Backport patch-safe fixes for v0.25.2

.github/workflows/release.yaml

@@ -54,10 +54,16 @@ jobs:
           # Removes: pre-release suffix ([+-].*) and patch version (\.[0-9]*$)
           release_branch=release-$(echo "${{ github.event.inputs.operatorVersion }}" | sed 's/[+-].*//; s/\.[0-9]*$//')
           echo "name=$release_branch" >> $GITHUB_OUTPUT
-      - name: Create release branch
+      - name: Create or checkout release branch
         if: ${{ !startsWith(github.event.inputs.gitRef, 'release-') }}
         run: |
-          git checkout -b ${{ steps.release-branch.outputs.name }}
+          branch=${{ steps.release-branch.outputs.name }}
+          if git ls-remote --exit-code --heads origin "$branch" > /dev/null 2>&1; then
+            git fetch origin "$branch"
+            git checkout "$branch"
+          else
+            git checkout -b "$branch"
+          fi
       - name: Prepare release
         run: |
           VERSION=${{ github.event.inputs.operatorVersion }} \

.github/workflows/sync-authorino-manifests.yaml

@@ -0,0 +1,65 @@
+name: Sync Authorino manifests
+
+on:
+  repository_dispatch:
+    types:
+      - authorino-manifests-sync
+  workflow_dispatch: {}
+
+concurrency:
+  group: authorino-manifests-sync
+  cancel-in-progress: true
+
+jobs:
+  sync-manifests:
+    name: Sync manifests and create PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.KUADRANT_DEV_PAT }}
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Install gettext-base
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gettext-base
+
+      - name: Update manifests
+        run: |
+          make manifests bundle helm-build
+
+      - name: Check for meaningful changes
+        id: check
+        run: |
+          git diff -I'^    createdAt:' --quiet && echo "skip=true" >> $GITHUB_OUTPUT || echo "skip=false" >> $GITHUB_OUTPUT
+
+      - name: Create Pull Request
+        if: steps.check.outputs.skip == 'false'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.KUADRANT_DEV_PAT }}
+          commit-message: Update Authorino manifests
+          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          author: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>
+          signoff: true
+          sign-commits: true
+          base: main
+          branch: sync/authorino-manifests
+          delete-branch: true
+          title: Update Authorino manifests
+          body: |
+            Automated sync of Authorino AuthConfig CRD and related manifests.
+
+            Synced by running `make manifests bundle helm-build`.
+
+            [Recent Authorino manifest changes](https://github.com/Kuadrant/authorino/commits/main/install)
+
+            Auto-generated by [sync-authorino-manifests](https://github.com/Kuadrant/authorino-operator/actions/workflows/sync-authorino-manifests.yaml)

Dockerfile

@@ -1,6 +1,6 @@
 # Build the authorino binary
 # https://catalog.redhat.com/software/containers/ubi10/go-toolset
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi10/go-toolset:1.25 AS builder
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi10/go-toolset:1.26 AS builder
 WORKDIR /workspace
 
 # Copy the Go Modules manifests

Makefile

@@ -347,10 +347,10 @@ bundle: manifests kustomize operator-sdk yq ## Generate bundle manifests and met
 	($(YQ) e -e '.config.replaces' $(BUILD_CONFIG_FILE) && \
 		V="$(shell $(YQ) e -e '.config.replaces' $(BUILD_CONFIG_FILE))" $(YQ) eval '.spec.replaces = strenv(V)' -i $(BUNDLE_CSV)) || \
 		($(YQ) eval '.' -i $(BUNDLE_CSV) && echo "no replaces added")
+	$(MAKE) bundle-custom-modifications
 	$(OPERATOR_SDK) bundle validate ./bundle
 	# Roll back edit
 	cd config/manager && $(KUSTOMIZE) edit set image controller=${DEFAULT_OPERATOR_IMAGE}
-	$(MAKE) bundle-custom-modifications
 
