From 7d625dc6eaf47f95ef54432dfe0eb227e4241d3d Mon Sep 17 00:00:00 2001
From: Dan Pock <self@danpock.me>
Date: Thu, 9 Jul 2026 17:00:00 -0400
Subject: [PATCH 1/3] Automate SCC Operator release handling with workflows,
 scripts, and PR creation logic for Rancher.

---
 .github/workflows/push-to-rancher.yml         |  56 +++++++
 .github/workflows/push-to-rancher/README.md   |  89 +++++++++++
 .github/workflows/push-to-rancher/common.sh   |  78 +++++++++
 .../workflows/push-to-rancher/create-prs.sh   | 150 ++++++++++++++++++
 .github/workflows/push-to-rancher/run-gha.sh  |  41 +++++
 .../workflows/push-to-rancher/run-local.sh    |  90 +++++++++++
 .../push-to-rancher/update-build-yaml.sh      |  30 ++++
 .github/workflows/release.yml                 |  21 ++-
 8 files changed, 553 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/push-to-rancher.yml
 create mode 100644 .github/workflows/push-to-rancher/README.md
 create mode 100755 .github/workflows/push-to-rancher/common.sh
 create mode 100755 .github/workflows/push-to-rancher/create-prs.sh
 create mode 100755 .github/workflows/push-to-rancher/run-gha.sh
 create mode 100755 .github/workflows/push-to-rancher/run-local.sh
 create mode 100755 .github/workflows/push-to-rancher/update-build-yaml.sh

diff --git a/.github/workflows/push-to-rancher.yml b/.github/workflows/push-to-rancher.yml
new file mode 100644
index 0000000..8c64716
--- /dev/null
+++ b/.github/workflows/push-to-rancher.yml
@@ -0,0 +1,56 @@
+name: Push to rancher/rancher
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'SCC Operator tag to sync (e.g. v0.4.2-rc.1)'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      tag:
+        description: 'SCC Operator tag to sync'
+        required: true
+        type: string
+
+jobs:
+  push-to-rancher:
+    name: Push to rancher/rancher
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    container:
+      image: ghcr.io/rancher/ci-image/go1.25
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Read GitHub App Credentials from Vault
+        if: github.repository == 'rancher/scc-operator'
+        uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APPID;
+            secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATEKEY
+
+      - name: Generate GitHub App Token
+        if: github.repository == 'rancher/scc-operator'
+        id: generate_token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ env.APPID }}
+          private-key: ${{ env.PRIVATEKEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: rancher
+
+      - name: Push updates to rancher/rancher
+        if: github.repository == 'rancher/scc-operator'
+        env:
+          TAG: ${{ inputs.tag }}
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+          SOURCE_REPO: ${{ github.repository }}
+          SCC_DIR: ${{ github.workspace }}
+          RANCHER_DIR: ${{ github.workspace }}/rancher-repo
+        run: ./.github/workflows/push-to-rancher/run-gha.sh
diff --git a/.github/workflows/push-to-rancher/README.md b/.github/workflows/push-to-rancher/README.md
new file mode 100644
index 0000000..1b6ec95
--- /dev/null
+++ b/.github/workflows/push-to-rancher/README.md
@@ -0,0 +1,89 @@
+# push-to-rancher
+
+Automates opening PRs against [rancher/rancher](https://github.com/rancher/rancher) when a new SCC Operator release is published.
+
+## Workflows
+
+### `.github/workflows/push-to-rancher.yml`
+
+Standalone workflow that can be:
+- **Manually triggered** via `workflow_dispatch` with any tag (including RCs)
+- **Called** from other workflows (e.g., `release.yml` for stable releases)
+
+### `.github/workflows/release.yml`
+
+Automatically calls `push-to-rancher.yml` for stable releases only (after images are published and release is un-drafted).
+
+## How it works
+
+For each target Rancher branch:
+1. Clone rancher/rancher
+2. Update `defaultSccOperatorImage` in `build.yaml`
+3. Run `go generate ./pkg/...` to update generated files
+4. Commit changes
+5. Push branch and create PR
+
+## Target branches
+
+Edit `common.sh` and update `RANCHER_BRANCHES` array:
+
+```bash
+RANCHER_BRANCHES=(
+  "release/v2.12"
+  "release/v2.13"
+  "release/v2.14"
+  "release/v2.15"
+  "main"
+)
+```
+
+Add new Rancher versions as they're released. Remove EOL versions.
+
+## Local usage
+
+```bash
+./.github/workflows/push-to-rancher/run-local.sh \
+  --tag v0.4.2 \
+  --rancher-dir /path/to/rancher \
+  [--dry-run] \
+  [--remote upstream]
+```
+
+`--dry-run` runs all local git work (commits to your rancher clone) but skips push and PR creation.
+
+## Step sequence
+
+| Script | What it does |
+|---|---|
+| `update-build-yaml.sh` | Updates `defaultSccOperatorImage` in `build.yaml` using `yq` |
+| `create-prs.sh` | For each target branch: checkout, update, `go generate`, commit, push, create PR |
+| `run-gha.sh` | GHA entry point: validates image exists, clones rancher/rancher, calls create-prs.sh |
+| `run-local.sh` | Local entry point: parses args, sets up env, calls create-prs.sh |
+
+## Key env vars
+
+| Var | Description |
+|---|---|
+| `TAG` | SCC Operator tag (e.g. `v0.4.2`) |
+| `RANCHER_DIR` | Path to local rancher/rancher clone |
+| `RANCHER_REMOTE` | Remote name in `RANCHER_DIR` (default: `origin`) |
+| `DRY_RUN` | Set to `true` to skip push and PR creation |
+| `SOURCE_REPO` | Source repo for PR body (default: `rancher/scc-operator`) |
+
+## GHA prerequisites
+
+The workflow reads a GitHub App credential from Vault at:
+
+```
+secret/data/github/repo/rancher/scc-operator/github/app-credentials
+```
+
+The app must have write access to `rancher/rancher` to push branches and open PRs.
+
+## Error handling
+
+The workflow continues processing branches even if one fails. Failed branches are logged at the end of the run. Common failure modes:
+
+- Branch doesn't exist (e.g., when a new Rancher version isn't released yet)
+- `go generate` fails (rare, usually indicates build.yaml format change)
+- PR already exists for this tag on this branch
diff --git a/.github/workflows/push-to-rancher/common.sh b/.github/workflows/push-to-rancher/common.sh
new file mode 100755
index 0000000..131e96a
--- /dev/null
+++ b/.github/workflows/push-to-rancher/common.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Shared setup for push-to-rancher scripts. Source this file: source "$(dirname "$0")/common.sh"
+
+# Determine SCC_DIR (scc-operator root) from this script's location
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCC_DIR="${SCC_DIR:-$(cd "$SCRIPT_DIR/../../.." && pwd)}"
+
+# Required: path to a local rancher/rancher clone
+RANCHER_DIR="${RANCHER_DIR:-}"
+
+# Remote name for rancher/rancher in RANCHER_DIR (may differ locally if using a fork)
+RANCHER_REMOTE="${RANCHER_REMOTE:-origin}"
+
+# Skip git commits, push, and PR creation when true
+DRY_RUN="${DRY_RUN:-false}"
+
+# Target branches in rancher/rancher to update
+RANCHER_BRANCHES=(
+  "release/v2.12"
+  "release/v2.13"
+  "release/v2.14"
+#  "release/v2.15"
+  "main"
+)
+
+# Docker registry to validate image existence
+IMAGE_REGISTRY="${IMAGE_REGISTRY:-docker.io}"
+IMAGE_REPO="${IMAGE_REPO:-rancher/scc-operator}"
+
+# Write to GitHub step summary if available, and always print to stdout
+summary() {
+  if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+    echo "$@" >> "$GITHUB_STEP_SUMMARY"
+  fi
+  echo "$@"
+}
+
+require_var() {
+  local var="$1"
+  if [ -z "${!var:-}" ]; then
+    echo "ERROR: $var is required" >&2
+    exit 1
+  fi
+}
+
+require_rancher_dir() {
+  require_var RANCHER_DIR
+  if [ ! -d "$RANCHER_DIR" ]; then
+    echo "ERROR: RANCHER_DIR '$RANCHER_DIR' does not exist" >&2
+    exit 1
+  fi
+}
+
+# Validate that the SCC Operator image exists in the registry
+validate_image_exists() {
+  local tag="$1"
+  local full_image="${IMAGE_REGISTRY}/${IMAGE_REPO}:${tag}"
+
+  summary "- Validating image exists: \`$full_image\`"
+
+  if ! docker manifest inspect "$full_image" >/dev/null 2>&1; then
+    echo "ERROR: Image $full_image does not exist in registry" >&2
+    echo "ERROR: Cannot proceed with PR creation until image is published" >&2
+    exit 1
+  fi
+
+  summary "  ✓ Image validated"
+}
+
+# Commit all changes in RANCHER_DIR if any exist. Does nothing if tree is clean.
+commit_if_changed() {
+  local message="$1"
+  if git -C "$RANCHER_DIR" diff --quiet --exit-code && [ -z "$(git -C "$RANCHER_DIR" status --porcelain)" ]; then
+    return 0
+  fi
+  git -C "$RANCHER_DIR" add .
+  git -C "$RANCHER_DIR" commit -m "$message"
+}
diff --git a/.github/workflows/push-to-rancher/create-prs.sh b/.github/workflows/push-to-rancher/create-prs.sh
new file mode 100755
index 0000000..81c317a
--- /dev/null
+++ b/.github/workflows/push-to-rancher/create-prs.sh
@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+# Creates PRs to rancher/rancher branches with updated SCC Operator image.
+#
+# Required env vars:
+#   TAG          - SCC Operator tag (e.g. v0.4.2)
+#   RANCHER_DIR  - Path to rancher/rancher clone
+#   GH_TOKEN     - GitHub token for PR creation
+#   SOURCE_REPO  - Source repo for PR body (e.g. rancher/scc-operator)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/common.sh"
+
+require_var TAG
+require_var GH_TOKEN
+require_rancher_dir
+
+SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
+
+# Configure git in rancher clone
+git -C "$RANCHER_DIR" config user.name "github-actions[bot]"
+git -C "$RANCHER_DIR" config user.email "github-actions[bot]@users.noreply.github.com"
+
+summary ""
+summary "## Processing branches"
+
+FAILED_BRANCHES=()
+
+for TARGET_BRANCH in "${RANCHER_BRANCHES[@]}"; do
+  summary ""
+  summary "### Branch: \`$TARGET_BRANCH\`"
+
+  # Fetch and checkout target branch
+  if ! git -C "$RANCHER_DIR" fetch "$RANCHER_REMOTE" "$TARGET_BRANCH" 2>&1; then
+    summary "  ⚠️  Failed to fetch branch \`$TARGET_BRANCH\` - skipping"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (fetch failed)")
+    continue
+  fi
+
+  git -C "$RANCHER_DIR" checkout -B "$TARGET_BRANCH" "$RANCHER_REMOTE/$TARGET_BRANCH"
+
+  # Create feature branch
+  BRANCH_NAME="bot/scc-operator-${TAG}-$(date +%s)"
+  git -C "$RANCHER_DIR" checkout -b "$BRANCH_NAME"
+
+  # Update build.yaml
+  export TAG RANCHER_DIR
+  if ! bash "$SCRIPT_DIR/update-build-yaml.sh"; then
+    summary "  ⚠️  Failed to update build.yaml - skipping"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (update failed)")
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
+    continue
+  fi
+
+  # Run go generate (extract first directive from generate.go)
+  GENERATE_FILE="$RANCHER_DIR/generate.go"
+  if [ ! -f "$GENERATE_FILE" ]; then
+    summary "  ⚠️  generate.go not found - skipping"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (no generate.go)")
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
+    continue
+  fi
+
+  # Extract first //go:generate directive
+  GENERATE_CMD=$(grep -m 1 '^//go:generate' "$GENERATE_FILE" | sed 's|^//go:generate ||')
+  if [ -z "$GENERATE_CMD" ]; then
+    summary "  ⚠️  No go:generate directive found in generate.go - skipping"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (no generate directive)")
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
+    continue
+  fi
+
+  summary "  - Running: \`$GENERATE_CMD\`"
+  if ! (cd "$RANCHER_DIR" && eval "$GENERATE_CMD"); then
+    summary "  ⚠️  go generate failed - skipping"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (go generate failed)")
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
+    continue
+  fi
+
+  # Commit changes
+  COMMIT_MSG="Update SCC Operator to ${TAG}
+
+Automated update from ${SOURCE_REPO} release ${TAG}"
+
+  if ! commit_if_changed "$COMMIT_MSG"; then
+    summary "  ℹ️  No changes detected - skipping"
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
+    continue
+  fi
+
+  if [ "$DRY_RUN" = "true" ]; then
+    summary "  ✓ Changes committed (dry-run, not pushing)"
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    continue
+  fi
+
+  # Push branch
+  summary "  - Pushing branch \`$BRANCH_NAME\`"
+  if ! git -C "$RANCHER_DIR" push -u "$RANCHER_REMOTE" "$BRANCH_NAME"; then
+    summary "  ⚠️  Failed to push branch - skipping PR creation"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (push failed)")
+    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+    continue
+  fi
+
+  # Create PR
+  summary "  - Creating PR..."
