tide: enable github_merge_blocks_policy for repos with recent merge failures

[Prucek]

Summary

• Configures github_merge_blocks_policy: block for repos that have had merge failures in the last 30 days (sourced from tide-history?state=failure)
• Uses the new Tide feature from tide: add configurable GitHub merge blocks enforcement kubernetes-sigs/prow#579 to respect GitHub's mergeStateStatus and prevent Tide from attempting to merge PRs blocked by branch protection rules, rulesets, or required reviews
• Policy set per-repo (not globally) to limit blast radius

/hold

Summary by CodeRabbit

This PR configures Tide to block merge attempts for 71 repositories with recent merge failures. The change updates core-services/prow/02_config/_config.yaml and sets github_merge_blocks_policy: block for each affected repository.

What this does:

• Makes Tide honor GitHub mergeStateStatus through the Prow feature from kubernetes-sigs/prow#579
• Prevents Tide from attempting merges blocked by branch protection rules, rulesets, or required reviews
• Limits the policy to specific repositories to reduce impact on other repositories

Affected repositories include:

• OpenShift core repositories
• OpenStack Kubernetes operators
• Red Hat AppStudio infrastructure repositories
• Container and migration tool repositories
• Operator Framework repositories
• OpenDataHub, Red Hat Developer Hub, Stolostron, and other ecosystem repositories

The configuration requires a Prow bump in ci-tools to enable the Tide feature.

[coderabbitai]

Walkthrough

This PR extends tide.github_merge_blocks_policy with 63 repository entries. Each entry assigns the block policy.

Changes

Tide merge-blocking policy

Layer / File(s)	Summary
Repository policy entries core-services/prow/02_config/_config.yaml	Adds merge-blocking policy entries for repositories across containers, OpenShift, OpenStack, operator-framework, Red Hat, and related organizations.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related issues

• Support github_merge_blocks_policy in per-repo supplemental prow config (_prowconfig.yaml) ci-tools#5353: Both changes configure per-repository entries for tide.github_merge_blocks_policy.

Possibly related PRs

• openshift/release#82902: Both PRs add repositories with the block value to core-services/prow/02_config/_config.yaml.

Suggested reviewers: pruan-rht, smg247

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only one YAML configuration file with repository policy entries; it adds no Ginkgo tests or test titles.
Test Structure And Quality	✅ Passed	The PR changes only core-services/prow/02_config/_config.yaml; it adds no Ginkgo tests or cluster operations to review against these requirements.
Microshift Test Compatibility	✅ Passed	The commit changes only core-services/prow/02_config/_config.yaml and adds no Ginkgo tests or test declarations, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only one YAML configuration file and adds no Ginkgo tests or test code, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The only modified file is the Tide YAML config, adding per-repository github_merge_blocks_policy: block entries; no deployment, operator, controller, or scheduling constraints changed.
Ote Binary Stdout Contract	✅ Passed	The patch changes only one YAML Tide configuration file; it adds repository policy entries and no OTE binary or process-level stdout/logging code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only one YAML file, adding 63 per-repository Tide policy entries; it adds no Ginkgo e2e tests, IPv4 logic, or external connectivity.
No-Weak-Crypto	✅ Passed	The modified file is a YAML configuration file. It contains no weak cryptographic algorithms (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB), custom crypto implementations, or secret comparisons.
Container-Privileges	✅ Passed	The only change adds github_merge_blocks_policy: block entries to a Prow config; no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation settings are added.
No-Sensitive-Data-In-Logs	✅ Passed	The only change adds repository names mapped to block in _config.yaml; it adds no logging code or passwords, tokens, API keys, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Tide policy change and its purpose of addressing recent merge failures.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Prucek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/OWNERS [Prucek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-ci]

@Prucek: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@Prucek: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[kaovilai]

Be mindful that kubernetes-sigs/prow#841 could happen. In which case, you need to trigger manually the test if it got stuck in pending or did not start a job too long, and it's a required status check.