feat: add AutoML and AutoRAG components to mapping

- AutoML: maps to pipelines-components upstream/midstream/downstream chain
  with container managed-open-data-hub/odh-automl-rhel9
- AutoRAG: same pipelines-components chain plus IBM/ai4rag as upstream-only
  Python package (excluded from automation — CVEs manifest as container
  CVEs in pipelines-components, fix by updating ai4rag version there)
- Both confirmed as distinct Jira component names (AutoML, AutoRAG)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: vmrh21

workflows/cve-fixer/component-repository-mappings.json

@@ -791,6 +791,103 @@
           }
         }
       }
+    },
+    "AutoML": {
+      "container_to_repo_mapping": {
+        "managed-open-data-hub/odh-automl-rhel9": "red-hat-data-services/pipelines-components"
+      },
+      "repositories": {
+        "kubeflow/pipelines-components": {
+          "github_url": "https://github.com/kubeflow/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [],
+          "branch_strategy": "Fix in main. No formal release branching documented.",
+          "repo_type": "upstream",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "None"
+          }
+        },
+        "opendatahub-io/pipelines-components": {
+          "github_url": "https://github.com/opendatahub-io/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [],
+          "branch_strategy": "Fork of upstream kubeflow/pipelines-components.",
+          "repo_type": "midstream",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "None"
+          }
+        },
+        "red-hat-data-services/pipelines-components": {
+          "github_url": "https://github.com/red-hat-data-services/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [
+            "rhoai-3.4"
+          ],
+          "branch_strategy": "Fork of midstream. RHOAI release branches follow pattern rhoai-X.Y.",
+          "repo_type": "downstream",
+          "notes": "Monorepo containing both AutoML (components/automl/) and AutoRAG (components/autorag/) components.",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "rhoai-3.4"
+          }
+        }
+      }
+    },
+    "AutoRAG": {
+      "container_to_repo_mapping": {},
+      "repositories": {
+        "kubeflow/pipelines-components": {
+          "github_url": "https://github.com/kubeflow/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [],
+          "branch_strategy": "Fix in main. No formal release branching documented.",
+          "repo_type": "upstream",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "None"
+          }
+        },
+        "opendatahub-io/pipelines-components": {
+          "github_url": "https://github.com/opendatahub-io/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [],
+          "branch_strategy": "Fork of upstream kubeflow/pipelines-components.",
+          "repo_type": "midstream",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "None"
+          }
+        },
+        "red-hat-data-services/pipelines-components": {
+          "github_url": "https://github.com/red-hat-data-services/pipelines-components",
+          "default_branch": "main",
+          "active_release_branches": [
+            "rhoai-3.4"
+          ],
+          "branch_strategy": "Fork of midstream. RHOAI release branches follow pattern rhoai-X.Y.",
+          "repo_type": "downstream",
+          "notes": "Monorepo containing both AutoML (components/automl/) and AutoRAG (components/autorag/) components.",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "rhoai-3.4"
+          }
+        },
+        "IBM/ai4rag": {
+          "github_url": "https://github.com/IBM/ai4rag",
+          "default_branch": "main",
+          "active_release_branches": [],
+          "branch_strategy": "Python package upstream. CVEs in ai4rag manifest as container CVEs in pipelines-components \u2014 fix by updating ai4rag version there.",
+          "repo_type": "upstream",
+          "notes": "No containerization \u2014 distributed as a Python package. No ODH/RHDS forks exist. Excluded from automation; track upstream releases and update dependency version in pipelines-components.",
+          "cve_fix_workflow": {
+            "primary_target": "main",
+            "backport_targets": "N/A",
+            "excluded_from_automation": true
+          }
+        }
+      }
     }
   },
   "metadata": {