review-agent: add PAT auth mode and installer onboarding - #82202
Conversation
openshift-ci
Bot
added
the
do-not-merge/hold
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe PR extracts a reusable Review Agent workflow, makes processing repository- and authentication-configurable, updates HyperShift to use generic steps, and adds Installer periodic and on-demand Gangway-triggered review jobs. ChangesGeneric Review Agent and integrations
Installer Review Agent integration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant InstallerTrigger
participant Gangway
participant InstallerReviewJob
participant ReviewAgent
InstallerTrigger->>Gangway: Start periodic review with target PR
Gangway->>InstallerReviewJob: Execute installer-review-agent
InstallerReviewJob->>ReviewAgent: Run setup, process, and report phases
InstallerTrigger->>Gangway: Poll for job URL
InstallerTrigger->>PullRequest: Post execution comment
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@enxebre, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@enxebre, If the problem persists, please contact Test Platform. |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@enxebre: job(s): periodic-ci-openshift-installer-main-periodic-review-agent either don't exist or were not found to be affected, and cannot be rehearsed |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
ci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.yaml (1)
15-16: 📐 Maintainability & Code Quality | 🔵 TrivialConfirm removal of the rehearsal PR hardcode before unholding.
REVIEW_AGENT_TARGET_PR: "10700"is explicitly marked for removal pre-merge, consistent with the PR objectives. Just flagging so it isn't missed when the/holdis lifted.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.yaml` around lines 15 - 16, Remove the hardcoded REVIEW_AGENT_TARGET_PR value for rehearsal PR 10700 before unholding or merging, including its associated temporary TODO comment, and restore the workflow’s normal target-PR behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/hypershift/review-agent/README.md`:
- Around line 10-15: Align PAT documentation with the workflow contract: in
ci-operator/step-registry/hypershift/review-agent/README.md lines 10-15, replace
REVIEW_AGENT_FORK_REPO with REVIEW_AGENT_FORK_ORG and document
REVIEW_AGENT_UPSTREAM_REPO; in
ci-operator/step-registry/review-agent/ONBOARDING.md lines 13-20, describe three
environment variables and include REVIEW_AGENT_UPSTREAM_REPO; in
ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml
lines 18-19, refer to the fork organization and derived fork rather than a fork
repository.
In
`@ci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.sh`:
- Around line 34-37: Update the curl invocations in both retry loops to catch
transport failures instead of allowing set -e to terminate the script. Add
bounded connection and request timeouts, preserve the HTTP status handling for
successful responses, and continue retrying after the configured delay until the
existing retry limit is reached.
- Line 38: Remove the set -x tracing toggles from the credential-handling
script, including the occurrences around the bearer-token calls and lines 60–81,
so tracing remains disabled throughout. If preserving prior tracing state is
required, restore it only when tracing was explicitly enabled, and document the
tracing-disabled scope.
- Around line 97-104: Update the curl invocation in the PR comment-posting flow
to fail on HTTP 4xx/5xx responses and surface the server error, using curl’s
failure and error-display options. Ensure the existing “Comment posted on PR”
message is reached only after curl succeeds, while preserving the current
request payload and tracing behavior.
In
`@ci-operator/step-registry/review-agent/process/review-agent-process-commands.sh`:
- Around line 7-23: Validate REVIEW_AGENT_AUTH_MODE against the explicit allowed
values "app" and "pat" before the mode-specific required-variable checks. Reject
any other value with an error message and nonzero exit, while preserving the
existing validation behavior for valid modes.
- Around line 151-195: Protect the App-mode token configuration in the block
containing GITHUB_TOKEN_FORK and GITHUB_TOKEN_UPSTREAM from shell tracing,
matching the PAT branch’s guard. Add a clear comment, disable tracing only
around the git credential.helper construction and GITHUB_TOKEN export, then
restore the prior tracing state immediately afterward. Keep token generation and
unrelated logging outside this minimal protected scope.
- Around line 109-142: Update the fork-creation POST in the process command to
include REVIEW_AGENT_FORK_ORG as the GitHub API organization field, ensuring the
fork is created where subsequent checks expect it. Add --connect-timeout 10 and
--max-time 30 to both GET requests that check fork existence and readiness,
including the polling request.
In
`@ci-operator/step-registry/review-agent/process/review-agent-process-ref.yaml`:
- Around line 37-46: Update the documentation for REVIEW_AGENT_FORK_REPO and
REVIEW_AGENT_UPSTREAM_REPO to reflect the PAT-mode contract:
REVIEW_AGENT_FORK_REPO is required only in App mode, while PAT mode requires
REVIEW_AGENT_FORK_ORG and may derive the fork URL through
review-agent-process-commands.sh. Keep the existing wrapper workflow and gh CLI
usage descriptions accurate.
In `@ci-operator/step-registry/review-agent/review-agent-workflow.yaml`:
- Around line 20-25: Update the documentation block in
ci-operator/step-registry/review-agent/review-agent-workflow.yaml at lines 20-25
to document both app (default) and pat authentication modes, including each
mode’s required environment variables. Update
ci-operator/step-registry/review-agent/README.md at lines 15-25 with entries for
REVIEW_AGENT_AUTH_MODE, REVIEW_AGENT_FORK_ORG, and optional REVIEW_AGENT_PAT_KEY
alongside the existing variables.
