chore: automate CIHealth image updates

[roi (roivaz)]

Follow-up to #6388.

What

• Register the CIHealth Quay image with the image updater using immutable seven-character commit tags.
• Replace the DEV-CI image tag with the latest published digest for d07a0f1.
• Render CIHealth deployments as repository@sha256:... while retaining tag fallback for local chart defaults.

Why

CIHealth image bumps are currently manual and use tags in the deployed configuration. Digest pinning makes deployments deterministic, while the existing image-updater periodic can keep CIHealth current through automated PRs.

Image update

Name	Old Digest	New Digest	Tag	Date	Status
cihealth	e6ce1b0bdf29…	d6be00b644b6…	d07a0f1	2026-08-05 13:40	updated

Testing

• make -C config materialize
• AZURE_TOKEN_CREDENTIALS=dev go test ./tooling/image-updater/...
• go run . update --config config.yaml --tags --components cihealth --dry-run --output-format markdown
• Rendered the CIHealth Helm chart with digest and tag values and verified both app and controllers image references.

[Copilot]

Pull request overview

This PR integrates the CIHealth image into the repo’s tooling/image-updater flow and updates DEV-CI CIHealth deployment inputs to prefer immutable digest pinning while keeping tag-based defaults for local Helm usage.

Changes:

• Register CIHealth in tooling/image-updater/config.yaml using 7-char git SHA tags and the vcs-ref label.
• Switch DEV-CI CIHealth rendered values to pass an image digest instead of a tag.
• Update the CIHealth Helm chart helper to render repository@sha256:... when a digest is provided, otherwise fall back to repository:tag.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tooling/image-updater/config.yaml	Adds CIHealth image registration to the image-updater config targeting the DEV-CI config digest field.
dev-infrastructure/dev-ci/cihealth/values.yaml.tmpl	Changes rendered CIHealth values to provide image.digest from config instead of image.tag.
dev-infrastructure/dev-ci/cihealth/deploy/values.yaml	Adds an explicit image.digest default (empty string) to support digest-or-tag rendering.
dev-infrastructure/dev-ci/cihealth/deploy/templates/_helpers.tpl	Updates image reference rendering to prefer digest (@sha256:...) with tag fallback.
config/config-dev-ci.yaml	Pins the DEV-CI CIHealth image to the new published digest (annotated with the corresponding 7-char tag).

[Giulio Frasca (gmfrasca)]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gmfrasca, roivaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• config/OWNERS [roivaz]
• dev-infrastructure/OWNERS [roivaz]
• tooling/image-updater/OWNERS [roivaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD fc90239 and 2 for PR HEAD 6c578d3 in total

[roi (roivaz)]

/retest

[roi (roivaz)]

Retesting e2e-parallel because build 2085091378521444352 failed for an environment-wide service disruption unrelated to this PR. Nine independent cases failed in the same run: FIPS, 4.20 candidate, and ARM64 cluster creates all returned InternalServerError: [clusterServiceClusterStatus] <no_message> within the same 20:38–20:39 UTC window, and other cases hit ClusterService deletion deadlines. The same job is concurrently red on PRs #6439 and #6440. This PR only changes CIHealth image-updater registration and Helm/config image rendering; it does not alter RP or e2e behavior.

/test e2e-parallel

[roi (roivaz)]

Retesting e2e-parallel because build 2085120533787054080 failed solely in the aggregated-features test with a known fleet-wide test-harness cleanup race:

VerifyCiliumConnectivityChecks failed: failed to create test namespace: object is being deleted: namespaces "cilium-connectivity-check" already exists

The identical testcase and error are also present in failed e2e-parallel runs on PRs #6440 (build 2085072376051011584), #6439 (2085053622613184512), and #6418 (2085032152935698432). This PR only changes CIHealth image updater/config and Helm image rendering, so it cannot affect Cilium namespace cleanup. The prior retry also reduced the unrelated failures from nine to this single race.

/test e2e-parallel

[roi (roivaz)]

Retesting e2e-parallel because build 2085154009877843968 passed all 55 executed e2e test cases (30 skipped) and failed only in the post-run observability gate for one resolved Sev3 warning:

[aro-hcp-observability] [svc] alert FrontendPathLatency does not fire
State: Resolved
method="put"
route=".../providers/microsoft.redhatopenshift/hcpopenshiftclusters/{resourcename}"
The 99th percentile ... exceeded 1 second over the past 5 minutes.

The same resolved FrontendPathLatency observability alert also failed e2e-parallel on PR #6418 (build 2085032152935698432, method get). This PR only changes CIHealth image updater/config and Helm image rendering and cannot affect RP frontend latency.

/test e2e-parallel