rh-ecosystem-edge/ibm-ci: onboard IBM Spyre operator CI to Prow - #82309
rh-ecosystem-edge/ibm-ci: onboard IBM Spyre operator CI to Prow#82309onaim500 wants to merge 6 commits into
Conversation
Adds CI configuration for rh-ecosystem-edge/ibm-ci with: - Image build from Containerfile - deploy-spyre-operator test (manual trigger, SSH to IBM hardware) - Prow plugins and Tide merge automation - OWNERS files for team reviewers MGMT-24319 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
@onaim500: GitHub didn't allow me to request PR reviews from the following users: ItzikEzra-rh. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
WalkthroughAdds IBM CI repository ownership, an OpenShift CI-operator build and deployment test, a registered deployment step, and Prow plugin and Tide configuration for ChangesIBM CI onboarding
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Test as deploy-spyre-operator
participant Step as ibm-ci-deploy
participant Credentials as IBM CI credentials
participant Ansible as Ansible
Test->>Step: Run deployment step
Step->>Credentials: Read SSH key and pull secret
Step->>Step: Generate inventory from IBM_HOST
Step->>Ansible: Run make -C ansible install
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: onaim500 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
approved
Extract inline deploy commands to step-registry ref ibm-ci-deploy for reusability and consistency with DPF pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/rh-ecosystem-edge/ibm-ci/rh-ecosystem-edge-ibm-ci-main.yaml`:
- Around line 18-53: Restrict the credential-bearing deploy-spyre-operator job
from untrusted pull-request execution by removing it from the pull-ci presubmit
configuration and moving it to a trusted postsubmit or branch job. Preserve the
deployment steps only where the ibm-ci credential mount is permitted, or replace
that mount with short-lived, narrowly scoped access.
In `@core-services/prow/02_config/rh-ecosystem-edge/ibm-ci/_prowconfig.yaml`:
- Around line 6-12: Add do-not-merge/product-pre-release to the missingLabels
list in the Prow configuration, matching the standard merge-blocking policy used
by comparable repositories. Preserve all existing labels and ordering.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0e673a9b-4b17-49a0-9b25-3933ec8af824
⛔ Files ignored due to path filters (2)
ci-operator/jobs/rh-ecosystem-edge/ibm-ci/OWNERSis excluded by!ci-operator/jobs/**ci-operator/jobs/rh-ecosystem-edge/ibm-ci/rh-ecosystem-edge-ibm-ci-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (4)
ci-operator/config/rh-ecosystem-edge/ibm-ci/OWNERSci-operator/config/rh-ecosystem-edge/ibm-ci/rh-ecosystem-edge-ibm-ci-main.yamlcore-services/prow/02_config/rh-ecosystem-edge/ibm-ci/_pluginconfig.yamlcore-services/prow/02_config/rh-ecosystem-edge/ibm-ci/_prowconfig.yaml
| missingLabels: | ||
| - backports/unvalidated-commits | ||
| - do-not-merge/hold | ||
| - do-not-merge/invalid-owners-file | ||
| - do-not-merge/work-in-progress | ||
| - jira/invalid-bug | ||
| - needs-rebase |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Block merges for do-not-merge/product-pre-release.
The Tide query omits this standard merge-blocking label, so a PR marked as a product pre-release could merge once it has approved and lgtm. Add it unless this repository is intentionally exempt.
This aligns with the existing policy in core-services/prow/02_config/integr8ly/integreatly-operator/_prowconfig.yaml.
Proposed fix
- do-not-merge/invalid-owners-file
+ - do-not-merge/product-pre-release
- do-not-merge/work-in-progress📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| missingLabels: | |
| - backports/unvalidated-commits | |
| - do-not-merge/hold | |
| - do-not-merge/invalid-owners-file | |
| - do-not-merge/work-in-progress | |
| - jira/invalid-bug | |
| - needs-rebase | |
| missingLabels: | |
| - backports/unvalidated-commits | |
| - do-not-merge/hold | |
| - do-not-merge/invalid-owners-file | |
| - do-not-merge/product-pre-release | |
| - do-not-merge/work-in-progress | |
| - jira/invalid-bug | |
| - needs-rebase |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-services/prow/02_config/rh-ecosystem-edge/ibm-ci/_prowconfig.yaml`
around lines 6 - 12, Add do-not-merge/product-pre-release to the missingLabels
list in the Prow configuration, matching the standard merge-blocking policy used
by comparable repositories. Preserve all existing labels and ordering.
- Add StrictHostKeyChecking=no for CI environment SSH - Inject pull secret via --extra-vars ocp_pull_secret_file (playbook pre_tasks validates this variable is set) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ERBOSE Append ocp_pull_secret_file to group_vars/all.yml instead of overloading the Makefile VERBOSE variable with --extra-vars. This uses Ansible's built-in variable mechanism properly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
/test images |
|
@onaim500: The specified target(s) for The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Add OWNERS files to core-services/prow/02_config and step-registry parent directories. Remove ItzikEzra-rh (not an openshift org member) from all OWNERS files to fix CI validation failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
openshift-ci
Bot
removed
the
do-not-merge/invalid-owners-file
- Add step-registry metadata JSON for ibm-ci-deploy ref - Add cluster fields to presubmit job definitions - Add external_plugins (needs-rebase, refresh, cherrypick, etc.) and triggers config to _pluginconfig.yaml matching org standard Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@onaim500: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
rh-ecosystem-edge/ibm-cito OpenShift CI (Prow)deploy-spyre-operatortest: SSH to IBM Spyre hardware, deploy via Ansible (manual trigger with/test deploy-spyre-operator)Jira
MGMT-24319
Test plan
/test images/test deploy-spyre-operator(requires Vault secretibm-cisynced totest-credentialsnamespace)/cc @aopincar @ItzikEzra-rh
Summary by CodeRabbit
rh-ecosystem-edge/ibm-cito OpenShift CI with a Containerfile-based image build.deploy-spyre-operatortest for IBM Spyre hardware.ibm-ci-deploystep, which uses SSH credentials and a pull secret to run the Ansible deployment.