+  PR_BODY="## Summary
+Update SCC Operator image to [\`${TAG}\`](https://github.com/${SOURCE_REPO}/releases/tag/${TAG})
+
+## Changes
+- Updated \`defaultSccOperatorImage\` in \`build.yaml\`
+- Ran \`go generate ./pkg/...\` to update generated files"
+
+  if gh pr create \
+    --repo rancher/rancher \
+    --base "$TARGET_BRANCH" \
+    --head "$BRANCH_NAME" \
+    --title "Update SCC Operator to ${TAG}" \
+    --body "$PR_BODY" \
+    --label "status/auto-created" 2>&1; then
+    summary "  ✓ PR created successfully"
+  else
+    summary "  ⚠️  Failed to create PR"
+    FAILED_BRANCHES+=("$TARGET_BRANCH (PR creation failed)")
+  fi
+
+  # Return to target branch for next iteration
+  git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
+done
+
+summary ""
+summary "## Summary"
+
+if [ ${#FAILED_BRANCHES[@]} -eq 0 ]; then
+  summary "✅ All branches processed successfully"
+else
+  summary "⚠️  Some branches failed:"
+  for branch in "${FAILED_BRANCHES[@]}"; do
+    summary "  - $branch"
+  done
+  exit 1
+fi
diff --git a/.github/workflows/push-to-rancher/run-gha.sh b/.github/workflows/push-to-rancher/run-gha.sh
new file mode 100755
index 0000000..cedde7f
--- /dev/null
+++ b/.github/workflows/push-to-rancher/run-gha.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# GHA entry point: orchestrates the full rancher/rancher update workflow.
+# Called from push-to-rancher.yaml after token generation.
+#
+# Required env vars (set by push-to-rancher.yaml or release.yml):
+#   TAG          - SCC Operator tag (e.g. v0.4.2)
+#   GH_TOKEN     - GitHub app token with access to rancher/rancher
+#   SOURCE_REPO  - source repo (github.repository)
+#   SCC_DIR      - path to scc-operator workspace ($GITHUB_WORKSPACE)
+#   RANCHER_DIR  - path to clone rancher/rancher into
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/common.sh"
+
+require_var TAG
+require_var GH_TOKEN
+
+export SCC_DIR RANCHER_DIR DRY_RUN
+
+summary "## Push to rancher/rancher"
+summary "- Tag: \`$TAG\`"
+summary "- Target branches: \`${RANCHER_BRANCHES[*]}\`"
+summary ""
+
+# Validate image exists before proceeding
+validate_image_exists "$TAG"
+
+# Clone rancher/rancher
+summary "- Cloning rancher/rancher..."
+git clone "https://oauth2:${GH_TOKEN}@github.com/rancher/rancher.git" "$RANCHER_DIR"
+
+summary ""
+summary "## Creating PRs"
+
+export SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
+bash "$SCRIPT_DIR/create-prs.sh"
+
+summary ""
+summary "## Workflow Complete"
diff --git a/.github/workflows/push-to-rancher/run-local.sh b/.github/workflows/push-to-rancher/run-local.sh
new file mode 100755
index 0000000..d492b62
--- /dev/null
+++ b/.github/workflows/push-to-rancher/run-local.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Local entry point for testing push-to-rancher workflow.
+#
+# Usage:
+#   ./run-local.sh --tag v0.4.2 --rancher-dir /path/to/rancher [--dry-run] [--remote upstream]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Defaults
+TAG=""
+RANCHER_DIR=""
+DRY_RUN="false"
+RANCHER_REMOTE="origin"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --tag)
+      TAG="$2"
+      shift 2
+      ;;
+    --rancher-dir)
+      RANCHER_DIR="$2"
+      shift 2
+      ;;
+    --dry-run)
+      DRY_RUN="true"
+      shift
+      ;;
+    --remote)
+      RANCHER_REMOTE="$2"
+      shift 2
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      echo "Usage: $0 --tag TAG --rancher-dir DIR [--dry-run] [--remote REMOTE]" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Validate required args
+if [ -z "$TAG" ]; then
+  echo "ERROR: --tag is required" >&2
+  exit 1
+fi
+
+if [ -z "$RANCHER_DIR" ]; then
+  echo "ERROR: --rancher-dir is required" >&2
+  exit 1
+fi
+
+if [ ! -d "$RANCHER_DIR" ]; then
+  echo "ERROR: rancher-dir '$RANCHER_DIR' does not exist" >&2
+  exit 1
+fi
+
+# Set up environment
+export TAG RANCHER_DIR RANCHER_REMOTE DRY_RUN
+export GH_TOKEN="${GH_TOKEN:-$(gh auth token)}"
+
+# Source common for validation functions
+source "$SCRIPT_DIR/common.sh"
+
+echo "## Push to rancher/rancher (local)"
+echo "- Tag: $TAG"
+echo "- Rancher dir: $RANCHER_DIR"
+echo "- Remote: $RANCHER_REMOTE"
+echo "- Dry run: $DRY_RUN"
+echo ""
+
+# Validate image exists
+validate_image_exists "$TAG"
+
+echo ""
+echo "## Creating PRs"
+
+export SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
+bash "$SCRIPT_DIR/create-prs.sh"
+
+echo ""
+echo "## Workflow Complete"
+
+if [ "$DRY_RUN" = "true" ]; then
+  echo ""
+  echo "NOTE: This was a dry run. Changes were committed locally but not pushed."
