Both workflows embed the same pinned tag string directly in extra_helm_args, meaning any future
change/removal must be done in multiple places.

.github/workflows/nightly.yaml[44-50]
.github/workflows/test.yaml[32-38]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The pinned catalog index tag value (`1.10-51`) is repeated in multiple workflow files.

### Issue Context
This pin is explicitly temporary (TODO comment), but while it exists it’s easy for one workflow to be updated and another to be missed.

### Fix Focus Areas
- .github/workflows/nightly.yaml[44-50]
- .github/workflows/test.yaml[32-38]

### Suggested fix approach
- Define a single workflow-level `env:` value (e.g., `CATALOG_INDEX_TAG_PIN: 1.10-51`) and reference it in both workflows, or move the logic into the composite action input defaults if appropriate.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Review Summary by Qodo

Pin catalog index image to 1.10-51 to fix lightspeed OCI refs

🐞 Bug fix

Walkthroughs

Description

• Pin catalog index image to 1.10-51 in CI workflows
• Workaround for incorrect lightspeed plugin OCI references
• Updated nightly and test workflows with pinned version
• Added TODO comments for future removal when upstream issue resolved

Diagram

flowchart LR
  A["CI Workflows"] -->|"Pin catalogIndex.image.tag"| B["1.10-51 Catalog Index"]
  B -->|"Contains correct OCI refs"| C["Lightspeed Plugins"]
  C -->|"Point to registry.access.redhat.com"| D["Unblock PR/Nightly Checks"]

Loading

File Changes

1. .github/workflows/nightly.yaml ⚙️ Configuration changes +2/-1

Pin catalog index image in nightly workflow

• Added --set global.catalogIndex.image.tag=1.10-51 to extra_helm_args
• Added TODO comment referencing [RHDHBUGS-3095](https://redhat.atlassian.net/browse/RHDHBUGS-3095) for future removal
• Pins catalog index image version in nightly workflow

.github/workflows/nightly.yaml

---

2. .github/workflows/test.yaml ⚙️ Configuration changes +2/-1

Pin catalog index image in test workflow

• Added --set global.catalogIndex.image.tag=1.10-51 to extra_helm_args for both main and release
 branches
• Added TODO comment referencing [RHDHBUGS-3095](https://redhat.atlassian.net/browse/RHDHBUGS-3095) for future removal
• Pins catalog index image version in test workflow for all branch types

.github/workflows/test.yaml

---