chore: allow ci-images-mirror to push QCI back to registry.ci

[deepsm007]

Enable registry.ci push and quay-proxy pull for QCI→app.ci mirrors.

/cc @openshift/test-platform

Summary by CodeRabbit

• Enables ci-images-mirror to push QCI images to registry.ci.
• Enables QCI-to-app.ci mirrors to pull images through quay-proxy.
• Updates CI image mirror credentials to use the image-pusher token and quayio-ci-read-only-robot authentication entry.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2587ae23-bb08-40af-a92f-ec6b0d2847e8

📥 Commits

Reviewing files that changed from the base of the PR and between 2d2a11c and f821001.

📒 Files selected for processing (1)

• core-services/ci-secret-bootstrap/_config.yaml

---

Walkthrough

The CI secret configuration now uses the image-pusher token and adds quayio-ci-read-only-robot authentication for the Quay proxy registry.

Changes

CI registry credentials

Layer / File(s)	Summary
Registry authentication update core-services/ci-secret-bootstrap/_config.yaml	The registry configuration replaces the image-puller token with the image-pusher token and adds the quayio-ci-read-only-robot authentication entry.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: hector-vido, josecastillolema

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: allowing ci-images-mirror to push QCI images to registry.ci.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML credentials in _config.yaml; no Ginkgo test files or test-title calls were added or modified.
Test Structure And Quality	✅ Passed	The PR changes only core-services/ci-secret-bootstrap/_config.yaml; it adds no Ginkgo test code, so the test-structure requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The pull request changes only one YAML configuration file; it adds no Ginkgo tests or test code that could affect MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The patch changes only Docker registry credentials in a YAML config; it adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only registry credentials in _config.yaml. It adds no deployment, operator, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only core-services/ci-secret-bootstrap/_config.yaml, updating registry credentials; it adds no OTE binary, suite setup, or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The only changed file is a YAML secret configuration; the diff adds no Ginkgo tests or test code, so this check is not applicable.
No-Weak-Crypto	✅ Passed	The PR changes only registry credential references in YAML; added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto code, or secret comparisons.
Container-Privileges	✅ Passed	The only changed file is a secret configuration block. Added lines change registry credentials and contain no privilege settings or Kubernetes workload manifest fields.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only Vault-backed Docker credential references in YAML; it adds no logging and exposes no literal token, password, API key, PII, or session ID.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@deepsm007: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[bear-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bear-redhat, deepsm007

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [bear-redhat,deepsm007]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@deepsm007: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

@deepsm007: Updated the following 2 configmaps:

• ci-secret-bootstrap configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml

Details

In response to this:

Enable registry.ci push and quay-proxy pull for QCI→app.ci mirrors.

/cc @openshift/test-platform

Summary by CodeRabbit

• Enables ci-images-mirror to push QCI images to registry.ci.
• Enables QCI-to-app.ci mirrors to pull images through quay-proxy.
• Updates CI image mirror credentials to use the image-pusher token and quayio-ci-read-only-robot authentication entry.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.