+  echo "Review the commits in $RANCHER_DIR and run without --dry-run to push and create PRs."
+fi
diff --git a/.github/workflows/push-to-rancher/update-build-yaml.sh b/.github/workflows/push-to-rancher/update-build-yaml.sh
new file mode 100755
index 0000000..98a921c
--- /dev/null
+++ b/.github/workflows/push-to-rancher/update-build-yaml.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Updates defaultSccOperatorImage in build.yaml to the specified tag.
+#
+# Required env vars:
+#   TAG          - SCC Operator tag (e.g. v0.4.2)
+#   RANCHER_DIR  - Path to rancher/rancher clone
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/common.sh"
+
+require_var TAG
+require_rancher_dir
+
+BUILD_YAML="$RANCHER_DIR/build.yaml"
+
+if [ ! -f "$BUILD_YAML" ]; then
+  echo "ERROR: build.yaml not found at $BUILD_YAML" >&2
+  exit 1
+fi
+
+# Remove leading 'v' if present for consistency
+TAG_NO_V="${TAG#v}"
+
+# Update the defaultSccOperatorImage field
+# Use yq for safe YAML editing
+yq eval ".defaultSccOperatorImage = \"rancher/scc-operator:v${TAG_NO_V}\"" -i "$BUILD_YAML"
+
+summary "  - Updated build.yaml: \`defaultSccOperatorImage: rancher/scc-operator:v${TAG_NO_V}\`"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a7dfbdd..d6b59bc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -129,9 +129,18 @@ jobs:
     name: Un-draft release
     runs-on: ubuntu-latest
     needs: [ ci, goreleaser, image ]
+    outputs:
+      is_stable: ${{ steps.semver_check.outputs.HAS_PRERELEASE == 'false' }}
     permissions:
       contents: write
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Check SemVer Characteristics
+        id: semver_check
+        run: bash ./.github/scripts/check-semver "${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+
       - name: Fully publish release (retry until visible)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -139,7 +148,7 @@ jobs:
         run: |
           set -euo pipefail
           tag="${{ github.ref_name }}"
-          
+
           for i in {1..12}; do
             if gh release view -R "${{ github.repository }}" "$tag" >/dev/null 2>&1; then
               gh release edit -R "${{ github.repository }}" "$tag" --draft=false
@@ -148,6 +157,14 @@ jobs:
             echo "Release '$tag' not found yet (attempt $i/12). Sleeping 10s..."
             sleep 10
           done
-          
+
           echo "Release '$tag' still not found after retries; failing."
           exit 1
+
+  push-to-rancher:
+    name: Push to rancher/rancher
+    needs: [ release ]
+    if: ${{ github.repository == 'rancher/scc-operator' && needs.release.outputs.is_stable == 'true' }}
+    uses: ./.github/workflows/push-to-rancher.yml
+    with:
+      tag: ${{ github.ref_name }}

From 39f9574f6d203b811c7d03957b4bfb6caddcb38f Mon Sep 17 00:00:00 2001
From: Dan Pock <self@danpock.me>
Date: Thu, 9 Jul 2026 17:09:05 -0400
Subject: [PATCH 2/3] Update PR title to include branch label for clarity

---
 .github/workflows/push-to-rancher/create-prs.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/push-to-rancher/create-prs.sh b/.github/workflows/push-to-rancher/create-prs.sh
index 81c317a..161ed19 100755
--- a/.github/workflows/push-to-rancher/create-prs.sh
+++ b/.github/workflows/push-to-rancher/create-prs.sh
@@ -112,6 +112,10 @@ Automated update from ${SOURCE_REPO} release ${TAG}"
 
   # Create PR
   summary "  - Creating PR..."
+
+  # Format branch name for title: strip "release/" prefix
+  BRANCH_LABEL="${TARGET_BRANCH#release/}"
+
   PR_BODY="## Summary
 Update SCC Operator image to [\`${TAG}\`](https://github.com/${SOURCE_REPO}/releases/tag/${TAG})
 
@@ -123,7 +127,7 @@ Update SCC Operator image to [\`${TAG}\`](https://github.com/${SOURCE_REPO}/rele
     --repo rancher/rancher \
     --base "$TARGET_BRANCH" \
     --head "$BRANCH_NAME" \
-    --title "Update SCC Operator to ${TAG}" \
+    --title "[${BRANCH_LABEL}] Update SCC Operator to ${TAG}" \
     --body "$PR_BODY" \
     --label "status/auto-created" 2>&1; then
     summary "  ✓ PR created successfully"

From 3a2b0038f238cc5807df9d8733747ee2ae676757 Mon Sep 17 00:00:00 2001
From: Dan Pock <self@danpock.me>
Date: Fri, 10 Jul 2026 14:17:10 -0400
Subject: [PATCH 3/3] Switch to reuseable action based PR create method

---
 .github/pr-consumer-config.yaml               |  13 ++
 .github/scripts/update-build-yaml.sh          | 120 ++++++++++++++
 .github/workflows/push-to-rancher.yml         |  14 +-
 .github/workflows/push-to-rancher/README.md   |  89 ----------
 .github/workflows/push-to-rancher/common.sh   |  78 ---------
 .../workflows/push-to-rancher/create-prs.sh   | 154 ------------------
 .github/workflows/push-to-rancher/run-gha.sh  |  41 -----
 .../workflows/push-to-rancher/run-local.sh    |  90 ----------
 .../push-to-rancher/update-build-yaml.sh      |  30 ----
 9 files changed, 139 insertions(+), 490 deletions(-)
 create mode 100644 .github/pr-consumer-config.yaml
 create mode 100755 .github/scripts/update-build-yaml.sh
 delete mode 100644 .github/workflows/push-to-rancher/README.md
 delete mode 100755 .github/workflows/push-to-rancher/common.sh
 delete mode 100755 .github/workflows/push-to-rancher/create-prs.sh
 delete mode 100755 .github/workflows/push-to-rancher/run-gha.sh
 delete mode 100755 .github/workflows/push-to-rancher/run-local.sh
 delete mode 100755 .github/workflows/push-to-rancher/update-build-yaml.sh

diff --git a/.github/pr-consumer-config.yaml b/.github/pr-consumer-config.yaml
new file mode 100644
index 0000000..d16f0f3
--- /dev/null
+++ b/.github/pr-consumer-config.yaml
@@ -0,0 +1,13 @@
+# Configuration for send-pr-to-consumer action
+version_mapping_type: major
+
+version_branch_map:
+  "0":
+    - "main"
+    - "dev-v2.14"
+    - "dev-v2.13"
+    - "dev-v2.12"
+
+target:
+  repo: "rancher/rancher"
+  update_script: "./.github/scripts/update-build-yaml.sh"
diff --git a/.github/scripts/update-build-yaml.sh b/.github/scripts/update-build-yaml.sh
new file mode 100755
index 0000000..19d3944
--- /dev/null
+++ b/.github/scripts/update-build-yaml.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Updates defaultSccOperatorImage in build.yaml to the specified tag.
