Skip to content

USHIFT-6973: Minor refactor of CIS scenarios and RF test#7087

Merged
openshift-merge-bot[bot] merged 5 commits into
openshift:mainfrom
ggiguash:scenario-config-refactor
Jul 22, 2026
Merged

USHIFT-6973: Minor refactor of CIS scenarios and RF test#7087
openshift-merge-bot[bot] merged 5 commits into
openshift:mainfrom
ggiguash:scenario-config-refactor

Conversation

@ggiguash

@ggiguash ggiguash commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Follow-up on #7041

Summary by CodeRabbit

  • New Features

    • RPM installation workflows now support optional installation arguments, including unsigned or beta package scenarios.
    • CIS validation can receive configurable source repositories, target versions, and security configuration files.
  • Bug Fixes

    • Added early validation for required CIS inputs, providing clearer failures when configuration is missing.
  • Tests

    • CIS test runs are now deterministic.
    • Repository and dependency setup occurs before test execution for more reliable validation across supported system versions.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 22, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 22, 2026

Copy link
Copy Markdown

@ggiguash: This pull request references USHIFT-6973 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Follow-up on #7041

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 22, 2026
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

The CIS periodic scripts now configure repositories during VM creation and pass installation variables to Robot. The CIS suite validates required inputs and installs MicroShift through repo-based RPM helpers, which now support optional extra dnf arguments.

Changes

CIS installation and periodic setup

Layer / File(s) Summary
RPM installation argument propagation
test/resources/microshift-rpm.resource
RPM installation keywords accept optional extra_args and forward them to dnf install.
Periodic VM repository setup
test/scenarios-bootc/el9/periodics/el98-src@cis-lvl2.sh, test/scenarios-bootc/el10/periodics/el102-src@cis-lvl2.sh
VM creation configures required repositories, while test execution passes source repository and target version variables and exports deterministic test ordering.
CIS suite validation and installation
test/suites/cis/validate-cis-lvl2.robot
The suite validates required inputs and installs MicroShift through the repo-based RPM helper with --nogpgcheck.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PeriodicScript
  participant VM
  participant RobotSuite
  participant RPMRepository
  PeriodicScript->>VM: configure repositories during VM creation
  PeriodicScript->>RobotSuite: pass source URL and target version
  RobotSuite->>RobotSuite: validate required variables
  RobotSuite->>RPMRepository: install MicroShift RPM with --nogpgcheck
Loading

Possibly related PRs

Suggested reviewers: copejon

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Changed files are Robot/shell only; no It/Describe/Context/When titles or dynamic Ginkgo names were introduced.
Test Structure And Quality ✅ Passed PASS: The PR only changes Robot Framework resources and shell scenario scripts; no Ginkgo It/BeforeEach/Eventually tests were modified, so this check is not applicable.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes Robot Framework and shell scripts, so the MicroShift API-compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes Robot and shell scripts, so SNO multi-node assumptions are not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed PR only updates Robot test resources/suites; no deployment manifests, controllers, node selectors, anti-affinity, replicas, or topology spread constraints were introduced.
Ote Binary Stdout Contract ✅ Passed PASS: PR only changes Robot resources and scenario shell scripts; no Go entrypoints or process-level stdout writes (main/init/TestMain/setup) were modified.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PR only changes Robot/shell files; no new Ginkgo e2e tests or IPv4/external connectivity assumptions were introduced.
No-Weak-Crypto ✅ Passed The diff adds only RPM/install test plumbing; no MD5/SHA1/DES/RC4/ECB, custom crypto, or non-constant-time secret comparisons appear.
Container-Privileges ✅ Passed PR only changes Robot/shell test resources; no container/K8s manifests or new privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs ✅ Passed No added logs print secrets/tokens/PII or hostnames; the changes only pass repo vars internally and log rule IDs/stdout/stderr already used elsewhere.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change set: a minor refactor across CIS scenarios and Robot Framework test code.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2026
@ggiguash

Copy link
Copy Markdown
Contributor Author

/test ?

@ggiguash

Copy link
Copy Markdown
Contributor Author

/test e2e-aws-tests-bootc-periodic-arm-el10
/test e2e-aws-tests-bootc-periodic-arm-el9
/test e2e-aws-tests-bootc-periodic-el10
/test e2e-aws-tests-bootc-periodic-el9

@ggiguash
ggiguash marked this pull request as ready for review July 22, 2026 12:38
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 22, 2026
@openshift-ci
openshift-ci Bot requested review from jogeo and pacevedom July 22, 2026 12:49
@copejon

copejon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

/assign @copejon

@copejon

copejon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

All tests passed, but infra teardown failed. will try it one more time

/test e2e-aws-tests-bootc-el9

@ggiguash

Copy link
Copy Markdown
Contributor Author

/verified by ci

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 22, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@ggiguash: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@copejon

copejon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

/override e2e-aws-tests-bootc-el9
/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 22, 2026
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@copejon: /override requires failed status contexts, check run or a prowjob name to operate on.
The following unknown contexts/checkruns were given:

  • e2e-aws-tests-bootc-el9

Only the following failed contexts/checkruns were expected:

  • CodeRabbit
  • ci/prow/e2e-aws-tests
  • ci/prow/e2e-aws-tests-arm
  • ci/prow/e2e-aws-tests-bootc-arm-el10
  • ci/prow/e2e-aws-tests-bootc-arm-el9
  • ci/prow/e2e-aws-tests-bootc-el10
  • ci/prow/e2e-aws-tests-bootc-el9
  • ci/prow/e2e-aws-tests-bootc-periodic-arm-el10
  • ci/prow/e2e-aws-tests-bootc-periodic-arm-el9
  • ci/prow/e2e-aws-tests-bootc-periodic-el10
  • ci/prow/e2e-aws-tests-bootc-periodic-el9
  • ci/prow/images
  • ci/prow/security
  • ci/prow/test-unit
  • ci/prow/verify
  • ci/prow/verify-deps
  • pull-ci-openshift-microshift-main-e2e-aws-tests
  • pull-ci-openshift-microshift-main-e2e-aws-tests-arm
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-arm-el10
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-arm-el9
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-el10
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-el9
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-periodic-arm-el10
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-periodic-arm-el9
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-periodic-el10
  • pull-ci-openshift-microshift-main-e2e-aws-tests-bootc-periodic-el9
  • pull-ci-openshift-microshift-main-images
  • pull-ci-openshift-microshift-main-security
  • pull-ci-openshift-microshift-main-test-unit
  • pull-ci-openshift-microshift-main-verify
  • pull-ci-openshift-microshift-main-verify-deps
  • tide

If you are trying to override a checkrun that has a space in it, you must put a double quote on the context.

Details

In response to this:

/override e2e-aws-tests-bootc-el9
/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: copejon, ggiguash

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@copejon

copejon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

/override ci/prow/e2e-aws-tests-bootc-el9

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@copejon: Overrode contexts on behalf of copejon: ci/prow/e2e-aws-tests-bootc-el9

Details

In response to this:

/override ci/prow/e2e-aws-tests-bootc-el9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

@ggiguash: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 3ae6c0e into openshift:main Jul 22, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants