From 116c7c5d6400bd088640210472f227f1d300f753 Mon Sep 17 00:00:00 2001
From: lufreita <lufreita@redhat.com>
Date: Thu, 21 May 2026 15:44:12 -0300
Subject: [PATCH] OCM-24478 | ci: add ROSA changelog tag job

Add a changelog-history postsubmit test to the ROSA ci-operator config so Prow
runs the changelog PR helper after merges to master. The job file is fully
generated by ci-operator-prowgen; no hand-edited job stanzas are included.

Tag-triggered execution is deferred to a follow-up once the repo-side changelog
tooling is validated on master merges first.
---
 .../openshift/rosa/openshift-rosa-master.yaml | 14 ++++
 .../openshift-rosa-master-postsubmits.yaml    | 70 +++++++++++++++++++
 2 files changed, 84 insertions(+)

diff --git a/ci-operator/config/openshift/rosa/openshift-rosa-master.yaml b/ci-operator/config/openshift/rosa/openshift-rosa-master.yaml
index 984a4a2cb1f70..131929492faa1 100644
--- a/ci-operator/config/openshift/rosa/openshift-rosa-master.yaml
+++ b/ci-operator/config/openshift/rosa/openshift-rosa-master.yaml
@@ -59,6 +59,20 @@ tests:
   secret:
     mount_path: /tmp/secret
     name: rosa-codecov-token
+- as: changelog-history
+  commands: |
+    unset GOFLAGS
+    export GITHUB_TOKEN=$(cat /tmp/github/oauth)
+    if ! command -v jq >/dev/null 2>&1; then
+      dnf install -y jq >/dev/null
+    fi
+    make changelog-pr
+  container:
+    from: src
+  postsubmit: true
+  secret:
+    mount_path: /tmp/github
+    name: github-credentials-openshift-ci-robot-private-git-cloner
 zz_generated_metadata:
   branch: master
   org: openshift
diff --git a/ci-operator/jobs/openshift/rosa/openshift-rosa-master-postsubmits.yaml b/ci-operator/jobs/openshift/rosa/openshift-rosa-master-postsubmits.yaml
index 0851f8fc6bf3b..b615ba19319ff 100644
--- a/ci-operator/jobs/openshift/rosa/openshift-rosa-master-postsubmits.yaml
+++ b/ci-operator/jobs/openshift/rosa/openshift-rosa-master-postsubmits.yaml
@@ -1,5 +1,75 @@
 postsubmits:
   openshift/rosa:
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    cluster: build05
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-openshift-rosa-master-changelog-history
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --oauth-token-path=/usr/local/github-credentials/oauth
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/github-credentials-openshift-ci-robot-private-git-cloner
+        - --target=changelog-history
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /usr/local/github-credentials
+          name: github-credentials-openshift-ci-robot-private-git-cloner
+          readOnly: true
+        - mountPath: /secrets/github-credentials-openshift-ci-robot-private-git-cloner
+          name: github-credentials-openshift-ci-robot-private-git-cloner
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: github-credentials-openshift-ci-robot-private-git-cloner
+        secret:
+          secretName: github-credentials-openshift-ci-robot-private-git-cloner
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
   - agent: kubernetes
     always_run: true
     branches: