Add explicit branch protection for openshift/origin active branches

[redhat-chai-bot]

Summary

Adds explicit branch-protection configuration for openshift/origin's active branches (main, release-4.21 through release-5.1) in the Prow config.

Problem

Origin's _prowconfig.yaml has no branch-protection section — it relies entirely on the org-wide protect-tested-repos: true default. Combined with the global Tide setting from-branch-protection: true (which derives required CI contexts from GitHub branch protection), this means the second-stage pipeline-controlled e2e jobs are not listed as required status checks. If the pipeline controller ever fails to trigger them, PRs can merge silently without any e2e testing.

This was observed on release branches where PRs merged without any e2e jobs running (see openshift/origin#31353, openshift/origin#31406).

Fix

Adds a branch-protection section that explicitly lists all required CI contexts for each active branch:

First-stage (5 jobs, always_run: true):

• ci/prow/go-verify-deps, ci/prow/lint, ci/prow/unit, ci/prow/verify, ci/prow/verify-deps

Second-stage (15 jobs, always_run: false + optional: false, pipeline-controlled):

• ci/prow/e2e-aws-csi, ci/prow/e2e-aws-jenkins, ci/prow/e2e-aws-ovn-fips, ci/prow/e2e-aws-ovn-image-registry, ci/prow/e2e-aws-ovn-microshift, ci/prow/e2e-aws-ovn-microshift-serial, ci/prow/e2e-aws-ovn-serial, ci/prow/e2e-gcp-csi, ci/prow/e2e-gcp-ovn, ci/prow/e2e-gcp-ovn-builds, ci/prow/e2e-gcp-ovn-image-ecosystem, ci/prow/e2e-gcp-ovn-upgrade, ci/prow/e2e-metal-ipi-ovn-ipv6, ci/prow/e2e-vsphere-ovn, ci/prow/e2e-vsphere-ovn-upi

All 6 active branches share the identical set of 20 required contexts.

Excluded: verify-image-manifest-lists — despite always_run defaulting to true, it sets run_if_changed (conditional trigger). Requiring a conditional context in branch protection would block every PR that doesn't touch its trigger files.

Also adds required_pull_request_reviews.required_approving_review_count: 1 for all active branches.

Related

• Companion PR: Enable pipeline controller for openshift/origin release branches #82264 (enables pipeline controller for origin release branches)

---

@smg247 requested in Slack thread

Summary by CodeRabbit

• Adds explicit branch protection for openshift/origin’s main and release-4.21 through release-5.1 branches.
• Requires one approving review and 20 CI status checks, including pipeline-controlled second-stage e2e jobs, before merging.
• Ensures required e2e validation is enforced independently of organization-wide and global Tide defaults.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign xueqzhan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/openshift/origin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@redhat-chai-bot: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[smg247]

/hold I don't think this is right

[redhat-chai-bot]

Thanks for the feedback @smg247 — could you elaborate on what you think is incorrect here? Happy to adjust the approach.

For context: the goal is to ensure that the second-stage pipeline-controlled e2e jobs (the always_run: false + optional: false jobs) are listed in required_status_checks so that Tide enforces them for merge. Without this, PRs on release branches were merging without any e2e tests running — even after the pipeline controller is enabled for these branches (companion PR #82264).

Is the concern about:

• Which contexts are listed?
• The approach of using explicit branch protection for this?
• Something else?

[openshift-ci]

@redhat-chai-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/config	36f187d	link	true	/test config

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f81fd9bb-f579-48d2-9872-71cc0d0ec634

📥 Commits

Reviewing files that changed from the base of the PR and between 0bfb11e and 36f187d.

📒 Files selected for processing (1)

• core-services/prow/02_config/openshift/origin/_prowconfig.yaml

---

Walkthrough

Branch protection configuration for openshift/origin now requires one approving review and specified status checks on main and release branches, with enforcement enabled.

Changes

Origin branch protection

Layer / File(s)	Summary
Branch protection rules core-services/prow/02_config/openshift/origin/_prowconfig.yaml	Adds one required approving review and fixed required status-check contexts for main and release-4.21 through release-5.1, with protect: true enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: approved

Suggested reviewers: neisw

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding explicit branch protection for openshift/origin active branches.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo tests were added or modified; the PR only changes a Prow YAML config, so stable test-title rules are unaffected.
Test Structure And Quality	✅ Passed	PR only changes Prow config in _prowconfig.yaml; no Ginkgo test files or test code were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	Only _prowconfig.yaml changed; no Ginkgo test files or test bodies were added or modified, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates prow branch-protection YAML; no new Ginkgo e2e tests were added, so SNO compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a Prow branch-protection YAML changed; no deployment manifests, controllers, or scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	PR only changes a Prow YAML config; no main/suite code or stdout writes were added, so the stdout contract isn’t implicated.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only _prowconfig.yaml changed; no Go/e2e test code was added, so IPv4/IPv6 compatibility checks are not applicable.
No-Weak-Crypto	✅ Passed	The PR only edits Prow branch-protection YAML; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons are present.
Container-Privileges	✅ Passed	Only a Prow branch-protection YAML changed; no container/K8s manifests or privilege fields appear in the diff.
No-Sensitive-Data-In-Logs	✅ Passed	Only branch-protection YAML changed; it adds required contexts and review counts, with no logging or sensitive-data strings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}