AROSLSRE-780: Onboard Azure/ARO-Tools to Prow by raelga · Pull Request #78902 · openshift/release

raelga · 2026-05-06T11:22:29Z

Summary

Onboard Azure/ARO-Tools to Prow
Add plugin config with approve, lgtm, blunderbuss, verify-owners, owners-label and other standard plugins
Add tide config for merge automation on main branch

JIRA

AROSLSRE-780

Prerequisites

ARO-Tools#231 — OWNERS file (AROSLSRE-779)

Test plan

Prow config validation passes CI
After merge, verify Prow responds to /lgtm and /approve on ARO-Tools PRs

Summary by CodeRabbit

Chores / CI infrastructure
- Onboards Azure/ARO-Tools to Prow.
- Enables standard Prow commands and automation, including /lgtm and /approve.
- Configures the refresh and needs-rebase external plugins.
- Trusts openshift-merge-bot for repository automation.
- Configures Tide to merge compliant pull requests targeting main when they have approved and lgtm labels and no blocking labels.
- Removes the stale org_invite trigger so the checked-in configuration matches make prow-config output.
- Requires an OWNERS file from ARO-Tools PR #231 before owner-based automation can function.
- The openshift-merge-bot GitHub App must be installed for Azure/ARO-Tools, with the required collaborators and permissions.

openshift-ci-robot · 2026-05-06T11:22:34Z

@raelga: This pull request references AROSLSRE-780 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Onboard Azure/ARO-Tools to Prow

Add plugin config with approve, lgtm, blunderbuss, verify-owners, owners-label and other standard plugins

Add tide config for merge automation on main branch

JIRA

AROSLSRE-780

Prerequisites

ARO-Tools#231 — OWNERS file (AROSLSRE-779)

Test plan

Prow config validation passes CI

After merge, verify Prow responds to /lgtm and /approve on ARO-Tools PRs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-05-06T11:23:02Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: e0b86f73-b87a-4231-a6d9-d1a78d3fe60b

📥 Commits

Reviewing files that changed from the base of the PR and between 1525724 and 93d1fd7.

📒 Files selected for processing (1)

core-services/prow/02_config/Azure/ARO-Tools/_pluginconfig.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

core-services/prow/02_config/Azure/ARO-Tools/_pluginconfig.yaml

Walkthrough

Adds Prow configuration for Azure/ARO-Tools. The configuration registers plugins and trusted triggers, enables unmanaged branch protection, and defines Tide requirements for the main branch.

Changes

Azure/ARO-Tools Prow configuration

Layer / File(s)	Summary
Plugin and merge configuration `core-services/prow/02_config/Azure/ARO-Tools/_pluginconfig.yaml`, `core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml`	Registers `refresh` and `needs-rebase`, enables built-in plugins, trusts `openshift-merge-bot`, and configures unmanaged branch protection with Tide requirements for `approved`, `lgtm`, and missing-label checks.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

openshift/release#82978: Adds repository-specific Prow plugin and branch-protection configuration.
openshift/release#83028: Adds Prow trigger configuration that trusts openshift-merge-bot.
openshift/release#83046: Adds repository-specific Prow plugin and Tide configuration.

Suggested reviewers: droslean, hector-vido

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: onboarding Azure/ARO-Tools to Prow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only Prow YAML configuration. No Ginkgo tests or test titles are present, so the stability check is not applicable.
Test Structure And Quality	✅ Passed	The PR adds only two YAML Prow configuration files. No Ginkgo tests, It blocks, cluster operations, or assertions require review under this check.
Microshift Test Compatibility	✅ Passed	The pull request adds only Prow YAML configuration files and no new Ginkgo tests, so the MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only Prow YAML configuration files; no new Ginkgo tests or test-like paths were added, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The change contains only Prow plugin and Tide YAML; no deployment manifests, operator code, controllers, replicas, affinity, node selectors, tolerations, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	The PR changes only two declarative YAML Prow configuration files; it adds no OTE binary, Go source, suite setup, or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds only Prow YAML configuration; no Ginkgo e2e tests or IPv4 assumptions and external connectivity requirements were added.
No-Weak-Crypto	✅ Passed	The PR adds only two YAML configuration files. Searches of all added content found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison logic.
Container-Privileges	✅ Passed	The ARO-Tools files contain only Prow plugin and Tide settings; searches found no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The ARO-Tools patch contains only Prow plugin, trigger, and Tide settings; searches found no logging directives or passwords, tokens, keys, PII, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml`:
- Around line 14-18: Add the label jira/invalid-bug to the missingLabels array
so Tide treats PRs flagged by the jira-lifecycle-plugin as blocking; update the
missingLabels configuration (the missingLabels key shown in the diff) to include
"jira/invalid-bug" alongside the existing entries like do-not-merge/hold and
needs-rebase to ensure JIRA-invalid PRs are not auto-merged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e6161d06-9e7b-4800-a041-ee664d647130

📥 Commits

Reviewing files that changed from the base of the PR and between c9bd218 and ffa03f2.

