openshift-mcp-server: Auto-ff daily #83135

cajieh · 2026-08-11T16:31:42Z

Given github-credentials-openshift-merge-robot isn’t on the build farm, should this job be pinned to app.ci or core-ci instead of build01?

This file is generated.

IIUC the secret not existing for rehearsals is deliberate (otherwise a malicious or merely hapless actor would be able to do privileged things just by proposing and rehearsing a PR). It should be present when this runs for real.

This ended up being a good callout. I'm trying to figure out how to pin the job to a cluster. (I don't think I'm allowed to change it here, because there are CI jobs that make sure that generated files aren't changed. But I've been surprised on that count in the past.)

cajieh · 2026-08-11T16:44:42Z

Since DESTINATION_BRANCH can be "", and set -u won’t catch that, should we add an early non-empty check so we fail with a clear error before git clone?

Talked through this with the rabbit above. Since we control the invocation very tightly, I'm pretty unworried about this kind of thing. The error we would get organically isn't inscrutable enough to warrant the extra script clutter IMO:

$ git clone -b "" https://github.com/openshift/hive.git Cloning into 'hive'... fatal: Remote branch not found in upstream origin

But if you feel strongly about it I'll add the extra checks.

It would be nice if the default field wasn't required... but I've thought of a compromise: what if I made it default: unset so the organic error message would be like fatal: Remote branch unset not found in upstream origin?

Yes, the default: unset is fine.

cajieh · 2026-08-11T16:39:18Z

After the secret works, won’t /pj-rehearse run a real git push to release-0.5? Should we no-op (skip the push) during rehearsals so we don’t update that branch just to test the PR?

As noted, the secret won't (and shouldn't) work in rehearsals. And the failure occurs before this script is invoked, so rehearsal-only logic wouldn't help.

cajieh · 2026-08-11T16:42:11Z

This needs git and the image is ocp/5.0:cli, right?
Does the image include git?

Gah, no, it doesn't. You won't believe this, but I've been lied to by an LLM.

Will fix. (Though still, we won't be able to validate until merged.)

cajieh · 2026-08-11T16:47:51Z

nit: Should REPO_OWNER and REPO_NAME be documented here as ci-operator-injected env vars for clarity?

I looked around and that's not being done anywhere else. (Also this file has magical semantics. I don't know this for sure, but it may error if I try to declare vars that are "owned" elsewhere.)

I wouldn't actually object to hardcoding openshift/openshift-mcp-server -- as currently written this workflow could technically be reused by others, but the name of the workflow would look weird if they did. But for now I'll leave it.

grokspawn · 2026-08-11T20:37:18Z

I think there's a danger that someone oopses and doesn't set DESTINATION_BRANCH, so it's then set to "unset" (but it's never checked and someone would have to figure out that it means the string-literal "unset" rather than the logical concept.
It might be better to default to empty-string and verify against that, with a clear error.
I'll leave that as a nit since I'm not sure how real the danger is.

-Original file line number
+Diff line change
@@ Expand Up / @@ -66,6 +66,12 @@ tests: @@
         test:
         - chain: openshift-mcp-server-mcpchecker-eval-vertex
         workflow: ipi-aws
+    - as: fast-forward-latest-release
+      cron: 0 6 * * *
+      steps:
+        env:
+          DESTINATION_BRANCH: release-0.5
+        workflow: openshift-mcp-server-fastforward
     zz_generated_metadata:
       branch: main
       org: openshift
@@ Expand Down @@

-Original file line number
+Diff line change
@@ -0,0 +1,77 @@
+    periodics:
+    - agent: kubernetes
+      cluster: build01
+      cron: 0 6 * * *
+      decorate: true
+      decoration_config:
+        sparse_checkout_files:
+        - .ci-operator.yaml
+        - Dockerfile.ci
+      extra_refs:
+      - base_ref: main
+        org: openshift
+        repo: openshift-mcp-server
+        sparse_checkout_files:
+        - .ci-operator.yaml
+        - Dockerfile.ci
+      labels:
+        ci.openshift.io/generator: prowgen
+        pj-rehearse.openshift.io/can-be-rehearsed: "true"
+      name: periodic-ci-openshift-openshift-mcp-server-main-fast-forward-latest-release
+      spec:
+        containers:
+        - args:
+          - --gcs-upload-secret=/secrets/gcs/service-account.json
+          - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+          - --lease-server-credentials-file=/etc/boskos/credentials
+          - --report-credentials-file=/etc/report/credentials
+          - --target=fast-forward-latest-release
+          command:
+          - ci-operator
+          env:
+          - name: HTTP_SERVER_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+          image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+          imagePullPolicy: Always
+          name: ""
+          ports:
+          - containerPort: 8080
+            name: http
+          resources:
+            requests:
+              cpu: 10m
+          volumeMounts:
+          - mountPath: /etc/boskos
+            name: boskos
+            readOnly: true
+          - mountPath: /secrets/gcs
+            name: gcs-credentials
+            readOnly: true
+          - mountPath: /secrets/manifest-tool
+            name: manifest-tool-local-pusher
+            readOnly: true
+          - mountPath: /etc/pull-secret
+            name: pull-secret
+            readOnly: true
+          - mountPath: /etc/report
+            name: result-aggregator
+            readOnly: true
+        serviceAccountName: ci-operator
+        volumes:
+        - name: boskos
+          secret:
+            items:
+            - key: credentials
+              path: credentials
+            secretName: boskos-credentials
+        - name: manifest-tool-local-pusher
+          secret:
+            secretName: manifest-tool-local-pusher
+        - name: pull-secret
+          secret:
+            secretName: registry-pull-credentials
+        - name: result-aggregator
+          secret:
+            secretName: result-aggregator