+#
+# This script is called by the rancher/ecm-distro-tools create-pr action to
+# update the SCC Operator image version in rancher/rancher's build.yaml file
+# and regenerate any dependent code.
+#
+# Required env vars:
+#   TAG          - SCC Operator tag (e.g. v0.4.2)
+#   RANCHER_DIR  - Path to rancher/rancher clone
+#
+# Optional env vars (provided by PRBUILDER):
+#   PRBUILDER_TAG          - The release tag (e.g., "v0.4.2")
+#   PRBUILDER_VERSION      - Parsed version based on version_mapping_type
+#   PRBUILDER_TARGET_DIR   - Absolute path to the cloned target repository
+#   PRBUILDER_TARGET_REPO  - Target repository in "owner/repo" format
+#   PRBUILDER_TARGET_BRANCH - Target branch being updated (e.g., "dev-v2.14")
+#   PRBUILDER_SOURCE_DIR   - Absolute path to the source repository
+
+set -euo pipefail
+
+# =============================================================================
+# ENVIRONMENT SETUP
+# =============================================================================
+
+# Use PRBUILDER_* variables if available, fall back to legacy names
+TAG=${TAG:-${PRBUILDER_TAG}}
+RANCHER_DIR=${RANCHER_DIR:-${PRBUILDER_TARGET_DIR}}
+TARGET_BRANCH=${PRBUILDER_TARGET_BRANCH:-unknown}  # For error message context only
+
+# =============================================================================
+# UTILITY FUNCTIONS
+# =============================================================================
+
+summary() {
+  if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+    echo "$@" >> "$GITHUB_STEP_SUMMARY"
+  fi
+  echo "$@"
+}
+
+require_var() {
+  local var="$1"
+  if [ -z "${!var:-}" ]; then
+    echo "ERROR: $var is required" >&2
+    exit 1
+  fi
+}
+
+require_binary() {
+  local bin="$1"
+  if ! command -v "$bin" &> /dev/null; then
+    echo "ERROR: Required binary '$bin' not found in PATH" >&2
+    exit 1
+  fi
+}
+
+# =============================================================================
+# PREFLIGHT CHECKS
+# =============================================================================
+
+# Check required binaries
+require_binary yq
+require_binary grep
+require_binary sed
+
+# Check required environment variables
+require_var TAG
+
+require_var RANCHER_DIR
+if [ ! -d "$RANCHER_DIR" ]; then
+  echo "ERROR: RANCHER_DIR '$RANCHER_DIR' does not exist" >&2
+  exit 1
+fi
+
+# Check that build.yaml exists
+BUILD_YAML="$RANCHER_DIR/build.yaml"
+if [ ! -f "$BUILD_YAML" ]; then
+  echo "ERROR: build.yaml not found at $BUILD_YAML" >&2
+  exit 1
+fi
+
+# =============================================================================
+# UPDATE BUILD.YAML
+# =============================================================================
+
+# Remove leading 'v' if present for consistency
+TAG_NO_V="${TAG#v}"
+
+# Update the defaultSccOperatorImage field using yq for safe YAML editing
+yq eval ".defaultSccOperatorImage = \"rancher/scc-operator:v${TAG_NO_V}\"" -i "$BUILD_YAML"
+
+summary "  - Updated build.yaml: \`defaultSccOperatorImage: rancher/scc-operator:v${TAG_NO_V}\`"
+
+# =============================================================================
+# RUN GO GENERATE
+# =============================================================================
+
+# Check that generate.go exists
+GENERATE_FILE="$RANCHER_DIR/generate.go"
+if [ ! -f "$GENERATE_FILE" ]; then
+  summary "  ⚠️  generate.go not found in branch '$TARGET_BRANCH' - cannot proceed"
+  exit 1
+fi
+
+# Extract first //go:generate directive
+GENERATE_CMD=$(grep -m 1 '^//go:generate' "$GENERATE_FILE" | sed 's|^//go:generate ||')
+if [ -z "$GENERATE_CMD" ]; then
+  summary "  ⚠️  No go:generate directive found in generate.go on branch '$TARGET_BRANCH' - cannot proceed"
+  exit 1
+fi
+
+# Run the generate command
+summary "  - Running: \`$GENERATE_CMD\`"
+if ! (cd "$RANCHER_DIR" && eval "$GENERATE_CMD"); then
+  summary "  ⚠️  go generate failed on branch '$TARGET_BRANCH'"
+  exit 1
+fi
+
+summary "  ✓ Successfully updated SCC Operator to v${TAG_NO_V}"
\ No newline at end of file
diff --git a/.github/workflows/push-to-rancher.yml b/.github/workflows/push-to-rancher.yml
index 8c64716..97a165d 100644
--- a/.github/workflows/push-to-rancher.yml
+++ b/.github/workflows/push-to-rancher.yml
@@ -45,12 +45,10 @@ jobs:
           owner: ${{ github.repository_owner }}
           repositories: rancher
 
-      - name: Push updates to rancher/rancher
+      - name: Create PRs to rancher/rancher
         if: github.repository == 'rancher/scc-operator'
-        env:
-          TAG: ${{ inputs.tag }}
-          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
-          SOURCE_REPO: ${{ github.repository }}
-          SCC_DIR: ${{ github.workspace }}
-          RANCHER_DIR: ${{ github.workspace }}/rancher-repo
-        run: ./.github/workflows/push-to-rancher/run-gha.sh
+        uses: rancher/ecm-distro-tools/actions/create-pr@master
+        with:
+          tag: ${{ inputs.tag }}
+          config-file: .github/pr-consumer-config.yaml
+          github-token: ${{ steps.generate_token.outputs.token }}
diff --git a/.github/workflows/push-to-rancher/README.md b/.github/workflows/push-to-rancher/README.md
deleted file mode 100644
index 1b6ec95..0000000
--- a/.github/workflows/push-to-rancher/README.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# push-to-rancher
-
-Automates opening PRs against [rancher/rancher](https://github.com/rancher/rancher) when a new SCC Operator release is published.
