SMC-13: Add CI pipeline for openshift/ocp-secrets-management-console

[sarthakpurohit]

Summary

• Onboard the OCP Secrets Management Console plugin to OpenShift CI for the first time
• Configure 3 presubmit jobs that run automatically on every PR to the main branch:
  • unit: Frontend Jest unit tests (103 tests across 6 suites) on Node 22 (console-plugin-test-cypress)
  • operator-unit: Go operator tests (controller reconciliation, CRD validation) on rhel-9-golang-1.23
  • images: Dockerfile build verification
• Together, unit + operator-unit mirror what make test runs locally (frontend Jest + operator Go tests), split into separate CI jobs for parallelism and clear failure attribution

Details

This is the initial CI onboarding for openshift/ocp-secrets-management-console. The repo has never been added to the release repo before.

Config: ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml

• Build root: ci/console-plugin-test-cypress:node22 (same image used by openshift/console-plugin-template; provides Node 22 which satisfies the project's Node 20+ requirement)
• Base images: golang (rhel-9-golang-1.23-openshift-4.19) for operator Go tests
• No promotion or release integration at this stage

Generated jobs: ci-operator/jobs/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main-presubmits.yaml

• All jobs generated via make jobs (ci-operator-prowgen + sanitize-prow-jobs)

Jobs intentionally excluded for now (pre-existing failures on main, not caused by this PR):

• lint: ESLint config issue — parserOptions not set for integration-tests/cypress.config.js
• frontend (i18n validation): Locale files on main are stale — yarn i18n produces different sorted output vs committed files

These will be re-added once the source repo fixes are merged.

Test plan

• make ci-operator-config — config determinized successfully
• make ci-operator-prowgen — Prow jobs generated successfully
• make sanitize-prow-jobs — jobs sanitized successfully
• Local make test passes (103 Jest tests + Go operator tests)
• Prow rehearsal jobs pass: unit, operator-unit, images all green

[coderabbitai]

Walkthrough

Adds a ci-operator job for ocp-secrets-management-console (builder image, build root, image mapping, resources), a three-entry test matrix (unit, operator-unit, frontend), zz_generated_metadata, and updates OWNERS to add two approvers.

Changes

ocp-secrets-management-console CI Configuration

Layer / File(s)	Summary
Repository ownership approvals ci-operator/config/openshift/ocp-secrets-management-console/OWNERS	Adds approvers: sarthakpurohit, anandkuma77.
CI build inputs and resource configuration ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml	Selects Go builder base image, sets the build_root to an image_stream_tag, maps Dockerfile to the ocp-secrets-management-console image, and defines global CPU/memory requests and a * memory limit.
CI test matrix and metadata ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml	Defines unit, operator-unit, and frontend test steps with container sources and commands; sets zz_generated_metadata (branch: main, org: openshift, repo: ocp-secrets-management-console).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

rehearsals-ack, lifecycle/active

Suggested reviewers

• jmguzik
• bear-redhat
• deepsm007

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR contains only CI configuration files (OWNERS and CI operator YAML), not Ginkgo test files. No test names to validate.
Test Structure And Quality	✅ Passed	PR contains only CI configuration files (OWNERS and YAML config), not Ginkgo test code. The test structure check is not applicable to this PR.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. Changes consist only of CI configuration files (OWNERS and ci-operator YAML), which do not contain test code subject to MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests are added in this PR. The changes only include CI configuration files (OWNERS and openshift-ocp-secrets-management-console-main.yaml) with no Go test code.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds only CI configuration files (OWNERS, ci-operator config, Prow presubmits). No deployment manifests, operator code, or scheduling constraints introduced—check not applicable.
Ote Binary Stdout Contract	✅ Passed	PR contains only CI configuration files (OWNERS and YAML) with no Go test code; OTE Binary Stdout Contract check is not applicable to configuration-only changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR adds CI configuration files (YAML config and OWNERS) only; no new Ginkgo e2e test source code is added, so IPv6/disconnected network check does not apply.
No-Weak-Crypto	✅ Passed	No weak crypto patterns (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB) or custom crypto implementations found in the configuration files added by this PR.
Container-Privileges	✅ Passed	No container privilege escalation issues found; CI configs lack privileged settings, hostPID/hostNetwork/hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or securityContext.
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data (passwords, tokens, API keys, PII, session IDs, or hostnames) is logged or exposed in the CI/CD configuration files added to this PR.
Title check	✅ Passed	The title accurately summarizes the main objective: adding a CI pipeline for the ocp-secrets-management-console repository.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sarthakpurohit]

/pj-rehearse

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[coderabbitai]

🧹 Nitpick comments (1)

ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml (1)

35-40: 💤 Low value

Consider using a dynamic path for safe.directory config.

