ci-staging: enable app.ci cluster for dispatcher - #11
Open
Prucek wants to merge 385 commits into
Open
Conversation
* OTA-1921_add_5.0_yz_stream_jobs * generated jobs
…3285) Standardize report_template across ROSA CI jobs: - Use Go template whitespace trimming ({{- if, {{- else}}, {{- end}}) - Remove 🌈 and 🌋 emojis - Add consistent failure pings: <!subteam^S0B7Q6G7XQR> and <@U0AKNPBBVT7> - Place pings at the end of failure messages (after View logs link) Co-authored-by: redhat-chai-bot <redhat-chai-bot@users.noreply.github.com>
Enhancements to the downstream sync automation to provide better diagnostics when issues occur: 1. Merge Conflict Reporting: - Capture conflicted files when merge fails - Add conflict details to PR description with expandable sections - Skip go mod tidy and test sync when conflicts exist 2. Test List Validation: - Add validation after successful test annotation sync - Detect orphaned tests (in tests.go but don't exist) - Detect new tests (exist but not in tests.go) - Report mismatches in PR description with expandable sections 3. Enhanced PR Handling: - Mark PRs as draft when conflicts or test mismatches occur - Update PR title with failure types - Add /hold comment with resolution steps - Include all diagnostic info in PR body for easier triage Signed-off-by: Jamo Luhrsen <jluhrsen@gmail.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
…penshift#83189) Expand the pipeline_run_if_changed regex for e2e-aws-gatewayapi-conformance to cover all gateway-related controllers, vendor dependencies, and manifests: - pkg/operator/controller/gateway.*/ (was only gatewayapi/) - vendor/github.com/istio-ecosystem/sail-operator/ - vendor/sigs.k8s.io/gateway-api/ - manifests/ Also remove optional: true so the conformance test blocks merge when triggered. This matches the pattern used by openshift/api and cluster-authentication-operator for pipeline-triggered required tests.
…ef (openshift#83194) * oran-o2ims: add step-registry OWNERS and metadata Add missing OWNERS file at the oran-o2ims step-registry root directory and generate registry metadata for wait-for-tls-pods ref. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com> * CNF-26477: oran-o2ims: extract wait-for-tls-pods into step-registry ref Extract the ~80-line wait-for-server-pods inline script that was duplicated 4 times (on-demand and periodic jobs for main and release-4.22) into a shared step-registry ref at ci-operator/step-registry/oran-o2ims/wait-for-tls-pods/. The ref waits for the Inventory CR, discovers TLS-annotated services, verifies pod readiness and TLS secret presence, and fails the step on any error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com> --------- Signed-off-by: Raúl Hernández <rauherna@redhat.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: claude
OCP 5.0.0-ec.5 bumped the default operator catalog to redhat-operator-index:v5.0, which does not yet publish lvms-operator. The LVM jobs can no longer install the operator, so the periodic has failed on every run since Aug 4. Revert the LVM jobs bumped in PR 80185 back to 4.22 to restore coverage. Re-bump once LVMS is published to the v5.0 catalog.
) Add --jira=OCPBUGS and --jira=OPRUN to the OLMv0 bumper job to match the existing configuration in the OLMv1 bumper job. This causes the generated sync PRs to include Jira ticket references extracted from upstream commit messages in the PR title and body. Signed-off-by: Todd Short <tshort@redhat.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - tls-scanner-tool base image from OCP 4.22 - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR openshift#78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
…in image (openshift#82256) The terraform-validate test uses `from: src` which means terraform-init runs from scratch every time. Switch to `from: bin` to reuse the image built by binary_build_commands (which already runs make terraform-init), eliminating redundant provider and module downloads. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…bs (openshift#83300) Co-authored-by: redhat-chai-bot <redhat-chai-bot@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…alized b…" (openshift#83302) This reverts commit c899ded.
PR openshift#82884 added the westus3 e2e job only as a periodic, making it unreachable via gangway as a postsubmit. Add the matching postsubmit entry so the job can be triggered with job_execution_type=2.