---
Nitpick comments:
In
`@ci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.yaml`:
- Around line 15-16: Remove the hardcoded REVIEW_AGENT_TARGET_PR value for
rehearsal PR 10700 before unholding or merging, including its associated
temporary TODO comment, and restore the workflow’s normal target-PR behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 526e1069-d2ef-4f01-ab45-cdc2dac86b1a
📒 Files selected for processing (26)
ci-operator/config/openshift/installer/openshift-installer-main.yamlci-operator/step-registry/hypershift/review-agent/README.mdci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yamlci-operator/step-registry/hypershift/review-agent/report/hypershift-review-agent-report-ref.yamlci-operator/step-registry/hypershift/review-agent/setup/hypershift-review-agent-setup-ref.yamlci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.yamlci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.shci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-ref.yamlci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-workflow.yamlci-operator/step-registry/review-agent/ONBOARDING.mdci-operator/step-registry/review-agent/OWNERSci-operator/step-registry/review-agent/README.mdci-operator/step-registry/review-agent/process/OWNERSci-operator/step-registry/review-agent/process/review-agent-process-commands.shci-operator/step-registry/review-agent/process/review-agent-process-ref.metadata.jsonci-operator/step-registry/review-agent/process/review-agent-process-ref.yamlci-operator/step-registry/review-agent/report/OWNERSci-operator/step-registry/review-agent/report/review-agent-report-commands.shci-operator/step-registry/review-agent/report/review-agent-report-ref.metadata.jsonci-operator/step-registry/review-agent/report/review-agent-report-ref.yamlci-operator/step-registry/review-agent/review-agent-workflow.metadata.jsonci-operator/step-registry/review-agent/review-agent-workflow.yamlci-operator/step-registry/review-agent/setup/OWNERSci-operator/step-registry/review-agent/setup/review-agent-setup-commands.shci-operator/step-registry/review-agent/setup/review-agent-setup-ref.metadata.jsonci-operator/step-registry/review-agent/setup/review-agent-setup-ref.yaml
💤 Files with no reviewable changes (5)
- ci-operator/step-registry/hypershift/review-agent/setup/hypershift-review-agent-setup-ref.yaml
- ci-operator/step-registry/review-agent/OWNERS
- ci-operator/step-registry/hypershift/review-agent/report/hypershift-review-agent-report-ref.yaml
- ci-operator/step-registry/review-agent/process/OWNERS
- ci-operator/step-registry/review-agent/report/OWNERS
| | Variable | Value | | ||
| |---|---| | ||
| | `REVIEW_AGENT_FORK_REPO` | `https://github.com/hypershift-community/hypershift` | | ||
| | `REVIEW_AGENT_UPSTREAM_REPO` | `openshift/hypershift` | | ||
|
|
||
| The workflow requires secrets in the `test-credentials` namespace: | ||
| Credentials use the `hypershift-team-claude-prow` secret (configured in the generic step refs). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align the PAT documentation with the actual workflow contract.
The workflow uses REVIEW_AGENT_AUTH_MODE, REVIEW_AGENT_FORK_ORG, and REVIEW_AGENT_UPSTREAM_REPO; PAT mode derives the fork from the organization. The current documentation advertises a fork URL or omits the required upstream repository, which can produce a failed onboarding configuration.
ci-operator/step-registry/hypershift/review-agent/README.md#L10-L15: DocumentREVIEW_AGENT_FORK_ORGandREVIEW_AGENT_UPSTREAM_REPOinstead ofREVIEW_AGENT_FORK_REPO.ci-operator/step-registry/review-agent/ONBOARDING.md#L13-L20: Change “two env vars” to three and includeREVIEW_AGENT_UPSTREAM_REPO.ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml#L18-L19: Say “fork organization/derived fork,” not “fork repo.”
📍 Affects 3 files
ci-operator/step-registry/hypershift/review-agent/README.md#L10-L15(this comment)ci-operator/step-registry/review-agent/ONBOARDING.md#L13-L20ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml#L18-L19
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/hypershift/review-agent/README.md` around lines 10
- 15, Align PAT documentation with the workflow contract: in
ci-operator/step-registry/hypershift/review-agent/README.md lines 10-15, replace
REVIEW_AGENT_FORK_REPO with REVIEW_AGENT_FORK_ORG and document
REVIEW_AGENT_UPSTREAM_REPO; in
ci-operator/step-registry/review-agent/ONBOARDING.md lines 13-20, describe three
environment variables and include REVIEW_AGENT_UPSTREAM_REPO; in
ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml
lines 18-19, refer to the fork organization and derived fork rather than a fork
repository.
| RESPONSE=$(curl -s -X POST -d "${POST_DATA}" \ | ||
| -H "Authorization: Bearer $(cat "${TOKEN_FILE}")" \ | ||
| "${GANGWAY_API}/v1/executions/${PERIODIC_JOB_NAME}" \ | ||
| -w "\n%{http_code}") |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Retry transport failures instead of exiting immediately.
A DNS, TLS, or connection failure makes these command substitutions non-zero; set -e then aborts the script before either retry loop can retry. Catch curl failures inside both loops, add bounded timeouts, and continue after the configured delay.
Also applies to: 63-66
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.sh`
around lines 34 - 37, Update the curl invocations in both retry loops to catch
transport failures instead of allowing set -e to terminate the script. Add
bounded connection and request timeouts, preserve the HTTP status handling for
successful responses, and continue retrying after the configured delay until the
existing retry limit is reached.
| -H "Authorization: Bearer $(cat "${TOKEN_FILE}")" \ | ||
| "${GANGWAY_API}/v1/executions/${PERIODIC_JOB_NAME}" \ | ||
| -w "\n%{http_code}") | ||
| set -x |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Keep tracing disabled in this credential-handling script.
The script starts without tracing, but re-enables it after bearer-token calls. Remove these set -x toggles (or restore prior state only when tracing was explicitly enabled); document any necessary tracing-disabled scope.
Also applies to: 60-81
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.sh`
at line 38, Remove the set -x tracing toggles from the credential-handling
script, including the occurrences around the bearer-token calls and lines 60–81,
so tracing remains disabled throughout. If preserving prior tracing state is
required, restore it only when tracing was explicitly enabled, and document the
tracing-disabled scope.
Source: Coding guidelines
| curl -s -X POST \ | ||
| -H "Authorization: token ${GITHUB_TOKEN_PAT}" \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "https://api.github.com/repos/${UPSTREAM_REPO}/issues/${PR_NUMBER}/comments" \ | ||
| -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')" > /dev/null | ||
|
|
||
| $_was_tracing && set -x || true | ||
| echo "Comment posted on PR #$PR_NUMBER" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fail when GitHub rejects the PR comment.
curl -s exits successfully for HTTP 4xx/5xx, so a denied or invalid comment is discarded and the script logs success. Use --fail --show-error or validate the HTTP status before printing “Comment posted.”
Proposed fix
- curl -s -X POST \
+ curl --fail --silent --show-error -X POST \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| curl -s -X POST \ | |
| -H "Authorization: token ${GITHUB_TOKEN_PAT}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/${UPSTREAM_REPO}/issues/${PR_NUMBER}/comments" \ | |
| -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')" > /dev/null | |
| $_was_tracing && set -x || true | |
| echo "Comment posted on PR #$PR_NUMBER" | |
| curl --fail --silent --show-error -X POST \ | |
| -H "Authorization: token ${GITHUB_TOKEN_PAT}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/${UPSTREAM_REPO}/issues/${PR_NUMBER}/comments" \ | |
| -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')" > /dev/null | |
| $_was_tracing && set -x || true | |
| echo "Comment posted on PR #$PR_NUMBER" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.sh`
around lines 97 - 104, Update the curl invocation in the PR comment-posting flow
to fail on HTTP 4xx/5xx responses and surface the server error, using curl’s
failure and error-display options. Ensure the existing “Comment posted on PR”
message is reached only after curl succeeds, while preserving the current
request payload and tracing behavior.
| REVIEW_AGENT_AUTH_MODE="${REVIEW_AGENT_AUTH_MODE:-app}" | ||
| REVIEW_AGENT_PAT_KEY="${REVIEW_AGENT_PAT_KEY:-gh-pat}" | ||
| REVIEW_AGENT_FORK_ORG="${REVIEW_AGENT_FORK_ORG:-}" | ||
|
|
||
| # Validate required env vars | ||
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "app" ]] && [[ -z "${REVIEW_AGENT_FORK_REPO:-}" ]]; then | ||
| echo "ERROR: REVIEW_AGENT_FORK_REPO is required in App auth mode (e.g. https://github.com/hypershift-community/hypershift)" | ||
| exit 1 | ||
| fi | ||
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "pat" ]] && [[ -z "$REVIEW_AGENT_FORK_ORG" ]]; then | ||
| echo "ERROR: REVIEW_AGENT_FORK_ORG is required in PAT auth mode" | ||
| exit 1 | ||
| fi | ||
| if [[ -z "${REVIEW_AGENT_UPSTREAM_REPO:-}" ]]; then | ||
| echo "ERROR: REVIEW_AGENT_UPSTREAM_REPO is required (e.g. openshift/hypershift)" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Validate REVIEW_AGENT_AUTH_MODE against an explicit allow-list.
Only "app" and "pat" are ever compared; any other/misspelled value silently falls through to the App-mode branch at line 87 instead of failing fast, since neither if at Line 12/16 raises an error for unrecognized values.
🛡️ Proposed validation
+if [[ "$REVIEW_AGENT_AUTH_MODE" != "app" ]] && [[ "$REVIEW_AGENT_AUTH_MODE" != "pat" ]]; then
+ echo "ERROR: REVIEW_AGENT_AUTH_MODE must be 'app' or 'pat', got: $REVIEW_AGENT_AUTH_MODE"
+ exit 1
+fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| REVIEW_AGENT_AUTH_MODE="${REVIEW_AGENT_AUTH_MODE:-app}" | |
| REVIEW_AGENT_PAT_KEY="${REVIEW_AGENT_PAT_KEY:-gh-pat}" | |
| REVIEW_AGENT_FORK_ORG="${REVIEW_AGENT_FORK_ORG:-}" | |
| # Validate required env vars | |
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "app" ]] && [[ -z "${REVIEW_AGENT_FORK_REPO:-}" ]]; then | |
| echo "ERROR: REVIEW_AGENT_FORK_REPO is required in App auth mode (e.g. https://github.com/hypershift-community/hypershift)" | |
| exit 1 | |
| fi | |
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "pat" ]] && [[ -z "$REVIEW_AGENT_FORK_ORG" ]]; then | |
| echo "ERROR: REVIEW_AGENT_FORK_ORG is required in PAT auth mode" | |
| exit 1 | |
| fi | |
| if [[ -z "${REVIEW_AGENT_UPSTREAM_REPO:-}" ]]; then | |
| echo "ERROR: REVIEW_AGENT_UPSTREAM_REPO is required (e.g. openshift/hypershift)" | |
| exit 1 | |
| fi | |
| REVIEW_AGENT_AUTH_MODE="${REVIEW_AGENT_AUTH_MODE:-app}" | |
| REVIEW_AGENT_PAT_KEY="${REVIEW_AGENT_PAT_KEY:-gh-pat}" | |
| REVIEW_AGENT_FORK_ORG="${REVIEW_AGENT_FORK_ORG:-}" | |
| if [[ "$REVIEW_AGENT_AUTH_MODE" != "app" ]] && [[ "$REVIEW_AGENT_AUTH_MODE" != "pat" ]]; then | |
| echo "ERROR: REVIEW_AGENT_AUTH_MODE must be 'app' or 'pat', got: $REVIEW_AGENT_AUTH_MODE" | |
| exit 1 | |
| fi | |
| # Validate required env vars | |
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "app" ]] && [[ -z "${REVIEW_AGENT_FORK_REPO:-}" ]]; then | |
| echo "ERROR: REVIEW_AGENT_FORK_REPO is required in App auth mode (e.g. https://github.com/hypershift-community/hypershift)" | |
| exit 1 | |
| fi | |
| if [[ "$REVIEW_AGENT_AUTH_MODE" == "pat" ]] && [[ -z "$REVIEW_AGENT_FORK_ORG" ]]; then | |
| echo "ERROR: REVIEW_AGENT_FORK_ORG is required in PAT auth mode" | |
| exit 1 | |
| fi | |
| if [[ -z "${REVIEW_AGENT_UPSTREAM_REPO:-}" ]]; then | |
| echo "ERROR: REVIEW_AGENT_UPSTREAM_REPO is required (e.g. openshift/hypershift)" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/review-agent/process/review-agent-process-commands.sh`
around lines 7 - 23, Validate REVIEW_AGENT_AUTH_MODE against the explicit
allowed values "app" and "pat" before the mode-specific required-variable
checks. Reject any other value with an error message and nonzero exit, while
preserving the existing validation behavior for valid modes.
| # Ensure the fork exists (auto-fork if needed) | ||
| FORK_REPO_NAME="${REVIEW_AGENT_UPSTREAM_REPO#*/}" | ||
| echo "Checking if fork ${REVIEW_AGENT_FORK_ORG}/${FORK_REPO_NAME} exists..." | ||
| FORK_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "https://api.github.com/app/installations/${INSTALL_ID}/access_tokens" \ | ||
| | jq -r '.token' | ||
| } | ||
| "https://api.github.com/repos/${REVIEW_AGENT_FORK_ORG}/${FORK_REPO_NAME}") | ||
| if [ "$FORK_HTTP_CODE" != "200" ]; then | ||
| echo "Fork not found (HTTP ${FORK_HTTP_CODE}). Creating fork of ${REVIEW_AGENT_UPSTREAM_REPO}..." | ||
| FORK_RESPONSE=$(curl -s -X POST \ | ||
| --connect-timeout 10 --max-time 30 \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "https://api.github.com/repos/${REVIEW_AGENT_UPSTREAM_REPO}/forks" \ | ||
| -d '{"default_branch_only":true}') | ||
| FORK_FULL_NAME=$(echo "$FORK_RESPONSE" | jq -r '.full_name // empty' 2>/dev/null) | ||
| if [ -z "$FORK_FULL_NAME" ]; then | ||
| echo "ERROR: Failed to create fork. API response:" | ||
| echo "$FORK_RESPONSE" | head -20 | ||
| exit 1 | ||
| fi | ||
| echo "Fork creation initiated: ${FORK_FULL_NAME}" | ||
| # Poll until ready | ||
| WAITED=0 | ||
| while [ $WAITED -lt 120 ]; do | ||
| FORK_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "https://api.github.com/repos/${REVIEW_AGENT_FORK_ORG}/${FORK_REPO_NAME}") | ||
| [ "$FORK_HTTP_CODE" = "200" ] && break | ||
| echo "Waiting for fork to be ready... (${WAITED}s/120s)" | ||
| sleep 10 | ||
| WAITED=$((WAITED + 10)) | ||
| done |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,220p' ci-operator/step-registry/review-agent/process/review-agent-process-commands.shRepository: openshift/release
Length of output: 9001
🏁 Script executed:
grep -nE 'FORK_RESPONSE|FORK_HTTP_CODE|organization|default_branch_only|GITHUB_TOKEN|REVIEW_AGENT_FORK_ORG|REVIEW_AGENT_UPSTREAM_REPO' -n ci-operator/step-registry/review-agent/process/review-agent-process-commands.shRepository: openshift/release
Length of output: 3068
🌐 Web query:
GitHub REST API forks create fork organization default_branch_only official docs
💡 Result:
To create a fork using the GitHub REST API, you can send a POST request to the /repos/{owner}/{repo}/forks endpoint [1][2]. When creating a fork, you can use the default_branch_only boolean parameter in the request body to specify that the fork should include only the default branch of the source repository [1][3]. You can also use the organization parameter to specify an organization if you wish to fork the repository into one, rather than to your personal account [1][4]. Example request: curl -L \ -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer YOUR_TOKEN" \ https://api.github.com/repos/OWNER/REPO/forks \ -d '{ "organization": "your-org-name", "name": "new-fork-name", "default_branch_only": true }' Note that forking a repository is an asynchronous operation, and you may need to wait a short period before the new repository is fully available [1][2]. The organization parameter is optional and is used only when you want to fork into an organization where you have the appropriate permissions [1][5].
Citations:
- 1: https://docs.github.com/en/rest/repos/forks
- 2: https://docs.github.com/rest/repos/forks
- 3: https://docs.github.com/en/enterprise-cloud@latest/rest/repos/forks
- 4: https://docs.github.com/en/enterprise-server@3.18/rest/repos/forks
- 5: https://stackoverflow.com/questions/25446157/creating-a-fork-with-the-github-v3-api-rest
Create the fork in REVIEW_AGENT_FORK_ORG and bound the GETs.
POST /forks needs an organization field here; without it, GitHub creates the fork under the token owner’s account, while the later existence/poll checks always look for ${REVIEW_AGENT_FORK_ORG}/${FORK_REPO_NAME}. Add --connect-timeout/--max-time to those GETs too so a stalled GitHub request can’t hang the step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/review-agent/process/review-agent-process-commands.sh`
around lines 109 - 142, Update the fork-creation POST in the process command to
include REVIEW_AGENT_FORK_ORG as the GitHub API organization field, ensuring the
fork is created where subsequent checks expect it. Add --connect-timeout 10 and
--max-time 30 to both GET requests that check fork existence and readiness,
including the polling request.
| else | ||
| # App mode: separate fork/upstream tokens | ||
| echo "Loading GitHub App auth library..." | ||
| if [ ! -f "${SHARED_DIR}/github-app-auth.sh" ]; then | ||
| echo "ERROR: github-app-auth.sh not found in SHARED_DIR." | ||
| echo "Ensure jira-agent-github-app-auth runs as a pre step." | ||
| exit 1 | ||
| fi | ||
| # shellcheck source=/dev/null | ||
| source "${SHARED_DIR}/github-app-auth.sh" | ||
|
|
||
| INSTALLATION_ID_FORK_FILE="${GITHUB_APP_CREDS_DIR}/installation-id" | ||
| INSTALLATION_ID_UPSTREAM_FILE="${GITHUB_APP_CREDS_DIR}/o-h-installation-id" | ||
|
|
||
| if [ ! -f "$INSTALLATION_ID_FORK_FILE" ] || [ ! -f "$INSTALLATION_ID_UPSTREAM_FILE" ]; then | ||
| echo "GitHub App credentials not yet available in ${GITHUB_APP_CREDS_DIR}" | ||
| echo "Available files:" | ||
| ls -la "${GITHUB_APP_CREDS_DIR}/" || echo "Directory does not exist" | ||
| echo "ERROR: Required credentials are missing. Re-run once secrets are synced." | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Generate token for fork (hypershift-community/hypershift) - for pushing branches | ||
| echo "Generating GitHub App token for fork..." | ||
| GITHUB_TOKEN_FORK=$(generate_github_token "$INSTALLATION_ID_FORK") | ||
| if [ -z "$GITHUB_TOKEN_FORK" ] || [ "$GITHUB_TOKEN_FORK" = "null" ]; then | ||
| echo "ERROR: Failed to generate GitHub App token for fork" | ||
| exit 1 | ||
| fi | ||
| echo "Fork token generated successfully" | ||
| INSTALLATION_ID_FORK=$(cat "$INSTALLATION_ID_FORK_FILE") | ||
| INSTALLATION_ID_UPSTREAM=$(cat "$INSTALLATION_ID_UPSTREAM_FILE") | ||
|
|
||
| # Generate token for upstream (openshift/hypershift) - for reading PRs and comments | ||
| echo "Generating GitHub App token for upstream..." | ||
| GITHUB_TOKEN_UPSTREAM=$(generate_github_token "$INSTALLATION_ID_UPSTREAM") | ||
| if [ -z "$GITHUB_TOKEN_UPSTREAM" ] || [ "$GITHUB_TOKEN_UPSTREAM" = "null" ]; then | ||
| echo "ERROR: Failed to generate GitHub App token for upstream" | ||
| exit 1 | ||
| fi | ||
| echo "Upstream token generated successfully" | ||
| echo "Generating GitHub App token for fork..." | ||
| GITHUB_TOKEN_FORK=$(generate_github_token "$INSTALLATION_ID_FORK") | ||
| if [ -z "$GITHUB_TOKEN_FORK" ] || [ "$GITHUB_TOKEN_FORK" = "null" ]; then | ||
| echo "ERROR: Failed to generate GitHub App token for fork" | ||
| exit 1 | ||
| fi | ||
| echo "Fork token generated successfully" | ||
|
|
||
| # Configure git to use the fork token for push operations via credential helper | ||
| git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f" | ||
| echo "Generating GitHub App token for upstream..." | ||
| GITHUB_TOKEN_UPSTREAM=$(generate_github_token "$INSTALLATION_ID_UPSTREAM") | ||
| if [ -z "$GITHUB_TOKEN_UPSTREAM" ] || [ "$GITHUB_TOKEN_UPSTREAM" = "null" ]; then | ||
| echo "ERROR: Failed to generate GitHub App token for upstream" | ||
| exit 1 | ||
| fi | ||
| echo "Upstream token generated successfully" | ||
|
|
||
| # Export upstream token as GITHUB_TOKEN for gh CLI (used for PR operations) | ||
| export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM" | ||
| echo "GitHub App tokens configured successfully" | ||
| git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f" | ||
| export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM" | ||
| echo "GitHub App tokens configured successfully" | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
App-mode token exposure: mirror the PAT branch's tracing guard.
Lines 192-193 embed GITHUB_TOKEN_FORK/GITHUB_TOKEN_UPSTREAM into a shell command and export, with no set +x/set -x guard — unlike the PAT branch (lines 96-107), which explicitly disables tracing around the equivalent credential.helper construction. If tracing is ever enabled earlier in the script, this path leaks both App tokens to CI logs.