📒 Files selected for processing (2)

core-services/prow/02_config/Azure/ARO-Tools/_pluginconfig.yaml
core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml

raelga · 2026-05-06T12:39:05Z

/hold

make prow-config generates way too many changes. Reviewing.

openshift-merge-bot · 2026-05-06T13:18:12Z

@raelga, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

could not determine changed registry steps: could not load step registry: load cluster profile list: unmarshal file /var/tmp/gitrepo4180541046/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal array into Go value of type api.ClusterProfilesList

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

raelga · 2026-05-06T22:18:35Z

/retest

Add plugin and tide config for Azure/ARO-Tools to enable OWNERS-based approve/lgtm workflows and merge automation.

openshift-merge-bot · 2026-05-07T10:17:04Z

[REHEARSALNOTIFIER]
@raelga: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

raelga · 2026-05-07T17:38:44Z

/test check-gh-automation-tide

raelga · 2026-05-11T08:27:39Z

/test check-gh-automation-tide

raelga · 2026-05-11T15:53:18Z

/test check-gh-automation-tide

raelga · 2026-05-12T07:21:03Z

/test check-gh-automation-tide

raelga · 2026-05-12T21:07:00Z

/test check-gh-automation-tide

raelga · 2026-05-13T19:57:12Z

/test check-gh-automation-tide

droslean · 2026-05-14T10:41:39Z

/test check-gh-automation-tide

raelga · 2026-05-19T12:45:05Z

/test check-gh-automation-tide

raelga · 2026-07-30T10:05:31Z

/hold cancel

The generated config review is complete. The remaining blocker is the failed automation check, which needs the Openshift Merge Bot app installed on Azure/ARO-Tools.

raelga · 2026-07-30T10:54:50Z

@droslean @hector-vido, the config is ready, but check-gh-automation-tide is blocked because the Openshift Merge Bot app is not installed on Azure/ARO-Tools. Could you help route the app installation to an Azure organization owner?

raelga · 2026-08-04T22:29:07Z

/test check-gh-automation-tide

Retesting to get a fresh signal. The recorded failure is from 2026-05-19, so it is about two and a half months stale.

The failure itself is not a code problem in this PR:

level=error msg="openshift-merge-bot app is not installed for repo" org=Azure repo=ARO-Tools
level=fatal msg="Repo(s) missing github automation: Azure/ARO-Tools"

The check reached at least one tide query exists for repo, checking app install and then IsAppInstalled(Azure, ARO-Tools) came back 404. That needs an admin on the Azure org to install the openshift-merge-bot GitHub App on Azure/ARO-Tools, it cannot be fixed from this repo. If the app has been installed since May this run will go green on its own.

raelga · 2026-08-04T22:48:11Z

Fresh run finished and it fails the same way, so the app has not been installed since May.

Run 2084768636752367616, finished 2026-08-04 22:45 UTC:

level=error msg="openshift-merge-bot app is not installed for repo" org=Azure repo=ARO-Tools
level=fatal msg="Repo(s) missing github automation: Azure/ARO-Tools"

I am not going to keep retesting this, it is deterministic and nothing in this PR can change it. Per the onboarding docs, someone with owner rights on the Azure GitHub org needs to:

Install the openshift-merge-bot app on Azure/ARO-Tools.
Add openshift-ci-robot and openshift-merge-robot as collaborators, with openshift-merge-robot at admin so tide can manage branch protection.

Once that is done this check goes green on a plain retest, no change needed here.

raelga · 2026-08-05T16:38:10Z

/lgtm
/approve

openshift-ci · 2026-08-05T16:38:13Z

@raelga: you cannot LGTM your own PR.

Details

In response to this:

/lgtm
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

raelga · 2026-08-05T16:39:23Z

/retest

raelga · 2026-08-05T18:58:47Z

/retest

raelga · 2026-08-05T21:19:11Z

/retest

raelga · 2026-08-05T21:33:00Z

/retest

raelga · 2026-08-06T05:12:23Z

/retest

raelga · 2026-08-06T08:13:33Z

/test check-gh-automation-tide

raelga · 2026-08-06T11:11:41Z

/test check-gh-automation-tide

raelga · 2026-08-06T16:14:37Z

/test check-gh-automation-tide

deepsm007 · 2026-08-06T17:00:53Z

/lgtm

raelga · 2026-08-06T17:14:34Z

/retest

The prow-config CI check regenerates configs and no longer produces the org_invite/prominent block under triggers for Azure/ARO-Tools, so drop it to match the generated output.

deepsm007 · 2026-08-06T17:25:25Z

/lgtm

openshift-ci · 2026-08-06T17:25:40Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-08-06T17:26:09Z

@raelga: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

openshift-ci · 2026-08-06T17:31:19Z

@raelga: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci · 2026-08-06T17:36:57Z

@raelga: Updated the following 2 configmaps:

config configmap in namespace ci at cluster app.ci using the following files:
- key core-services-prow-02_config-Azure-ARO-Tools-_prowconfig.yaml using file core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml
config configmap in namespace ci at cluster core-ci using the following files:
- key core-services-prow-02_config-Azure-ARO-Tools-_prowconfig.yaml using file core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml

Details

In response to this:

Summary

Onboard Azure/ARO-Tools to Prow

Add plugin config with approve, lgtm, blunderbuss, verify-owners, owners-label and other standard plugins

Add tide config for merge automation on main branch

JIRA

AROSLSRE-780

Prerequisites

ARO-Tools#231 — OWNERS file (AROSLSRE-779)

Test plan

Prow config validation passes CI

After merge, verify Prow responds to /lgtm and /approve on ARO-Tools PRs

Summary by CodeRabbit

Chores / CI infrastructure

Onboards Azure/ARO-Tools to Prow.

Enables standard Prow commands and automation, including /lgtm and /approve.

Configures the refresh and needs-rebase external plugins.

Trusts openshift-merge-bot for repository automation.

Configures Tide to merge compliant pull requests targeting main when they have approved and lgtm labels and no blocking labels.

Removes the stale org_invite trigger so the checked-in configuration matches make prow-config output.

Requires an OWNERS file from ARO-Tools PR #231 before owner-based automation can function.

The openshift-merge-bot GitHub App must be installed for Azure/ARO-Tools, with the required collaborators and permissions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 6, 2026

openshift-ci Bot requested review from droslean and hector-vido May 6, 2026 11:23

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 6, 2026

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 6, 2026

coderabbitai Bot reviewed May 6, 2026

View reviewed changes

Comment thread core-services/prow/02_config/Azure/ARO-Tools/_prowconfig.yaml

raelga force-pushed the raelga/onboard-aro-tools-prow branch 3 times, most recently from 38793ae to f17312a Compare May 6, 2026 12:19

openshift-ci Bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 6, 2026

raelga force-pushed the raelga/onboard-aro-tools-prow branch 2 times, most recently from 49b1ece to 1f3d054 Compare May 6, 2026 12:25

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 6, 2026

raelga force-pushed the raelga/onboard-aro-tools-prow branch from 1f3d054 to 883b011 Compare May 6, 2026 13:13

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 6, 2026

AROSLSRE-780: Onboard Azure/ARO-Tools to Prow

1525724

Add plugin and tide config for Azure/ARO-Tools to enable OWNERS-based approve/lgtm workflows and merge automation.

raelga force-pushed the raelga/onboard-aro-tools-prow branch from 883b011 to 1525724 Compare May 7, 2026 10:13

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 30, 2026

openshift-ci Bot assigned deepsm007 Aug 6, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026

AROSLSRE-780: drop stale org_invite trigger to match make prow-config

93d1fd7

The prow-config CI check regenerates configs and no longer produces the org_invite/prominent block under triggers for Azure/ARO-Tools, so drop it to match the generated output.

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 6, 2026

openshift-merge-bot Bot merged commit 42dea7a into openshift:main Aug 6, 2026
12 checks passed

Uh oh!

Conversation

raelga commented May 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

JIRA

Prerequisites

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented May 6, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

JIRA

Prerequisites

Test plan

Uh oh!

coderabbitai Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

raelga commented May 6, 2026

Uh oh!

openshift-merge-bot Bot commented May 6, 2026

Uh oh!

raelga commented May 6, 2026

Uh oh!

openshift-merge-bot Bot commented May 7, 2026

Uh oh!

raelga commented May 7, 2026

Uh oh!

raelga commented May 11, 2026

Uh oh!

raelga commented May 11, 2026

Uh oh!

raelga commented May 12, 2026

Uh oh!

raelga commented May 12, 2026

Uh oh!

raelga commented May 13, 2026

Uh oh!

droslean commented May 14, 2026

Uh oh!

raelga commented May 19, 2026

Uh oh!

raelga commented Jul 30, 2026

Uh oh!

raelga commented Jul 30, 2026

Uh oh!

raelga commented Aug 4, 2026

Uh oh!

raelga commented Aug 4, 2026

Uh oh!

raelga commented Aug 5, 2026

Uh oh!

openshift-ci Bot commented Aug 5, 2026

Uh oh!

raelga commented Aug 5, 2026

Uh oh!

raelga commented Aug 5, 2026

Uh oh!

raelga commented Aug 5, 2026

Uh oh!

raelga commented Aug 5, 2026

Uh oh!

raelga commented Aug 6, 2026

Uh oh!

raelga commented Aug 6, 2026

Uh oh!

raelga commented Aug 6, 2026

Uh oh!

raelga commented Aug 6, 2026

Uh oh!

deepsm007 commented Aug 6, 2026

Uh oh!

raelga commented May 6, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented May 6, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented May 6, 2026 •

edited

Loading