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		../OWNERS

-Original file line number
+Diff line change
@@ -0,0 +1,41 @@
+    #!/bin/bash
+    set -euo pipefail
+    dnf install -y git
+    HOME="$(mktemp -d -t ff-XXXXX)"
+    export HOME
+    cd
+    log_file="${ARTIFACT_DIR}/fastforward.log"
+    log() {
+        echo "$(date --iso-8601=seconds)" "$@" | tee -a "$log_file"
+    }
+    # git_wrapper invokes the `git` CLI with
+    # - creds in a way that doesn't reveal them in logs, env, or process table.
+    # - logging
+    git_wrapper() {
+      git -c credential.helper= -c credential.helper='!f() { echo username=openshift-merge-robot; printf password=; cat /etc/github/oauth; echo; }; f' "$@" 2>&1 | tee -a "$log_file"
+    }
+    log "INFO Fast-forward settings"
+    log "    REPO_OWNER         = $REPO_OWNER"
+    log "    REPO_NAME          = $REPO_NAME"
+    log "    SOURCE_BRANCH      = $SOURCE_BRANCH"
+    log "    DESTINATION_BRANCH = $DESTINATION_BRANCH"
+    repo_url="https://github.com/${REPO_OWNER}/${REPO_NAME}.git"
+    log "INFO Cloning $DESTINATION_BRANCH"
+    git_wrapper clone -b "$DESTINATION_BRANCH" "$repo_url"
+    cd "$REPO_NAME"
+    log "INFO Pulling $SOURCE_BRANCH into $DESTINATION_BRANCH (ff-only)"
+    git_wrapper pull --ff-only origin "$SOURCE_BRANCH"
+    log "INFO Pushing to origin/$DESTINATION_BRANCH"
+    git_wrapper push
+    log "INFO Fast-forward complete"

-Original file line number
+Diff line change
@@ -0,0 +1,28 @@
+    {
+    	"path": "openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-ref.yaml",
+    	"owners": {
+    		"approvers": [
+    			"2uasimojo",
+    			"bentito",
+    			"cajieh",
+    			"Cali0707",
+    			"dlom",
+    			"grokspawn",
+    			"manusa",
+    			"matzew",
+    			"Kaustubh-pande",
+    			"wking"
+    		],
+    		"reviewers": [
+    			"2uasimojo",
+    			"bentito",
+    			"cajieh",
+    			"Cali0707",
+    			"dlom",
+    			"grokspawn",
+    			"manusa",
+    			"matzew",
+    			"Kaustubh-pande"
+    		]
+    	}
+    }

Navigation Menu

Uh oh!

openshift-mcp-server: Auto-ff daily #83135

Uh oh!

Diff view

Diff view

There are no files selected for viewing

cajieh Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026 •

edited

Loading

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

cajieh Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

cajieh Aug 11, 2026

Uh oh!

cajieh Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

cajieh Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

cajieh Aug 11, 2026

Uh oh!

2uasimojo Aug 11, 2026

Uh oh!

grokspawn Aug 11, 2026

Uh oh!

-Original file line number
+Diff line change
@@ -0,0 +1,28 @@
+    ref:
+      as: openshift-mcp-server-fastforward
+      from_image:
+        name: "5.0"
+        namespace: ocp
+        tag: cli
+      commands: openshift-mcp-server-fastforward-commands.sh
+      resources:
+        requests:
+          cpu: 100m
+          memory: 100Mi
+      credentials:
+      - namespace: ci
+        name: github-credentials-openshift-merge-robot
+        mount_path: /etc/github
+      env:
+      - name: SOURCE_BRANCH
+        default: "main"
+        documentation: |-
+          The branch to fast-forward FROM.
+      - name: DESTINATION_BRANCH
+        default: "unset"
+        documentation: |-
+          The branch to fast-forward TO. Required.
+      documentation: |-
+        Fast-forwards a source branch to a destination branch in the
+        openshift/openshift-mcp-server GitHub repo using openshift-merge-robot
+        credentials.

Uh oh!

openshift-mcp-server: Auto-ff daily #83135

Uh oh!

openshift-mcp-server: Auto-ff daily #83135

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Choose a reason for hiding this comment

Uh oh!

2uasimojo Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

2uasimojo Aug 11, 2026 •

edited

Loading