🔒 Proposed fix
+ [[ $- == *x* ]] && _was_tracing=true || _was_tracing=false
+ set +x
git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f"
export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM"
echo "GitHub App tokens configured successfully"
+ $_was_tracing && set -x || true
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| else | |
| # App mode: separate fork/upstream tokens | |
| echo "Loading GitHub App auth library..." | |
| if [ ! -f "${SHARED_DIR}/github-app-auth.sh" ]; then | |
| echo "ERROR: github-app-auth.sh not found in SHARED_DIR." | |
| echo "Ensure jira-agent-github-app-auth runs as a pre step." | |
| exit 1 | |
| fi | |
| # shellcheck source=/dev/null | |
| source "${SHARED_DIR}/github-app-auth.sh" | |
| INSTALLATION_ID_FORK_FILE="${GITHUB_APP_CREDS_DIR}/installation-id" | |
| INSTALLATION_ID_UPSTREAM_FILE="${GITHUB_APP_CREDS_DIR}/o-h-installation-id" | |
| if [ ! -f "$INSTALLATION_ID_FORK_FILE" ] || [ ! -f "$INSTALLATION_ID_UPSTREAM_FILE" ]; then | |
| echo "GitHub App credentials not yet available in ${GITHUB_APP_CREDS_DIR}" | |
| echo "Available files:" | |
| ls -la "${GITHUB_APP_CREDS_DIR}/" || echo "Directory does not exist" | |
| echo "ERROR: Required credentials are missing. Re-run once secrets are synced." | |
| exit 1 | |
| fi | |
| # Generate token for fork (hypershift-community/hypershift) - for pushing branches | |
| echo "Generating GitHub App token for fork..." | |
| GITHUB_TOKEN_FORK=$(generate_github_token "$INSTALLATION_ID_FORK") | |
| if [ -z "$GITHUB_TOKEN_FORK" ] || [ "$GITHUB_TOKEN_FORK" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for fork" | |
| exit 1 | |
| fi | |
| echo "Fork token generated successfully" | |
| INSTALLATION_ID_FORK=$(cat "$INSTALLATION_ID_FORK_FILE") | |
| INSTALLATION_ID_UPSTREAM=$(cat "$INSTALLATION_ID_UPSTREAM_FILE") | |
| # Generate token for upstream (openshift/hypershift) - for reading PRs and comments | |
| echo "Generating GitHub App token for upstream..." | |
| GITHUB_TOKEN_UPSTREAM=$(generate_github_token "$INSTALLATION_ID_UPSTREAM") | |
| if [ -z "$GITHUB_TOKEN_UPSTREAM" ] || [ "$GITHUB_TOKEN_UPSTREAM" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for upstream" | |
| exit 1 | |
| fi | |
| echo "Upstream token generated successfully" | |
| echo "Generating GitHub App token for fork..." | |
| GITHUB_TOKEN_FORK=$(generate_github_token "$INSTALLATION_ID_FORK") | |
| if [ -z "$GITHUB_TOKEN_FORK" ] || [ "$GITHUB_TOKEN_FORK" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for fork" | |
| exit 1 | |
| fi | |
| echo "Fork token generated successfully" | |
| # Configure git to use the fork token for push operations via credential helper | |
| git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f" | |
| echo "Generating GitHub App token for upstream..." | |
| GITHUB_TOKEN_UPSTREAM=$(generate_github_token "$INSTALLATION_ID_UPSTREAM") | |
| if [ -z "$GITHUB_TOKEN_UPSTREAM" ] || [ "$GITHUB_TOKEN_UPSTREAM" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for upstream" | |
| exit 1 | |
| fi | |
| echo "Upstream token generated successfully" | |
| # Export upstream token as GITHUB_TOKEN for gh CLI (used for PR operations) | |
| export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM" | |
| echo "GitHub App tokens configured successfully" | |
| git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f" | |
| export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM" | |
| echo "GitHub App tokens configured successfully" | |
| fi | |
| else | |
| # App mode: separate fork/upstream tokens | |
| echo "Loading GitHub App auth library..." | |
| if [ ! -f "${SHARED_DIR}/github-app-auth.sh" ]; then | |
| echo "ERROR: github-app-auth.sh not found in SHARED_DIR." | |
| echo "Ensure jira-agent-github-app-auth runs as a pre step." | |
| exit 1 | |
| fi | |
| # shellcheck source=/dev/null | |
| source "${SHARED_DIR}/github-app-auth.sh" | |
| INSTALLATION_ID_FORK_FILE="${GITHUB_APP_CREDS_DIR}/installation-id" | |
| INSTALLATION_ID_UPSTREAM_FILE="${GITHUB_APP_CREDS_DIR}/o-h-installation-id" | |
| if [ ! -f "$INSTALLATION_ID_FORK_FILE" ] || [ ! -f "$INSTALLATION_ID_UPSTREAM_FILE" ]; then | |
| echo "GitHub App credentials not yet available in ${GITHUB_APP_CREDS_DIR}" | |
| echo "Available files:" | |
| ls -la "${GITHUB_APP_CREDS_DIR}/" || echo "Directory does not exist" | |
| echo "ERROR: Required credentials are missing. Re-run once secrets are synced." | |
| exit 1 | |
| fi | |
| INSTALLATION_ID_FORK=$(cat "$INSTALLATION_ID_FORK_FILE") | |
| INSTALLATION_ID_UPSTREAM=$(cat "$INSTALLATION_ID_UPSTREAM_FILE") | |
| echo "Generating GitHub App token for fork..." | |
| GITHUB_TOKEN_FORK=$(generate_github_token "$INSTALLATION_ID_FORK") | |