…penshift#83311) Co-authored-by: openshift-ci[bot] <75433959+openshift-ci[bot]@users.noreply.github.com>
…#83260) The hypershift verification test needs to be vendor both the root and api modules.
…penshift#83181) * Add Jetson CI periodic jobs and fix JETSON_HOSTNAME to use IP - Fix JETSON_HOSTNAME from unresolvable FQDN to direct IP 10.26.2.85 - Add jp6-rhel9 and jp7-rhel10 variant configs with 4 weekly periodics each: - e2e-sanity, e2e-hardware, e2e-peripherals, e2e-bootc test suites - Staggered cron schedules to avoid overlap between variants - Add qe-rhel-jetson-e2e and qe-rhel-jetson-bootc-e2e workflows to step-registry - Regenerate periodic and presubmit Prow job YAML Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * qe-rhel-jetson: add --junit-xml to pytest step for dashboard integration Prow auto-uploads $ARTIFACT_DIR to GCS; adding --junit-xml makes per-test results available for the test matrix dashboard. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Sonia Garudi <sonia.garudi1@ibm.com>
…83268) Needed ahead of adding the AWS EFS CSI driver + a static job-configs-nfs PV/PVC to app.ci: cluster-manifest-verifier validates new resource kinds against the AppProject already synced on the live Argo CD server, so the whitelist has to land before the resources that need it.
e2etests is not available in all NetObserv jobs (e.g. web-console), which caused ImagePullBackOff on integration-tests. Co-authored-by: Cursor <cursoragent@cursor.com>
Use a private HOME directory that only our group can read. Use a tmp_bin_dir variable. Use install command to also set permissions. PowerVC-Tool now needs to run in the HOME directory. Add timeouts to curl commands.
* openshift-dpf: Include PR info in slack notification
Signed-off-by: Jose Castillo Lema <josecastillolema@gmail.com>
gitleaks.version: 8.30.0
gitleaks.check-secrets: ENABLED
* Address CodeRabbit comments
Signed-off-by: Jose Castillo Lema <josecastillolema@gmail.com>
gitleaks.version: 8.30.0
gitleaks.check-secrets: ENABLED
TLSAdherence is behind a FeatureGate that's disabled under the Default
FeatureSet (confirmed via the cluster's live FeatureGate status), so
apiserver.config.openshift.io/cluster silently drops
spec.tlsAdherence updates ("unknown field" warning) on this job's
cluster. That causes most of the secrets-store-csi-driver-operator's
TLS profile adherence e2e matrix to be skipped instead of actually
exercised.
Use FEATURE_SET: CustomNoUpgrade with FEATURE_GATES: ['TLSAdherence=true']
to enable just this gate, rather than TechPreviewNoUpgrade which would
turn on every Tech Preview feature at once.
…nshift#83318) Adds the standard Prow merge-automation config for this new repo: tide queries gated on approved+lgtm labels, branch protection requiring the rdoproject.org/github-check Zuul status, and the usual approve/lgtm/ plugins/triggers config. Signed-off-by: Martin Schuppert <mschuppert@redhat.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
) * app.ci: install AWS EFS CSI driver operator Adds the OLM aws-efs-csi-driver-operator subscription and its ClusterCSIDriver, plus a CredentialsRequest so app.ci's cloud-credential-operator (Mint mode, same as the existing EBS driver) auto-provisions the aws-efs-cloud-credentials secret. Requires openshift#83268 (whitelists these resource kinds in the app-ci ArgoCD AppProject) to merge first. * ci-staging: back job-configs-nfs on app.ci with AWS EFS The ci-staging Prow deployment on app.ci already mounts a PVC named job-configs-nfs, but nothing in git ever provisioned it. Bind a static PV/PVC to a newly created EFS filesystem so the volume is reproducible, and document the CSI driver's credentials secret. Requires openshift#83268 (whitelists PersistentVolume in the app-ci ArgoCD AppProject) to merge first.
…ift#83323) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…penshift#83295) Add the pull secret environment needed to configure guests and test setup for AutoNode/Karpenter e2e in the v2 framework. This change is backwards compatible with the existing tests.