-
-## Workflows
-
-### `.github/workflows/push-to-rancher.yml`
-
-Standalone workflow that can be:
-- **Manually triggered** via `workflow_dispatch` with any tag (including RCs)
-- **Called** from other workflows (e.g., `release.yml` for stable releases)
-
-### `.github/workflows/release.yml`
-
-Automatically calls `push-to-rancher.yml` for stable releases only (after images are published and release is un-drafted).
-
-## How it works
-
-For each target Rancher branch:
-1. Clone rancher/rancher
-2. Update `defaultSccOperatorImage` in `build.yaml`
-3. Run `go generate ./pkg/...` to update generated files
-4. Commit changes
-5. Push branch and create PR
-
-## Target branches
-
-Edit `common.sh` and update `RANCHER_BRANCHES` array:
-
-```bash
-RANCHER_BRANCHES=(
-  "release/v2.12"
-  "release/v2.13"
-  "release/v2.14"
-  "release/v2.15"
-  "main"
-)
-```
-
-Add new Rancher versions as they're released. Remove EOL versions.
-
-## Local usage
-
-```bash
-./.github/workflows/push-to-rancher/run-local.sh \
-  --tag v0.4.2 \
-  --rancher-dir /path/to/rancher \
-  [--dry-run] \
-  [--remote upstream]
-```
-
-`--dry-run` runs all local git work (commits to your rancher clone) but skips push and PR creation.
-
-## Step sequence
-
-| Script | What it does |
-|---|---|
-| `update-build-yaml.sh` | Updates `defaultSccOperatorImage` in `build.yaml` using `yq` |
-| `create-prs.sh` | For each target branch: checkout, update, `go generate`, commit, push, create PR |
-| `run-gha.sh` | GHA entry point: validates image exists, clones rancher/rancher, calls create-prs.sh |
-| `run-local.sh` | Local entry point: parses args, sets up env, calls create-prs.sh |
-
-## Key env vars
-
-| Var | Description |
-|---|---|
-| `TAG` | SCC Operator tag (e.g. `v0.4.2`) |
-| `RANCHER_DIR` | Path to local rancher/rancher clone |
-| `RANCHER_REMOTE` | Remote name in `RANCHER_DIR` (default: `origin`) |
-| `DRY_RUN` | Set to `true` to skip push and PR creation |
-| `SOURCE_REPO` | Source repo for PR body (default: `rancher/scc-operator`) |
-
-## GHA prerequisites
-
-The workflow reads a GitHub App credential from Vault at:
-
-```
-secret/data/github/repo/rancher/scc-operator/github/app-credentials
-```
-
-The app must have write access to `rancher/rancher` to push branches and open PRs.
-
-## Error handling
-
-The workflow continues processing branches even if one fails. Failed branches are logged at the end of the run. Common failure modes:
-
-- Branch doesn't exist (e.g., when a new Rancher version isn't released yet)
-- `go generate` fails (rare, usually indicates build.yaml format change)
-- PR already exists for this tag on this branch
diff --git a/.github/workflows/push-to-rancher/common.sh b/.github/workflows/push-to-rancher/common.sh
deleted file mode 100755
index 131e96a..0000000
--- a/.github/workflows/push-to-rancher/common.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Shared setup for push-to-rancher scripts. Source this file: source "$(dirname "$0")/common.sh"
-
-# Determine SCC_DIR (scc-operator root) from this script's location
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-SCC_DIR="${SCC_DIR:-$(cd "$SCRIPT_DIR/../../.." && pwd)}"
-
-# Required: path to a local rancher/rancher clone
-RANCHER_DIR="${RANCHER_DIR:-}"
-
-# Remote name for rancher/rancher in RANCHER_DIR (may differ locally if using a fork)
-RANCHER_REMOTE="${RANCHER_REMOTE:-origin}"
-
-# Skip git commits, push, and PR creation when true
-DRY_RUN="${DRY_RUN:-false}"
-
-# Target branches in rancher/rancher to update
-RANCHER_BRANCHES=(
-  "release/v2.12"
-  "release/v2.13"
-  "release/v2.14"
-#  "release/v2.15"
-  "main"
-)
-
-# Docker registry to validate image existence
-IMAGE_REGISTRY="${IMAGE_REGISTRY:-docker.io}"
-IMAGE_REPO="${IMAGE_REPO:-rancher/scc-operator}"
-
-# Write to GitHub step summary if available, and always print to stdout
-summary() {
-  if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
-    echo "$@" >> "$GITHUB_STEP_SUMMARY"
-  fi
-  echo "$@"
-}
-
-require_var() {
-  local var="$1"
-  if [ -z "${!var:-}" ]; then
-    echo "ERROR: $var is required" >&2
-    exit 1
-  fi
-}
-
-require_rancher_dir() {
-  require_var RANCHER_DIR
-  if [ ! -d "$RANCHER_DIR" ]; then
-    echo "ERROR: RANCHER_DIR '$RANCHER_DIR' does not exist" >&2
-    exit 1
-  fi
-}
-
-# Validate that the SCC Operator image exists in the registry
-validate_image_exists() {
-  local tag="$1"
-  local full_image="${IMAGE_REGISTRY}/${IMAGE_REPO}:${tag}"
-
-  summary "- Validating image exists: \`$full_image\`"
-
-  if ! docker manifest inspect "$full_image" >/dev/null 2>&1; then
-    echo "ERROR: Image $full_image does not exist in registry" >&2
-    echo "ERROR: Cannot proceed with PR creation until image is published" >&2
-    exit 1
-  fi
-
-  summary "  ✓ Image validated"
-}
-
-# Commit all changes in RANCHER_DIR if any exist. Does nothing if tree is clean.