| if [ -z "$GITHUB_TOKEN_FORK" ] || [ "$GITHUB_TOKEN_FORK" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for fork" | |
| exit 1 | |
| fi | |
| echo "Fork token generated successfully" | |
| echo "Generating GitHub App token for upstream..." | |
| GITHUB_TOKEN_UPSTREAM=$(generate_github_token "$INSTALLATION_ID_UPSTREAM") | |
| if [ -z "$GITHUB_TOKEN_UPSTREAM" ] || [ "$GITHUB_TOKEN_UPSTREAM" = "null" ]; then | |
| echo "ERROR: Failed to generate GitHub App token for upstream" | |
| exit 1 | |
| fi | |
| echo "Upstream token generated successfully" | |
| [[ $- == *x* ]] && _was_tracing=true || _was_tracing=false | |
| set +x | |
| git config --global credential.helper "!f() { echo username=x-access-token; echo password=${GITHUB_TOKEN_FORK}; }; f" | |
| export GITHUB_TOKEN="$GITHUB_TOKEN_UPSTREAM" | |
| echo "GitHub App tokens configured successfully" | |
| $_was_tracing && set -x || true | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/review-agent/process/review-agent-process-commands.sh`
around lines 151 - 195, Protect the App-mode token configuration in the block
containing GITHUB_TOKEN_FORK and GITHUB_TOKEN_UPSTREAM from shell tracing,
matching the PAT branch’s guard. Add a clear comment, disable tracing only
around the git credential.helper construction and GITHUB_TOKEN export, then
restore the prior tracing state immediately afterward. Keep token generation and
unrelated logging outside this minimal protected scope.
Source: Path instructions
| - name: REVIEW_AGENT_FORK_REPO | ||
| default: "" | ||
| documentation: |- | ||
| Fork repo URL to clone and push to (e.g. https://github.com/hypershift-community/hypershift). | ||
| Set by the team's wrapper workflow. | ||
| - name: REVIEW_AGENT_UPSTREAM_REPO | ||
| default: "" | ||
| documentation: |- | ||
| Upstream owner/repo for gh CLI PR operations (e.g. openshift/hypershift). | ||
| Set by the team's wrapper workflow. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the PAT-mode configuration contract.
review-agent-process-commands.sh derives REVIEW_AGENT_FORK_REPO in PAT mode, and the Installer wrapper relies on that behavior. Document it as required only for App mode; PAT mode requires REVIEW_AGENT_FORK_ORG and may derive the fork URL.
Also applies to: 75-81
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/review-agent/process/review-agent-process-ref.yaml`
around lines 37 - 46, Update the documentation for REVIEW_AGENT_FORK_REPO and
REVIEW_AGENT_UPSTREAM_REPO to reflect the PAT-mode contract:
REVIEW_AGENT_FORK_REPO is required only in App mode, while PAT mode requires
REVIEW_AGENT_FORK_ORG and may derive the fork URL through
review-agent-process-commands.sh. Keep the existing wrapper workflow and gh CLI
usage descriptions accurate.
| Teams onboard by creating a thin wrapper workflow that sets two env vars: | ||
| - REVIEW_AGENT_FORK_REPO: Fork repo URL to clone and push to | ||
| - REVIEW_AGENT_UPSTREAM_REPO: Upstream owner/repo for gh CLI operations | ||
|
|
||
| Teams with a different credential secret create thin ref YAML wrappers | ||
| pointing to the generic commands scripts. See ONBOARDING.md. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Onboarding docs don't mention the new PAT auth mode. Both the workflow's documentation: block and README.md describe onboarding as setting only REVIEW_AGENT_FORK_REPO/REVIEW_AGENT_UPSTREAM_REPO, but the process script (and the installer wrapper that consumes it) now also requires REVIEW_AGENT_AUTH_MODE=pat, REVIEW_AGENT_FORK_ORG, and optionally REVIEW_AGENT_PAT_KEY for PAT-mode teams. The next team onboarding via these docs would miss the PAT path entirely.
ci-operator/step-registry/review-agent/review-agent-workflow.yaml#L20-L25: extend thedocumentation:block to describe bothapp(default) andpatauth modes and their respective required env vars.ci-operator/step-registry/review-agent/README.md#L15-L25: add a row/section forREVIEW_AGENT_AUTH_MODE,REVIEW_AGENT_FORK_ORG, andREVIEW_AGENT_PAT_KEYalongside the existing table.
📍 Affects 2 files
ci-operator/step-registry/review-agent/review-agent-workflow.yaml#L20-L25(this comment)ci-operator/step-registry/review-agent/README.md#L15-L25
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/review-agent/review-agent-workflow.yaml` around
lines 20 - 25, Update the documentation block in
ci-operator/step-registry/review-agent/review-agent-workflow.yaml at lines 20-25
to document both app (default) and pat authentication modes, including each
mode’s required environment variables. Update
ci-operator/step-registry/review-agent/README.md at lines 15-25 with entries for
REVIEW_AGENT_AUTH_MODE, REVIEW_AGENT_FORK_ORG, and optional REVIEW_AGENT_PAT_KEY
alongside the existing variables.
