updating operator-framework api w/ additional bundle validation

[acornett21]

Motivation

Over time and historically, the catalogs produced by any/all of are tooling, contain bundles that:

• break for all customers
• break for some customers
• break the OCP UI

With that we try to improve the validation overtime as more and more sharp edges are found. One such incident was found where a partners relatedImages section contained an invalid sha256 value, casing oc-mirror of the catalog to be broken. Luckly, for that instance, the bundle in question was the first version that the operator author had released, so a removal/fix was able to be made.

During that remove/fix operator-framework/api was updated with further bundle validation to catch these types of issues:

• DependsOn: add bundle relatedimage image pullspec validation operator-framework/api#475

Testing

This PR points to a fork/commit of operator-framework/api, below is what would be outputted for an incorrect bundle in the catalog.

PFLT_INDEXIMAGE=registry.redhat.io/redhat/certified-operator-index:v4.20 preflight check operator check operator registry.connect.redhat.com/nvidia/gpu-operator-bundle:v23.3.0

...
time="2026-02-16T10:41:18-07:00" level=error msg="Error: Value spec.relatedImages[3].image: relatedImages[3] has an invalid image pullspec \"nvcr.io/nvidia/k8s/container-toolkit@sha256:489125ceae5864280e4d6a9ab52ab0f650b3179349a7298c4a204feb60b661a\": invalid checksum digest length" check=ValidateOperatorBundle error="validate operator bundle error"
time="2026-02-16T10:41:18-07:00" level=info msg="check completed" check=ValidateOperatorBundle result=FAILED

[coveralls]

coverage: 84.053%. remained the same
when pulling 57e747e on acornett21:update_of_api
into 5aed1c7 on redhat-openshift-ecosystem:main.

[dcibot]

from change #1370:

• SUCCESS https://www.distributed-ci.io/jobs/fd0a72c5-928a-4dc8-be57-d5627b9d0ba0/jobStates

[dcibot]

from change #1370:

• SUCCESS https://www.distributed-ci.io/jobs/162965fe-c852-4a88-ac32-988f8389fe96/jobStates

[dcibot]

from change #1370:

• SUCCESS https://www.distributed-ci.io/jobs/4218a4d5-5fa6-416f-9345-10b849f7f2ec/jobStates

[github-actions]

## 📋 Review Summary

This Pull Request updates multiple dependencies, particularly bumping operator-framework/api to v0.40.0 and adding a replace directive for testing additional bundle validation. The changes to go.mod and go.sum appear correct for a draft or testing context, but introduce a supply chain issue if merged as-is.

🔍 General Feedback

• Dependency Updates: The general dependency version bumps and indirect module additions in go.mod and go.sum look standard and align with expected Go module management practices.
• Testing Context: As mentioned in the PR description, if this branch is primarily for testing the output against a specific fork, consider converting the PR to a Draft to clearly signal that it is not yet ready to be merged.

[bcrochet]

/retest

[dcibot]

from change #1370:

• SUCCESS https://www.distributed-ci.io/jobs/27f6f80e-926c-47c8-b90f-0c913b0fb1d4/jobStates

[bcrochet]

There's a bit more here than just operator-framework api... I'm fine with that, as long as we've validated that things like graphql and go-containerregistry haven't had breaking changes.

/lgtm

[acornett21]

@bcrochet I thought I had added those as a separate commit, but since I did not I just rolled them back to keep this PR clean. I'll update the other things in another PR.

[dcibot]

from change #1370:

• SUCCESS https://www.distributed-ci.io/jobs/0d24ed62-2881-4584-a020-8eba60fe1251/jobStates

[bcrochet]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: acornett21, bcrochet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [acornett21,bcrochet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment