fix(ci): fix behavioral regressions in workflow refactor

- Restore bundle CSV update and commit-SHA-tagged bundle image
- Derive OPERATOR_IMAGE_BASE from GITHUB_REPOSITORY_OWNER
- Decouple coverage from blocking image builds
- Remove duplicate pull_request trigger from code-scanning

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Author: ArangoGutierrez

.github/workflows/ci.yaml

@@ -41,6 +41,10 @@ jobs:
   golang-checks:
     uses: ./.github/workflows/golang-checks.yaml
 
+  coverage:
+    needs: [golang-checks]
+    uses: ./.github/workflows/coverage.yaml
+
   image-builds:
     needs: [variables, config-checks, golang-checks]
     uses: ./.github/workflows/image-builds.yaml

.github/workflows/code-scanning.yaml

@@ -16,13 +16,6 @@ name: "CodeQL"
 
 on:
   workflow_call: {}
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    branches:
-      - main
-      - release-*
 
 jobs:
   analyze:

.github/workflows/coverage.yaml

@@ -0,0 +1,53 @@
+# Copyright NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Coverage
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  coverage:
+    runs-on: linux-amd64-cpu4
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Get Golang version
+        id: vars
+        run: |
+          GOLANG_VERSION=$( grep "GOLANG_VERSION ?=" versions.mk )
+          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> $GITHUB_ENV
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GOLANG_VERSION }}
+      - name: Setup Go Proxy
+        id: setup-go-proxy
+        uses: nv-gha-runners/setup-artifactory-go-proxy@main
+      - name: Generate coverage report
+        env:
+          GOPROXY: ${{ steps.setup-go-proxy.outputs.goproxy-url }}
+        run: |
+          make cov-report
+      - name: Upload to Coveralls
+        uses: coverallsapp/github-action@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path-to-lcov: lcov.info

.github/workflows/golang-checks.yaml

@@ -87,35 +87,3 @@ jobs:
       - uses: actions/checkout@v6
         name: Checkout code
       - run: make docker-build
-
-  coverage:
-    needs: [go-test]
-    runs-on: linux-amd64-cpu4
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-      - name: Get Golang version
-        id: vars
-        run: |
-          GOLANG_VERSION=$( grep "GOLANG_VERSION ?=" versions.mk )
-          echo "GOLANG_VERSION=${GOLANG_VERSION##GOLANG_VERSION ?= }" >> $GITHUB_ENV
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GOLANG_VERSION }}
-      - name: Setup Go Proxy
-        id: setup-go-proxy
-        uses: nv-gha-runners/setup-artifactory-go-proxy@main
-      - name: Generate coverage report
-        env:
-          GOPROXY: ${{ steps.setup-go-proxy.outputs.goproxy-url }}
-        run: |
-          make cov-report
-      - name: Upload to Coveralls
-        uses: coverallsapp/github-action@v2
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: lcov.info

.github/workflows/release.yaml

@@ -34,7 +34,6 @@ jobs:
       operator_image_base: ${{ steps.vars.outputs.operator_image_base }}
       operator_image_source: ${{ steps.vars.outputs.operator_image_source }}
       operator_image_latest: ${{ steps.vars.outputs.operator_image_latest }}
-      bundle_image: ${{ steps.vars.outputs.bundle_image }}
     steps:
       - name: Calculate release variables
         id: vars
@@ -48,14 +47,12 @@ jobs:
           # Calculate derived values
           OPERATOR_IMAGE_SOURCE="${OPERATOR_IMAGE_BASE}:${COMMIT_SHORT_SHA}"
           OPERATOR_IMAGE_LATEST="${OPERATOR_IMAGE_BASE}:main-latest"
-          BUNDLE_IMAGE="ghcr.io/nvidia/gpu-operator/gpu-operator-bundle:main-latest"
 
           # Output all variables
           echo "commit_short_sha=${COMMIT_SHORT_SHA}" >> $GITHUB_OUTPUT
           echo "operator_image_base=${OPERATOR_IMAGE_BASE}" >> $GITHUB_OUTPUT
           echo "operator_image_source=${OPERATOR_IMAGE_SOURCE}" >> $GITHUB_OUTPUT
           echo "operator_image_latest=${OPERATOR_IMAGE_LATEST}" >> $GITHUB_OUTPUT
-          echo "bundle_image=${BUNDLE_IMAGE}" >> $GITHUB_OUTPUT
 
           # Display for debugging
           echo "::notice::Releasing: ${OPERATOR_IMAGE_SOURCE} → ${OPERATOR_IMAGE_LATEST}"
@@ -85,6 +82,10 @@ jobs:
   push-gpu-operator-bundle-image:
     needs: [variables, release-latest-gpu-operator-image]
     runs-on: linux-amd64-cpu4
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v6
         name: Check out code
@@ -94,12 +95,21 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Update bundle CSV
+        env:
+          COMMIT_SHORT_SHA: ${{ needs.variables.outputs.commit_short_sha }}
+          OPERATOR_IMAGE_BASE: ${{ needs.variables.outputs.operator_image_base }}
+        run: |
+          sed -i -e "s|${OPERATOR_IMAGE_BASE}:[^ \"]*|${OPERATOR_IMAGE_BASE}:${COMMIT_SHORT_SHA}|g" bundle/manifests/gpu-operator-certified.clusterserviceversion.yaml
+          echo "Bundle CSV updated successfully"
       - name: Build bundle-image
         env:
-          BUNDLE_IMAGE: ${{ needs.variables.outputs.bundle_image }}
+          COMMIT_SHORT_SHA: ${{ needs.variables.outputs.commit_short_sha }}
           VERSION: ""
           DEFAULT_CHANNEL: "stable"
           CHANNELS: "stable"
         run: |
-          make push-bundle-image
+          BUNDLE_IMAGE_BASE="ghcr.io/nvidia/gpu-operator/gpu-operator-bundle"
+          make push-bundle-image BUNDLE_IMAGE=${BUNDLE_IMAGE_BASE}:${{ github.ref_name }}-latest
+          make push-bundle-image BUNDLE_IMAGE=${BUNDLE_IMAGE_BASE}:${COMMIT_SHORT_SHA}
 

.github/workflows/variables.yaml

@@ -96,7 +96,8 @@ jobs:
           fi
 
           # Image and version information (with override support)
-          OPERATOR_IMAGE_BASE="ghcr.io/nvidia/gpu-operator"
+          LOWERCASE_REPO_OWNER=$(echo "${GITHUB_REPOSITORY_OWNER}" | awk '{print tolower($0)}')
+          OPERATOR_IMAGE_BASE="ghcr.io/${LOWERCASE_REPO_OWNER}/gpu-operator"
           if [[ -n "${INPUT_OPERATOR_VERSION}" ]]; then
             OPERATOR_VERSION="${INPUT_OPERATOR_VERSION}"
           else