The hardcoded path /go/src/github.com/openshift/ocp-secrets-management-console works but reduces portability. Consider using a dynamic reference:

 - as: frontend
   commands: |
-    git config --global --add safe.directory /go/src/github.com/openshift/ocp-secrets-management-console
+    git config --global --add safe.directory "$(pwd)"
     ./test-frontend.sh
   container:
     from: src

This makes the config more resilient to changes in ci-operator's checkout path structure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml`
around lines 35 - 40, Replace the hardcoded safe.directory path in the commands
block with a dynamic runtime path: change the git config --global --add
safe.directory entry to use the current working directory (e.g., $(pwd) or $PWD)
so the command in the commands block sets safe.directory to the container's
actual checkout location when running ./test-frontend.sh; update the commands
block accordingly where safe.directory is referenced.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml`:
- Around line 35-40: Replace the hardcoded safe.directory path in the commands
block with a dynamic runtime path: change the git config --global --add
safe.directory entry to use the current working directory (e.g., $(pwd) or $PWD)
so the command in the commands block sets safe.directory to the container's
actual checkout location when running ./test-frontend.sh; update the commands
block accordingly where safe.directory is referenced.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 12c3b535-a4ce-4762-9589-f044497b31ae

📥 Commits

Reviewing files that changed from the base of the PR and between a8863b9 and c1749ca.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (2)

• ci-operator/config/openshift/ocp-secrets-management-console/OWNERS
• ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml

[sarthakpurohit]

/pj-rehearse

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[sarthakpurohit]

/pj-rehearse

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[sarthakpurohit]

/pj-rehearse

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[coderabbitai]

🧹 Nitpick comments (1)

ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml (1)

22-37: 💤 Low value

Test configuration looks solid.

The three-test split (unit, operator-unit, frontend) provides good separation of concerns and parallel execution. Commands are correctly structured with fail-fast behavior.

Optional optimization: Both unit and frontend tests execute yarn install separately. Since they run in separate containers, this duplication is functionally correct but slightly inefficient. Consider whether a shared step or pre-test phase could install dependencies once if CI execution time becomes a concern. This is a minor optimization and not required for initial onboarding.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml`
around lines 22 - 37, The unit and frontend test entries both run "yarn install"
separately causing duplicated install work; to optimize, either introduce a
shared pre-test step or enable dependency caching for those jobs so the "unit"
and "frontend" entries (referenced by their job names unit and frontend and the
frontend script test-frontend.sh) reuse the installed node_modules instead of
re-running yarn install in each container—update the CI config to add a shared
step or CI cache configuration for node_modules and remove the duplicate install
from one of the job commands accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml`:
- Around line 22-37: The unit and frontend test entries both run "yarn install"
separately causing duplicated install work; to optimize, either introduce a
shared pre-test step or enable dependency caching for those jobs so the "unit"
and "frontend" entries (referenced by their job names unit and frontend and the
frontend script test-frontend.sh) reuse the installed node_modules instead of
re-running yarn install in each container—update the CI config to add a shared
step or CI cache configuration for node_modules and remove the duplicate install
from one of the job commands accordingly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1cc0026a-e4af-4e96-8851-f58a1fa6278f

📥 Commits

Reviewing files that changed from the base of the PR and between ad064d4 and 4eafe16.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml

[openshift-ci-robot]

@sarthakpurohit: This pull request references SMC-13 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Onboard the OCP Secrets Management Console plugin to OpenShift CI for the first time
• Configure 5 presubmit jobs that run automatically on every PR to the main branch:
• unit: Frontend Jest unit tests (103 tests across 6 suites) on nodejs-18
• operator-unit: Go operator tests (controller reconciliation, CRD validation) on rhel-9-golang-1.23
• lint: ESLint + stylelint code quality checks
• frontend: i18n file validation via test-frontend.sh
• images: Dockerfile build verification
• Together, unit + operator-unit mirror what make test runs locally (frontend Jest + operator Go tests), split into separate CI jobs for parallelism and clear failure attribution

Details

This is the initial CI onboarding for openshift/ocp-secrets-management-console. The repo has never been added to the release repo before.