-commit_if_changed() {
-  local message="$1"
-  if git -C "$RANCHER_DIR" diff --quiet --exit-code && [ -z "$(git -C "$RANCHER_DIR" status --porcelain)" ]; then
-    return 0
-  fi
-  git -C "$RANCHER_DIR" add .
-  git -C "$RANCHER_DIR" commit -m "$message"
-}
diff --git a/.github/workflows/push-to-rancher/create-prs.sh b/.github/workflows/push-to-rancher/create-prs.sh
deleted file mode 100755
index 161ed19..0000000
--- a/.github/workflows/push-to-rancher/create-prs.sh
+++ /dev/null
@@ -1,154 +0,0 @@
-#!/usr/bin/env bash
-# Creates PRs to rancher/rancher branches with updated SCC Operator image.
-#
-# Required env vars:
-#   TAG          - SCC Operator tag (e.g. v0.4.2)
-#   RANCHER_DIR  - Path to rancher/rancher clone
-#   GH_TOKEN     - GitHub token for PR creation
-#   SOURCE_REPO  - Source repo for PR body (e.g. rancher/scc-operator)
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-require_var TAG
-require_var GH_TOKEN
-require_rancher_dir
-
-SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
-
-# Configure git in rancher clone
-git -C "$RANCHER_DIR" config user.name "github-actions[bot]"
-git -C "$RANCHER_DIR" config user.email "github-actions[bot]@users.noreply.github.com"
-
-summary ""
-summary "## Processing branches"
-
-FAILED_BRANCHES=()
-
-for TARGET_BRANCH in "${RANCHER_BRANCHES[@]}"; do
-  summary ""
-  summary "### Branch: \`$TARGET_BRANCH\`"
-
-  # Fetch and checkout target branch
-  if ! git -C "$RANCHER_DIR" fetch "$RANCHER_REMOTE" "$TARGET_BRANCH" 2>&1; then
-    summary "  ⚠️  Failed to fetch branch \`$TARGET_BRANCH\` - skipping"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (fetch failed)")
-    continue
-  fi
-
-  git -C "$RANCHER_DIR" checkout -B "$TARGET_BRANCH" "$RANCHER_REMOTE/$TARGET_BRANCH"
-
-  # Create feature branch
-  BRANCH_NAME="bot/scc-operator-${TAG}-$(date +%s)"
-  git -C "$RANCHER_DIR" checkout -b "$BRANCH_NAME"
-
-  # Update build.yaml
-  export TAG RANCHER_DIR
-  if ! bash "$SCRIPT_DIR/update-build-yaml.sh"; then
-    summary "  ⚠️  Failed to update build.yaml - skipping"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (update failed)")
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
-    continue
-  fi
-
-  # Run go generate (extract first directive from generate.go)
-  GENERATE_FILE="$RANCHER_DIR/generate.go"
-  if [ ! -f "$GENERATE_FILE" ]; then
-    summary "  ⚠️  generate.go not found - skipping"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (no generate.go)")
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
-    continue
-  fi
-
-  # Extract first //go:generate directive
-  GENERATE_CMD=$(grep -m 1 '^//go:generate' "$GENERATE_FILE" | sed 's|^//go:generate ||')
-  if [ -z "$GENERATE_CMD" ]; then
-    summary "  ⚠️  No go:generate directive found in generate.go - skipping"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (no generate directive)")
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
-    continue
-  fi
-
-  summary "  - Running: \`$GENERATE_CMD\`"
-  if ! (cd "$RANCHER_DIR" && eval "$GENERATE_CMD"); then
-    summary "  ⚠️  go generate failed - skipping"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (go generate failed)")
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
-    continue
-  fi
-
-  # Commit changes
-  COMMIT_MSG="Update SCC Operator to ${TAG}
-
-Automated update from ${SOURCE_REPO} release ${TAG}"
-
-  if ! commit_if_changed "$COMMIT_MSG"; then
-    summary "  ℹ️  No changes detected - skipping"
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    git -C "$RANCHER_DIR" branch -D "$BRANCH_NAME" || true
-    continue
-  fi
-
-  if [ "$DRY_RUN" = "true" ]; then
-    summary "  ✓ Changes committed (dry-run, not pushing)"
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    continue
-  fi
-
-  # Push branch
-  summary "  - Pushing branch \`$BRANCH_NAME\`"
-  if ! git -C "$RANCHER_DIR" push -u "$RANCHER_REMOTE" "$BRANCH_NAME"; then
-    summary "  ⚠️  Failed to push branch - skipping PR creation"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (push failed)")
-    git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-    continue
-  fi
-
-  # Create PR
-  summary "  - Creating PR..."
-
-  # Format branch name for title: strip "release/" prefix
-  BRANCH_LABEL="${TARGET_BRANCH#release/}"
-
-  PR_BODY="## Summary
-Update SCC Operator image to [\`${TAG}\`](https://github.com/${SOURCE_REPO}/releases/tag/${TAG})
-
-## Changes
-- Updated \`defaultSccOperatorImage\` in \`build.yaml\`
-- Ran \`go generate ./pkg/...\` to update generated files"
-
-  if gh pr create \
-    --repo rancher/rancher \
-    --base "$TARGET_BRANCH" \
-    --head "$BRANCH_NAME" \
-    --title "[${BRANCH_LABEL}] Update SCC Operator to ${TAG}" \
-    --body "$PR_BODY" \
-    --label "status/auto-created" 2>&1; then
-    summary "  ✓ PR created successfully"
-  else
-    summary "  ⚠️  Failed to create PR"
-    FAILED_BRANCHES+=("$TARGET_BRANCH (PR creation failed)")
-  fi
-
-  # Return to target branch for next iteration
-  git -C "$RANCHER_DIR" checkout "$TARGET_BRANCH"
-done
-
-summary ""
-summary "## Summary"
-
-if [ ${#FAILED_BRANCHES[@]} -eq 0 ]; then
-  summary "✅ All branches processed successfully"
-else
-  summary "⚠️  Some branches failed:"
-  for branch in "${FAILED_BRANCHES[@]}"; do
-    summary "  - $branch"
-  done
-  exit 1
-fi
diff --git a/.github/workflows/push-to-rancher/run-gha.sh b/.github/workflows/push-to-rancher/run-gha.sh
deleted file mode 100755
index cedde7f..0000000
--- a/.github/workflows/push-to-rancher/run-gha.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-# GHA entry point: orchestrates the full rancher/rancher update workflow.