…comps (openshift#83321) * initialize prow config for 5.1 release branches Signed-off-by: Coleen Iona Quadros <coleen.quadros27@gmail.com> * make update Signed-off-by: Coleen Iona Quadros <coleen.quadros27@gmail.com> * make update Signed-off-by: Coleen Iona Quadros <coleen.quadros27@gmail.com> --------- Signed-off-by: Coleen Iona Quadros <coleen.quadros27@gmail.com>
…penshift#82795) Enable approve, lgtm, and label plugins. Tide merge policy requires `approved` and `lgtm` labels on `main`. Co-Authored-By: Claude
Add `fips-check-image-scan` presubmit test to verify the `bgp-cloud-connector` image contains FIPS-compliant Go binaries using `check-payload scan local`. Co-Authored-By: Claude
Switch MDR and NHC main-branch CI configs from using the operator-sdk base image directly to using make bundle-run and make bundle-run-update from the src image. This aligns with the pattern used by FAR, SNR, SBR, and NMO, and uses the Makefile-managed operator-sdk version instead of the CI image's pinned 4.17 version. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Add an optional presubmit using the Managed HSM workflow so HyperShift PRs can validate changes with the PR-built test image. Commit-Message-Assisted-by: Claude (via Claude Code) Signed-off-by: Hilliary Lipsig <hlipsig@redhat.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…83494) Redistribute ROSA STS and HCP e2e periodic jobs with 20-minute spacing to avoid resource contention from simultaneous runs. The new schedule interleaves STS and HCP tests across versions: 00:10 - 4.21 STS 00:30 - 4.22 HCP 00:50 - 4.22 STS 01:10 - 4.19 HCP 01:30 - 4.19 STS 01:50 - 4.20 HCP 02:10 - 4.20 STS 02:30 - 4.21 HCP Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Remove FEATURE_SET: TechPreviewNoUpgrade and the -techpreview suffix from e2e-aws-ovn-dualstack-ipv4-primary and e2e-aws-ovn-dualstack-ipv6-primary jobs across installer main, release-4.23, release-5.0, and release-5.1 branches.
Wire rosa-gather-rhobs-logs as a best_effort post step to the rosa-aws-sts-conformance and rosa-aws-sts-byo-kms-oidc workflows, and rosa-gather-hcp-diagnostics (which includes MC-side log collection) to the rosa-aws-hcp-conformance workflow. The gather steps are placed as the first post step in each workflow so the cluster is still available when logs are collected. Using best_effort: true ensures that a failure in log gathering does not fail the overall job. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…o UBI 10 (openshift#83548) Signed-off-by: Adam D. Cornett <adc@redhat.com>
… support (openshift#83563) FVT jobs manage clusters internally in nested podman and do not write a cluster-id to ${SHARED_DIR}. Previously, the script would exit immediately with zero RHOBS log collection in this case. This change adds three modes: 1. Single cluster (existing behavior preserved): reads cluster-id from ${SHARED_DIR}/cluster-id, logs go to ${ARTIFACT_DIR}/rhobs-logs/ 2. Multi-cluster: reads additional IDs from ${SHARED_DIR}/cluster-ids (one per line), deduplicates, and iterates over each cluster. Logs go to ${ARTIFACT_DIR}/rhobs-logs/${CLUSTER_ID}/ 3. Fallback (no cluster-id): instead of exiting, skips MC-side logs (which require a cluster ID to resolve the management cluster) and collects all CS provisioning logs for the time window without a cluster-id filter. Logs go to ${ARTIFACT_DIR}/rhobs-logs/all-cs/ Also refactors the log collection into a collect_for_cluster() function and a query_loki() helper to reduce duplication, and updates the summary to use find for recursive log discovery across subdirectories. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…rod overlay branches (openshift#83442) Split the Tide query for openshift-online/hp-gitops-manifests into two: main and overlays/prod keep requiring approved+lgtm, while the remaining overlay promotion branches (overlays/int, int-next, prod-next, stage, stage-next) no longer require those labels since they are updated automatically by gitops-automator. The do-not-merge/* and needs-rebase guards are kept on both queries. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…cron jobs (openshift#83568) Remove hardcoded TEST_NAMESPACE: "5" from all 12 resolver concurrency cron jobs (gr/br/cr), letting the test code use its default value. Co-authored-by: Cursor <cursoragent@cursor.com>
…ift#83486) Co-authored-by: openshift-bot <openshift-bot@users.noreply.github.com>
…83571) Have git-sync write directly to the NFS PVC under /etc/jobs/git-synced/ instead of a separate emptyDir. All prow components now read both EFS plugin-written jobs and git-synced release-staging jobs from a single --job-config-path=/etc/jobs.