Config: ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml

• Build root: from_repository (nodejs-18 via .ci-operator.yaml)
• Base images: golang (rhel-9-golang-1.23-openshift-4.19) for operator Go tests
• No promotion or release integration at this stage

Generated jobs: ci-operator/jobs/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main-presubmits.yaml

• All jobs generated via make jobs (ci-operator-prowgen + sanitize-prow-jobs)

Test plan

• make ci-operator-config — config determinized successfully
• make ci-operator-prowgen — Prow jobs generated successfully
• make sanitize-prow-jobs — jobs sanitized successfully
• Local make test passes (103 Jest tests + Go operator tests)
• Prow rehearsal jobs pass on this PR

Made with Cursor

Summary by CodeRabbit

This PR onboards the openshift/ocp-secrets-management-console repository to OpenShift CI by adding a ci-operator config and generated Prow presubmits so PRs to main run automated checks.

What changed in practical terms

• Adds ci-operator configuration at ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml to define builds and tests on OpenShift CI.
• Uses from_repository build root for the frontend (nodejs image via the repository’s .ci-operator.yaml) and a rhel-9-golang-1.23 base image for operator tests.
• Builds the repository image from its Dockerfile and applies global resource requests/limits for job containers; no promotion/release integration — CI-only onboarding.
• Test matrix includes separate jobs to allow parallel runs and clearer failure attribution.
• Adds OWNERS for the CI config (approvers now include sarthakpurohit and anandkuma77).
• Adds five presubmit Prow jobs (generated via make ci-operator-prowgen and sanitize-prow-jobs):
• unit: Frontend Jest unit tests (103 tests across 6 suites) on nodejs-18 (yarn install + yarn test, LANG=en_US.UTF-8).
• operator-unit: Go operator tests (make test under operator) on rhel-9-golang-1.23 with GOFLAGS unset.
• lint: ESLint + stylelint checks.
• frontend: i18n/frontend validation via ./test-frontend.sh (with yarn install).
• images: Dockerfile build verification.
• Jobs were produced using the repo’s make targets (ci-operator-prowgen + sanitize-prow-jobs).

Test status and notes

• Local generation and validation completed: make ci-operator-config, make ci-operator-prowgen, make sanitize-prow-jobs succeeded.
• Local make test passed (103 Jest tests + Go operator tests).
• Prow rehearsal jobs are pending; the author posted "/pj-rehearse" repeatedly requesting rehearsals.
• Commit history includes a change to OWNERS to add a new approver.

Net effect

• Enables OpenShift CI presubmits (frontend unit, operator unit, lint, frontend validation, and image verification) for the ocp-secrets-management-console repository on main, splitting frontend/operator tests for parallelism and clearer failure attribution while keeping the setup CI-only.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sarthakpurohit]

/pj-rehearse

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@sarthakpurohit: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-ocp-secrets-management-console-main-images	openshift/ocp-secrets-management-console	presubmit	Presubmit changed
pull-ci-openshift-ocp-secrets-management-console-main-operator-unit	openshift/ocp-secrets-management-console	presubmit	Presubmit changed
pull-ci-openshift-ocp-secrets-management-console-main-unit	openshift/ocp-secrets-management-console	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[sarthakpurohit]

/jira refresh

[openshift-ci-robot]

@sarthakpurohit: This pull request references SMC-13 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[sarthakpurohit]

/cc @jupierce

[jupierce]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anandkuma77, jupierce, sarthakpurohit

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sarthakpurohit]

/label rehearsals-ack

[openshift-ci]

@sarthakpurohit: The label(s) /label rehearsals-ack cannot be applied. These labels are supported: acknowledge-critical-fixes-only, platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, ux-approved, no-qe, rebase/manual, cluster-config-api-changed, run-integration-tests, verified, ready-for-human-review, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/skip-dependent-bug-check, jira/valid-bug, ok-to-test, priority/ci-critical, stability-fix-approved, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

Details

In response to this:

/label rehearsals-ack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sarthakpurohit]

/pj-rehearse ack

[openshift-merge-bot]

@sarthakpurohit: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@sarthakpurohit: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/ocp-secrets-management-console/main/frontend	05951fd	link	unknown	/pj-rehearse pull-ci-openshift-ocp-secrets-management-console-main-frontend
ci/rehearse/openshift/ocp-secrets-management-console/main/lint	ad064d4	link	unknown	/pj-rehearse pull-ci-openshift-ocp-secrets-management-console-main-lint

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.