[hypershell-builder]

Summary

This update moves HyperShell's pinned OpenShell gateway from v0.1.5-rhaiv.3
to v0.1.5-rhaiv.4, the newest stable midstream release. It changes image
tags and version strings only. The vendored Helm chart under
charts/openshell/ has no content changes - this patch release only touched
upstream Rust source code and documentation, not the chart.

• Bumped OPENSHELL_TAG in OPENSHELL_VERSION and ran the standard sync
  (deployment env vars, capability labels on four overlays).
• Bumped the matching tag string in the ROKS e2e script, the CLI e2e image
  pin, and spec/skill doc examples that cite the tag.
• Ran all Python policy checks that make up make check directly (make
  itself cannot run in this agent runtime); all pass. go build/vet/test
  could not run in this runtime (no Go toolchain available) - the CLI e2e
  change is a single string-literal image-tag edit, so this is a recorded gap
  for CI or a human reviewer to confirm, not a known break.

Release-note triage

Comparing v0.1.5-rhaiv.3...v0.1.5-rhaiv.4 on opendatahub-io/openshell:

• Needs a maintainer decision (not fixed in this PR): upstream
  fix(gateway): require authentication or explicit development opt-in NVIDIA/OpenShell#4821 changes the gateway so it now refuses to start -
  before it opens any network port - if no OIDC, mTLS, operator auth, or
  gateway_jwt is configured and allow_unauthenticated_users is not set to
  true. Before this change, that same setup just logged a warning and ran
  unauthenticated. HyperShell's own config check
  (ValidateRenderedGatewayConfig) still accepts that setup as valid today,
  and the control plane can produce it for a gateway reconciled while
  Keycloak integration is off and no custom OIDC issuer is set on the Gateway.
  After this bump, such a gateway will crash-loop at startup instead of
  running insecurely as before. I filed
  needs-decision: OpenShell v0.1.5-rhaiv.4 gateway now refuses to start without an auth mechanism #809 so a maintainer can choose how to handle
  it (reject the configuration earlier with a clear error, require an auth
  mechanism at gateway-creation time, or default to the old permissive
  behavior). This PR does not change that behavior.
• Additive, no action needed: the gateway adds new SuspendSandbox /
  ResumeSandbox gRPC calls and two new sandbox states (suspended /
  suspending) for a new pause-and-resume feature, plus an optional policy
  for supervisor middleware extensions. Both changes are backward compatible
  and HyperShell does not yet use either feature.
• The console dashboard pin is unchanged. A newer dashboard release exists,
  but its image digest cannot be fetched from this runtime (no network
  access to quay.io); this gap is already tracked in needs-decision: bump OpenShell console pin from v0.1.1 to v0.1.2 (digest unresolved) #760 and update-openshell: pin console dashboard v0.1.2 (gateway 0.1.5-rhaiv.1 line) once a digest can be fetched #752.

Files changed

• OPENSHELL_VERSION, deploy/base/platform-resources/controller.yaml,
  deploy/{gitops/platform,ibm,kind,openshift}/kustomization.yaml - pin sync
• components/pr-test/e2e-openshell-roks.sh, tests/e2e/cli_test.go - e2e
  image pins
• specs/platform/data-model.spec.md,
  specs/platform/openshell-image-auto-update.spec.md,
  specs/platform/openshell-gateway.spec.md - doc/spec citations of the tag,
  plus a new note on the auth-gate risk above
• skills/deploy/{deploy-cluster,gcp-cluster,ibm-cluster}/SKILL.md - example
  image pins
• skills/tooling/update-openshell/SKILL.md - Learnings log entry and a new
  permanent contract-surface check for the gateway startup auth gate

Test plan

• All runnable make check sub-checks (Python policy scripts and their
  unit tests) pass directly
• Chart vendor diff confirmed empty (byte-identical between tags)
• Full-repo grep confirms no stray old-version string remains outside
  intentional fixtures and historical log entries
• go build/vet/test - could not run in this agent runtime (no Go
  toolchain); please confirm in CI
• Live cluster validation (Kind or ROKS) of the new gateway image,
  including the auth-gate risk above, is still needed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: openshift-online/hypershell
• Branch: main
• File: .coderabbit.yaml
• Commit: 85a28f8
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 715c9d21-714e-4a39-8cc9-c6d28c100ac0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

HyperShell environment destroyed

This ephemeral OpenShift environment has been destroyed. Comment /pr-extend to redeploy it.