…bot PRs (openshift#83572) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove redundant required-status-check contexts (auto-derived via protect-tested-repos), standardize the openshift-bots push restriction and main branch protection across the four non-infra repos, and move gcp-hcp-ctl to the ocp/builder Go build_root to match gecko and kube-applier-gcp. Assisted-by: Claude:claude-opus-4-8
….1 --skip-periodics --future-release 4.23 --future-release 5.2 --confirm
…openshift-priv --only-org openshift --whitelist-file ./core-services/openshift-priv/_whitelist.yaml
…rator/jobs --registry ./ci-operator/step-registry
…/core-services/sanitize-prow-jobs/_config.yaml
Automate config brancher by auto-config-brancher job at Tue, 18 Aug 2026 08:11:02 UTC
…posync to CDN (openshift#83532) The 5.1 branching automation generated ocp-5.1-rhel9.repo with reposync S3 mirror URLs for external RHEL repos (baseos, appstream, nfv, highavailability, codeready-builder). But reposync is intentionally disabled for 5.x external repos, so the S3 mirror is empty, causing HTTP 404 errors in CI builds. Migrate these 14 repo sections to use Red Hat CDN URLs directly (with SSL client cert auth), matching how ocp-5.0-rhel9.repo is configured. ART plashet repos (server-ose, early-kernel) remain on reposync as intended. Fixes ironic/baremetal CI build failures caused by missing mtools and other baseos packages.
…openshift#83225) * Use FIPS VPN workflow for IBM Z TechPreview conformance-parallel jobs Enable FIPS validation on s390x TechPreviewNoUpgrade conformance-parallel periodics for 4.23, 5.0, and 5.1 by switching to openshift-e2e-libvirt-vpn-fips. * Rename TechPreview FIPS jobs to include fips in job name FIPS-enabled TechPreview conformance-parallel jobs must use the ocp-fips- prefix so origin job name validation passes when FIPS_ENABLED is set. * Drop unrelated periodics reordering from job rename Restore openshift-multiarch-main-periodics.yaml from main and apply only the three FIPS TechPreview job name/target renames. * Regenerate multiarch periodics with make jobs Prow job YAML must match ci-operator-prowgen output. Renaming the FIPS TechPreview jobs changes prowgen sort order, so the periodics file must be fully regenerated rather than edited in place.
…enshift#82879) Deploy a lightweight in-cluster NFS server backed by GCP PD with nfs-subdir-external-provisioner to provide an RWX StorageClass on GCP, avoiding Filestore's 1 TiB minimum volume size and ODF/Ceph. Set up NFS storage before installing CNV so CDI uses nfs-rwx from the start, avoiding a costly re-import when the default virt class changes. Patch the StorageProfile with RWX after CDI creates it. Use a 500Gi backing PD for adequate write throughput. Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
Remove app.ci from disabled_clusters so the scheduler can dispatch prowgen postsubmit jobs to app.ci where the EFS PVC is accessible. The staging-dispatcher routes prowgen jobs to app.ci and test jobs to build09.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Prucek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the Prucek org. You can then trigger verification by writing
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
app.cifromdisabled_clustersin staging prow config so the scheduler can dispatch prowgen postsubmit jobs to app.cijob-configs-nfs) is accessible🤖 Generated with Claude Code