@@ -0,0 +1,53 @@
+# Midstream cluster-free deploy contract checks. Runs the digest/Helm
+# regression suite for the Quay deploy script without a cluster, so PRs
+# touching the deploy path get automated validation. Kept separate from
+# branch-checks.yml so ODH does not depend on NVIDIA self-hosted runners.
+
+name: ODH Deploy Contract
+
+on:
+  pull_request:
+    paths:
+      - odh/scripts/**
+      - e2e/support/gateway-common.sh
+      - e2e/rust/tests/odh/tier_plan.py
+      - e2e/rust/tests/odh/tiers.toml
+      - deploy/helm/openshell/ci/values-openshift-e2e.yaml
+      - odh/values-openshift-e2e.yaml
+      - deploy/docker/Dockerfile.konflux.e2e-odh
+      - deploy/konflux/e2e-odh/**
+      - renovate.json
+      - tasks/test-odh.toml
+      - .github/workflows/odh-deploy-contract.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: odh-deploy-contract-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy-contract:
+    name: Cluster-free deploy script contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # The deploy plan resolver imports tomllib (Python 3.11+); pin the
+      # interpreter so the check does not depend on the runner default.
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Run the deploy digest contract suite
+        run: bash odh/scripts/tests/test-openshell-deploy-from-quay.sh
+
+      - name: Verify generic-fetcher synchronization
+        run: |
+          python3 deploy/konflux/e2e-odh/sync-generic-fetcher.py --check
+          python3 deploy/konflux/e2e-odh/sync-generic-fetcher_test.py
@@ -13,23 +13,33 @@
 # environment with awk. Every RUN must start at column 0 with `RUN ` and
 # use `&& \` continuations.
 
+# Tool versions are the source of truth for generic-fetcher.yaml. Renovate
+# updates annotated versions in both files; then run
+# `deploy/konflux/e2e-odh/sync-generic-fetcher.py --update all` to refresh the
+# amd64 and arm64 checksums.
+# renovate: datasource=docker depName=quay.io/openshift-release-dev/ocp-release extractVersion=^(?<version>4\.\d+\.\d+)-x86_64$
 ARG OC_VERSION=4.20.0
+# renovate: datasource=github-releases depName=helm/helm extractVersion=^v(?<version>.+)$
 ARG HELM_VERSION=4.2.0
+# renovate: datasource=github-releases depName=nextest-rs/nextest extractVersion=^cargo-nextest-(?<version>.+)$
 ARG NEXTEST_VERSION=0.9.143
+# renovate: datasource=github-releases depName=astral-sh/uv
+ARG UV_VERSION=0.13.1
 
 FROM registry.redhat.io/rust-builder-image/rust-rhel9:1.99.0@sha256:b00aaa63f7d6f5b857c170e4aed9d77f013f507ba97e72ebfcac48a7d3760310 AS builder
 
 # The builder image runs as 1001 and already ships gcc, gcc-c++, make,
-# cmake, openssl-devel, git and tar, so no dnf step. Root writes /usr/local/bin.
+# cmake, openssl-devel, git and tar. Install Python for the locked E2E test
+# environment; root writes /usr/local/bin.
 USER 0
 
 ARG NEXTEST_VERSION
+ARG UV_VERSION
 ARG TARGETARCH
 ARG OPENSHELL_VERSION=""
 
-RUN dnf install -y --nodocs --setopt=install_weak_deps=0 python3.11 && \
-    dnf clean all
-
+RUN dnf install -y --nodocs --setopt=install_weak_deps=0 python3.11 \
+    && dnf clean all
 RUN RUST_ARCH=$(case "${TARGETARCH}" in amd64) echo x86_64;; arm64) echo aarch64;; *) exit 1;; esac) && \
     RUST_TRIPLE="${RUST_ARCH}-unknown-linux-gnu" && \
     tar xzf "/cachi2/output/deps/generic/cargo-nextest-${NEXTEST_VERSION}-${RUST_TRIPLE}.tar.gz" \
@@ -64,7 +74,7 @@ RUN VER="${OPENSHELL_VERSION#v}" && \
         --archive-file /opt/openshell/e2e-odh.tar.zst
 
 RUN UV_ARCH=$(case "${TARGETARCH}" in amd64) echo x86_64;; arm64) echo aarch64;; *) exit 1;; esac) && \
-    tar xzf "/cachi2/output/deps/generic/uv-${UV_ARCH}-unknown-linux-gnu.tar.gz" \
+    tar xzf "/cachi2/output/deps/generic/uv-${UV_VERSION}-${UV_ARCH}-unknown-linux-gnu.tar.gz" \
         -C /tmp && \
     install -m 0555 "/tmp/uv-${UV_ARCH}-unknown-linux-gnu/uv" /usr/local/bin/uv
 COPY odh/requirements.txt /tmp/requirements.txt
@@ -77,6 +87,7 @@ FROM registry.access.redhat.com/ubi9/ubi:9.8@sha256:25a147defd01e19674714f55d175
 
 ARG OC_VERSION
 ARG HELM_VERSION
+ARG UV_VERSION
 ARG TARGETARCH
 
 RUN dnf install -y --nodocs --setopt=install_weak_deps=0 \
@@ -101,7 +112,7 @@ RUN OC_ARCH=$(case "${TARGETARCH}" in amd64) echo amd64;; arm64) echo arm64;; *)
     tar xzf "/cachi2/output/deps/generic/helm-v${HELM_VERSION}-linux-${OC_ARCH}.tar.gz" \
         -C /tmp/helm && \
     install -m 0555 "/tmp/helm/linux-${OC_ARCH}/helm" /usr/local/bin/helm && \
-    tar xzf "/cachi2/output/deps/generic/uv-${UV_ARCH}-unknown-linux-gnu.tar.gz" \
+    tar xzf "/cachi2/output/deps/generic/uv-${UV_VERSION}-${UV_ARCH}-unknown-linux-gnu.tar.gz" \
         -C /tmp && \
     install -m 0555 "/tmp/uv-${UV_ARCH}-unknown-linux-gnu/uv" /usr/local/bin/uv
 
@@ -115,6 +126,7 @@ COPY --chown=1001:1001 .config/ .config/
 COPY --chown=1001:1001 crates/ crates/
 COPY --chown=1001:1001 proto/ proto/
 COPY --from=builder --chown=1001:1001 /home/odh/openshell-e2e-odh/python/ python/
+COPY --chown=1001:1001 sdk/conformance/ sdk/conformance/
 COPY --chown=1001:1001 providers/ providers/
 COPY --chown=1001:1001 examples/ examples/
 COPY --chown=1001:1001 e2e/ e2e/
 
@@ -63,3 +63,14 @@ The image name is `odh-openshell-e2e`; Konflux automation generates the
 Tekton YAML files.
 Before merging, validate the local hermetic build on both `linux/amd64` and
 `linux/arm64` using `PLATFORM` with `deploy/konflux/build-local.sh e2e-odh`.
+
+`sync-generic-fetcher.py` keeps the Dockerfile tool versions and the Hermeto
+generic artifacts consistent. `--check` (offline) verifies that the URLs and
+filenames derive from the Dockerfile versions and that checksums are
+well-formed. `--update <tool>` recomputes checksums by downloading both
+architectures concurrently, retrying transient failures and comparing each
+hash with the publisher-provided checksum sidecar. This catches corruption or
+inconsistent responses, but the sidecar is not an independent trust root
+because it comes from the same origin as the artifact. Run it after a Renovate
+bump, as the PR note instructs. Nothing is written unless every download
+succeeds and matches its sidecar.
@@ -5,12 +5,13 @@
 metadata:
   version: "1.0"
 artifacts:
-  - download_url: https://github.com/astral-sh/uv/releases/download/0.11.29/uv-x86_64-unknown-linux-gnu.tar.gz
-    checksum: "sha256:04f8b82f5d47f0512dcd32c67a4a6f16a0ea27c81537c338fd0ad6b23cebe829"
-    filename: uv-x86_64-unknown-linux-gnu.tar.gz
-  - download_url: https://github.com/astral-sh/uv/releases/download/0.11.29/uv-aarch64-unknown-linux-gnu.tar.gz
-    checksum: "sha256:94500fb064ae3c971a873cba64d94694c50677e0a4dbf78735c80509e7429919"
-    filename: uv-aarch64-unknown-linux-gnu.tar.gz
+  - download_url: https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-gnu.tar.gz
+    checksum: "sha256:eadd9d27c134ab5ac1ffd4473b97a741407f3ea238288f03121fc4deddf90220"
+    filename: uv-0.13.1-x86_64-unknown-linux-gnu.tar.gz
+  - download_url: https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-gnu.tar.gz
+    checksum: "sha256:9041c73c99fdc5892cf128140beb354eca9231d502068cc36e6cb53a8e59ad14"
+    filename: uv-0.13.1-aarch64-unknown-linux-gnu.tar.gz
+
   - download_url: https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.20.0/openshift-client-linux-amd64-rhel9-4.20.0.tar.gz
     checksum: "sha256:dbc11aa32c8fa967c47c46900c524798b782b355615c9ca8ec2bbba647850420"
     filename: openshift-client-linux-amd64-rhel9-4.20.0.tar.gz
 
@@ -23,6 +23,7 @@ packages:
   - libxslt
   - util-linux
   - openssh-clients
+  - openssl
 arches:
   - x86_64
   - aarch64