 .PHONY: bundle-custom-modifications
 OPENSHIFT_VERSIONS_ANNOTATION_KEY="com.redhat.openshift.versions"
@@ -391,7 +391,7 @@ set-authorino-default-image: yq ## Sets the default Authorino image in the build
 set-replaces-directive: yq ## Sets the value for the OLM replaces directive in the build file.
 	$(eval REPLACES_VERSION=$(shell curl -sSL -H "Accept: application/vnd.github+json" \
                https://api.github.com/repos/Kuadrant/authorino-operator/releases/latest | \
-               jq -r '.name'))
+               jq -r 'if (.name // "" | length) > 0 then .name else .tag_name end'))
 	V="authorino-operator.$(REPLACES_VERSION)" $(YQ) e -i '.config.replaces = strenv(V)' $(BUILD_CONFIG_FILE)
 
 .PHONY: prepare-release

build.yaml

@@ -1,5 +1,5 @@
 config:
   version: 0.25.1
   replaces: authorino-operator.v0.25.0
-  authorinoVersion: 0.26.1
-  authorinoImage: quay.io/kuadrant/authorino:v0.26.1
+  authorinoVersion: 0.26.2
+  authorinoImage: quay.io/kuadrant/authorino:v0.26.2

bundle/manifests/authorino-operator.clusterserviceversion.yaml

@@ -55,7 +55,7 @@ metadata:
     capabilities: Basic Install
     categories: Integration & Delivery
     containerImage: quay.io/kuadrant/authorino-operator:v0.25.1
-    createdAt: "2026-06-19T14:15:09Z"
+    createdAt: "2026-07-15T07:14:06Z"
     operators.operatorframework.io/builder: operator-sdk-v1.32.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
     repository: https://github.com/Kuadrant/authorino-operator
@@ -255,7 +255,7 @@ spec:
                       - /manager
                     env:
                       - name: RELATED_IMAGE_AUTHORINO
-                        value: quay.io/kuadrant/authorino:v0.26.1
+                        value: quay.io/kuadrant/authorino:v0.26.2
                     image: quay.io/kuadrant/authorino-operator:v0.25.1
                     livenessProbe:
                       httpGet:
@@ -359,7 +359,7 @@ spec:
   provider:
     name: Red Hat
   relatedImages:
-    - image: quay.io/kuadrant/authorino:v0.26.1
+    - image: quay.io/kuadrant/authorino:v0.26.2
       name: authorino
   version: 0.25.1
   replaces: authorino-operator.v0.25.0

charts/authorino-operator/templates/manifests.yaml

@@ -6179,7 +6179,7 @@ spec:
         - /manager
         env:
         - name: RELATED_IMAGE_AUTHORINO
-          value: quay.io/kuadrant/authorino:v0.26.1
+          value: quay.io/kuadrant/authorino:v0.26.2
         image: quay.io/kuadrant/authorino-operator:v0.25.1
         livenessProbe:
           httpGet:

config/authorino/kustomization.yaml

@@ -2,14 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-- github.com/Kuadrant/authorino/install?ref=v0.26.1
+- github.com/Kuadrant/authorino/install?ref=v0.26.2
 # - webhook
 
 # # Configures the conversion webhook
 # images:
 # - name: AUTHORINO_IMAGE
 #   newName: quay.io/kuadrant/authorino
-#   newTag: v0.26.1
+#   newTag: v0.26.2
 
 # patchesStrategicMerge:
 # - webhook/patches/webhook_in_authconfigs.yaml

config/deploy/manifests.yaml

@@ -6186,7 +6186,7 @@ spec:
         - /manager
         env:
         - name: RELATED_IMAGE_AUTHORINO
-          value: quay.io/kuadrant/authorino:v0.26.1
+          value: quay.io/kuadrant/authorino:v0.26.2
         image: quay.io/kuadrant/authorino-operator:v0.25.1
         livenessProbe:
           httpGet:

config/manager/manager.yaml

@@ -22,7 +22,7 @@ spec:
             - /manager
           env:
             - name: RELATED_IMAGE_AUTHORINO
-              value: quay.io/kuadrant/authorino:v0.26.1
+              value: quay.io/kuadrant/authorino:v0.26.2
           args:
             - --leader-elect
           image: controller:latest

go.mod

@@ -1,6 +1,6 @@
 module github.com/kuadrant/authorino-operator
 
-go 1.25.9
+go 1.26.4
 
 require (
 	github.com/go-logr/logr v1.4.3