-# Called from push-to-rancher.yaml after token generation.
-#
-# Required env vars (set by push-to-rancher.yaml or release.yml):
-#   TAG          - SCC Operator tag (e.g. v0.4.2)
-#   GH_TOKEN     - GitHub app token with access to rancher/rancher
-#   SOURCE_REPO  - source repo (github.repository)
-#   SCC_DIR      - path to scc-operator workspace ($GITHUB_WORKSPACE)
-#   RANCHER_DIR  - path to clone rancher/rancher into
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-require_var TAG
-require_var GH_TOKEN
-
-export SCC_DIR RANCHER_DIR DRY_RUN
-
-summary "## Push to rancher/rancher"
-summary "- Tag: \`$TAG\`"
-summary "- Target branches: \`${RANCHER_BRANCHES[*]}\`"
-summary ""
-
-# Validate image exists before proceeding
-validate_image_exists "$TAG"
-
-# Clone rancher/rancher
-summary "- Cloning rancher/rancher..."
-git clone "https://oauth2:${GH_TOKEN}@github.com/rancher/rancher.git" "$RANCHER_DIR"
-
-summary ""
-summary "## Creating PRs"
-
-export SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
-bash "$SCRIPT_DIR/create-prs.sh"
-
-summary ""
-summary "## Workflow Complete"
diff --git a/.github/workflows/push-to-rancher/run-local.sh b/.github/workflows/push-to-rancher/run-local.sh
deleted file mode 100755
index d492b62..0000000
--- a/.github/workflows/push-to-rancher/run-local.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/usr/bin/env bash
-# Local entry point for testing push-to-rancher workflow.
-#
-# Usage:
-#   ./run-local.sh --tag v0.4.2 --rancher-dir /path/to/rancher [--dry-run] [--remote upstream]
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-
-# Defaults
-TAG=""
-RANCHER_DIR=""
-DRY_RUN="false"
-RANCHER_REMOTE="origin"
-
-# Parse arguments
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    --tag)
-      TAG="$2"
-      shift 2
-      ;;
-    --rancher-dir)
-      RANCHER_DIR="$2"
-      shift 2
-      ;;
-    --dry-run)
-      DRY_RUN="true"
-      shift
-      ;;
-    --remote)
-      RANCHER_REMOTE="$2"
-      shift 2
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      echo "Usage: $0 --tag TAG --rancher-dir DIR [--dry-run] [--remote REMOTE]" >&2
-      exit 1
-      ;;
-  esac
-done
-
-# Validate required args
-if [ -z "$TAG" ]; then
-  echo "ERROR: --tag is required" >&2
-  exit 1
-fi
-
-if [ -z "$RANCHER_DIR" ]; then
-  echo "ERROR: --rancher-dir is required" >&2
-  exit 1
-fi
-
-if [ ! -d "$RANCHER_DIR" ]; then
-  echo "ERROR: rancher-dir '$RANCHER_DIR' does not exist" >&2
-  exit 1
-fi
-
-# Set up environment
-export TAG RANCHER_DIR RANCHER_REMOTE DRY_RUN
-export GH_TOKEN="${GH_TOKEN:-$(gh auth token)}"
-
-# Source common for validation functions
-source "$SCRIPT_DIR/common.sh"
-
-echo "## Push to rancher/rancher (local)"
-echo "- Tag: $TAG"
-echo "- Rancher dir: $RANCHER_DIR"
-echo "- Remote: $RANCHER_REMOTE"
-echo "- Dry run: $DRY_RUN"
-echo ""
-
-# Validate image exists
-validate_image_exists "$TAG"
-
-echo ""
-echo "## Creating PRs"
-
-export SOURCE_REPO="${SOURCE_REPO:-rancher/scc-operator}"
-bash "$SCRIPT_DIR/create-prs.sh"
-
-echo ""
-echo "## Workflow Complete"
-
-if [ "$DRY_RUN" = "true" ]; then
-  echo ""
-  echo "NOTE: This was a dry run. Changes were committed locally but not pushed."
-  echo "Review the commits in $RANCHER_DIR and run without --dry-run to push and create PRs."
-fi
diff --git a/.github/workflows/push-to-rancher/update-build-yaml.sh b/.github/workflows/push-to-rancher/update-build-yaml.sh
deleted file mode 100755
index 98a921c..0000000
--- a/.github/workflows/push-to-rancher/update-build-yaml.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# Updates defaultSccOperatorImage in build.yaml to the specified tag.
-#
-# Required env vars:
-#   TAG          - SCC Operator tag (e.g. v0.4.2)
-#   RANCHER_DIR  - Path to rancher/rancher clone
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$SCRIPT_DIR/common.sh"
-
-require_var TAG
-require_rancher_dir
-
-BUILD_YAML="$RANCHER_DIR/build.yaml"
-
-if [ ! -f "$BUILD_YAML" ]; then
-  echo "ERROR: build.yaml not found at $BUILD_YAML" >&2
-  exit 1
-fi
-
-# Remove leading 'v' if present for consistency
-TAG_NO_V="${TAG#v}"
-
-# Update the defaultSccOperatorImage field
-# Use yq for safe YAML editing
-yq eval ".defaultSccOperatorImage = \"rancher/scc-operator:v${TAG_NO_V}\"" -i "$BUILD_YAML"
-
-summary "  - Updated build.yaml: \`defaultSccOperatorImage: rancher/scc-operator:v${TAG_NO_V}\`"