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@enxebre: job(s): periodic-ci-openshift-installer-main-periodic-review-agent either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: your |
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
added
the
needs-rebase
aa68f96 to
32cfe89
Compare
32cfe89 to
ab6a080
Compare
|
/pj-rehearse periodic-ci-openshift-installer-main-periodic-review-agent |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
4374296 to
502ef7f
Compare
|
/pj-rehearse ack |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/approve |
openshift-ci
Bot
added
the
approved
Adds opt-in PAT authentication mode (REVIEW_AGENT_AUTH_MODE=pat) to the review-agent as an alternative to the existing GitHub App flow. In PAT mode, a single classic PAT handles fork creation, push, and PR operations against any public repo. New env vars: - REVIEW_AGENT_AUTH_MODE: "app" (default) or "pat" - REVIEW_AGENT_FORK_ORG: GitHub user/org to fork repos into (PAT mode) - REVIEW_AGENT_PAT_KEY: key name in credential secret for the PAT - REVIEW_AGENT_TARGET_PR: explicit PR number override Updates the hypershift review-agent workflow to PAT mode and the onboarding guide to document PAT as a works-out-of-the-box option. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds review-agent workflow, trigger, and CI job configuration for openshift/installer using PAT auth mode with jira-solve-bot fork org. - installer-review-agent workflow (PAT mode, auto-fork) - installer-review-agent-trigger (gangway + PAT-based PR comment) - periodic-review-agent and address-review-comments jobs in CI config - claude-ai-helpers base image for agent container steps - Generated prowjobs, metadata, and OWNERS files PR openshift#10700 hardcoded for rehearsal — remove before merge. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
502ef7f to
aa077bc
Compare
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, enxebre, patrickdillon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse ack |
|
@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@enxebre: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
…2202) * review-agent: add PAT auth mode with auto-fork Adds opt-in PAT authentication mode (REVIEW_AGENT_AUTH_MODE=pat) to the review-agent as an alternative to the existing GitHub App flow. In PAT mode, a single classic PAT handles fork creation, push, and PR operations against any public repo. New env vars: - REVIEW_AGENT_AUTH_MODE: "app" (default) or "pat" - REVIEW_AGENT_FORK_ORG: GitHub user/org to fork repos into (PAT mode) - REVIEW_AGENT_PAT_KEY: key name in credential secret for the PAT - REVIEW_AGENT_TARGET_PR: explicit PR number override Updates the hypershift review-agent workflow to PAT mode and the onboarding guide to document PAT as a works-out-of-the-box option. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * installer: add review-agent CI jobs with PAT auth Adds review-agent workflow, trigger, and CI job configuration for openshift/installer using PAT auth mode with jira-solve-bot fork org. - installer-review-agent workflow (PAT mode, auto-fork) - installer-review-agent-trigger (gangway + PAT-based PR comment) - periodic-review-agent and address-review-comments jobs in CI config - claude-ai-helpers base image for agent container steps - Generated prowjobs, metadata, and OWNERS files PR openshift#10700 hardcoded for rehearsal — remove before merge. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![openshift-prow[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…2202) * review-agent: add PAT auth mode with auto-fork Adds opt-in PAT authentication mode (REVIEW_AGENT_AUTH_MODE=pat) to the review-agent as an alternative to the existing GitHub App flow. In PAT mode, a single classic PAT handles fork creation, push, and PR operations against any public repo. New env vars: - REVIEW_AGENT_AUTH_MODE: "app" (default) or "pat" - REVIEW_AGENT_FORK_ORG: GitHub user/org to fork repos into (PAT mode) - REVIEW_AGENT_PAT_KEY: key name in credential secret for the PAT - REVIEW_AGENT_TARGET_PR: explicit PR number override Updates the hypershift review-agent workflow to PAT mode and the onboarding guide to document PAT as a works-out-of-the-box option. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * installer: add review-agent CI jobs with PAT auth Adds review-agent workflow, trigger, and CI job configuration for openshift/installer using PAT auth mode with jira-solve-bot fork org. - installer-review-agent workflow (PAT mode, auto-fork) - installer-review-agent-trigger (gangway + PAT-based PR comment) - periodic-review-agent and address-review-comments jobs in CI config - claude-ai-helpers base image for agent container steps - Generated prowjobs, metadata, and OWNERS files PR openshift#10700 hardcoded for rehearsal — remove before merge. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 participants
Summary
REVIEW_AGENT_AUTH_MODE=pat) to the review-agent — single classic PAT for fork creation, push, and PR operations against any public repoTest plan
periodic-ci-openshift-installer-main-periodic-review-agent(hardcoded to PR OCPBUGS-99229: fix(bootstrap): detect CVO render flag support before passing optional flags installer#10700)jira-solve-bot/installerREVIEW_AGENT_TARGET_PRbefore mergetested via openshift/installer#10700
/hold
🤖 Generated with Claude Code
Summary by CodeRabbit
REVIEW_AGENT_AUTH_MODE=pat), enabling fork creation/push and PR/comment operations against public GitHub repos in PAT mode (with documented PAT vs GitHub App requirements).review-agentsetup/process/report step-registry components, and updates the HyperShift wrapper wiring/docs accordingly.REVIEW_AGENT_AUTH_MODE: "pat").openshift/installer:installer-review-agentworkflow that runs the generic review-agent steps in PAT mode and includes a temporary rehearsal hardcode forREVIEW_AGENT_TARGET_PR: "10700"(to be removed before merge).installer-review-agent-triggerworkflow plus a Gangway-based trigger script to run the installer periodic review-agent and, when possible, post a “view job” link back to the PR as a comment.ci-operator/config/openshift/installer/openshift-installer-main.yamlwith aclaude-ai-helpersbase image entry and new installer periodic/review jobs (periodic-review-agentand optionaladdress-review-comments).JOB_STATUSvariable during Gangway polling.