Update workflows to run with 2026.1

[owenjones]

• Vault password is required during bootstrapping control host task. Some of our workflows continued working as the vault password environment variable was set globally in the workflow while others failed as we only set it on certain tasks.
• Amphora promotion workflow was set to run on Ubuntu 22.04 - 24.04 needed for newer required python version.
• DOCA OFED tags needed updating from 3.2.2 to 3.2.3 to be able to build modules.
• Some items in stackhpc_overcloud_dib_elements evaluate to None - filter these out

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 709eee81-dce4-43bb-8c37-8fe552365476

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Updated five CI workflows to define KAYOBE_VAULT_PASSWORD globally from the CI builder secret. Removed redundant task-level declarations. This supports 2026.1 control host bootstrapping and prevents failures caused by task-scoped Vault password configuration.

Walkthrough

Changes

Vault password environment configuration

Layer / File(s)	Summary
Define workflow-level Vault password environment .github/workflows/amphora-image-promote.yml, .github/workflows/ipa-image-promote.yml, .github/workflows/overcloud-host-image-promote.yml	The promotion workflows define KAYOBE_VAULT_PASSWORD from the CI builder secret at workflow level.
Use workflow-level Vault password in IPA builds .github/workflows/ipa-image-build.yml	The x86_64 and aarch64 IPA build steps remove repeated step-level Vault password environment blocks.
Use workflow-level Vault password in overcloud builds .github/workflows/overcloud-host-image-build.yml	The standard and aarch64 overcloud image build steps remove repeated step-level Vault password environment blocks.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to ee107

The workflows now expose the Vault password to every step rather than only the tasks that need it, increasing the impact of any compromised action or command. Merge should wait for step-scoped secret usage or explicit security-owner acceptance.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f0c4aa8a-ddbf-4e53-93bf-ee0c4fb1aa0d

📥 Commits

Reviewing files that changed from the base of the PR and between 7fa8c88 and ee1070c.

📒 Files selected for processing (5)

• .github/workflows/amphora-image-promote.yml
• .github/workflows/ipa-image-build.yml
• .github/workflows/ipa-image-promote.yml
• .github/workflows/overcloud-host-image-build.yml
• .github/workflows/overcloud-host-image-promote.yml

💤 Files with no reviewable changes (2)

• .github/workflows/overcloud-host-image-build.yml
• .github/workflows/ipa-image-build.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.19 lint with Python 3.12

🧰 Additional context used

🪛 zizmor (1.29.0)

.github/workflows/overcloud-host-image-promote.yml

[warning] 2-133: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

.github/workflows/amphora-image-promote.yml

[warning] 2-70: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

.github/workflows/ipa-image-promote.yml

[warning] 2-145: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)