renovate: run update_artifacts_lockfile as postUpgradeTasks

[c4rt0]

When MintMaker bumps the OpenShift client version in ci/hermetic/artifacts.lock.yaml it only updates the download_url fields, leaving the checksum fields pointing at the old version. The hermetic build then fails because the downloaded file doesn't match the stored fingerprint. Example: PR #4524.

postUpgradeTasks is a standard Renovate feature that runs a shell command after a dependency is updated. This PR adds it to the custom.oc package rule so MintMaker calls update_artifacts_lockfile immediately after bumping the OC version, refreshing all four architecture checksums in the same PR commit.

update_artifacts_lockfile is also updated to accept the lockfile path as a command-line argument (sys.argv[1]), since MintMaker runs from the repo root and needs to pass the full path. The original no-argument behavior is preserved as a fallback.

This PR has no effect until the following are merged and deployed:

• KONFLUX-9132: Add update_artifacts_lockfile script for artifact checksum updates konflux-ci/mintmaker-renovate-image#539, installs the script in the MintMaker image
• KONFLUX-9132: renovate: allow update_artifacts_lockfile as postUpgradeTasks command konflux-ci/mintmaker#597 adds the command to allowedCommands

See: https://issues.redhat.com/browse/COS-3382

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 26bed2b4-5db9-4416-ae84-59a58e296cf1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[c4rt0]

/do-not-merge as this PR has no effect until the two konflux-ci PR's listed in the description merge.