review-agent: add PAT auth mode and installer onboarding

ci-operator/config/openshift/installer/openshift-installer-main.yaml

@@ -1612,6 +1612,16 @@ tests:
     env:
       JIRA_AGENT_MAX_ISSUES: "1"
     workflow: installer-jira-agent
+- as: periodic-review-agent
+  cron: '@yearly'
+  steps:
+    workflow: installer-review-agent
+- always_run: false
+  as: address-review-comments
+  optional: true
+  skip_if_only_changed: .*
+  steps:
+    workflow: installer-review-agent-trigger
 zz_generated_metadata:
   branch: main
   org: openshift

ci-operator/jobs/openshift/installer/openshift-installer-main-periodics.yaml

@@ -90,3 +90,94 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build01
+  cron: '@yearly'
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - images/baremetal/Dockerfile.ci
+    - images/installer/Dockerfile.ci
+    - images/installer/Dockerfile.upi.ci
+    - images/libvirt/Dockerfile.ci
+    - images/openstack/Dockerfile.ci
+  extra_refs:
+  - base_ref: main
+    org: openshift
+    repo: installer
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - images/baremetal/Dockerfile.ci
+    - images/installer/Dockerfile.ci
+    - images/installer/Dockerfile.upi.ci
+    - images/libvirt/Dockerfile.ci
+    - images/openstack/Dockerfile.ci
+  labels:
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-installer-main-periodic-review-agent
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=periodic-review-agent
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator

ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml

@@ -1,5 +1,93 @@
 presubmits:
   openshift/installer:
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build01
+    context: ci/prow/address-review-comments
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - images/baremetal/Dockerfile.ci
+      - images/installer/Dockerfile.ci
+      - images/installer/Dockerfile.upi.ci
+      - images/libvirt/Dockerfile.ci
+      - images/openstack/Dockerfile.ci
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-installer-main-address-review-comments
+    optional: true
+    rerun_command: /test address-review-comments
+    skip_if_only_changed: .*
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=address-review-comments
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )address-review-comments,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:

ci-operator/step-registry/hypershift/review-agent/README.md

@@ -12,6 +12,9 @@ configuration:
 | `REVIEW_AGENT_FORK_REPO` | `https://github.com/hypershift-community/hypershift` |
 | `REVIEW_AGENT_UPSTREAM_REPO` | `openshift/hypershift` |
 
+This uses App mode (the default). For PAT mode, set `REVIEW_AGENT_AUTH_MODE="pat"` and
+`REVIEW_AGENT_FORK_ORG` instead of `REVIEW_AGENT_FORK_REPO` — the fork URL is auto-derived.
+
 Credentials use the `hypershift-team-claude-prow` secret (configured in the generic step refs).
 
 ## Jobs

ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml

@@ -9,7 +9,8 @@ workflow:
     post:
       - ref: review-agent-report
     env:
-      REVIEW_AGENT_FORK_REPO: "https://github.com/hypershift-community/hypershift"
+      REVIEW_AGENT_AUTH_MODE: "pat"
+      REVIEW_AGENT_FORK_ORG: "jira-solve-bot"
       REVIEW_AGENT_UPSTREAM_REPO: "openshift/hypershift"
   documentation: |-
     HyperShift-specific wrapper for the generic review-agent workflow.

ci-operator/step-registry/installer/review-agent/OWNERS

@@ -0,0 +1,10 @@
+approvers:
+- bryan-cox
+- csrwng
+- celebdor
+- enxebre
+reviewers:
+- bryan-cox
+- csrwng
+- celebdor
+- enxebre

ci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.metadata.json

@@ -0,0 +1,17 @@
+{
+	"path": "installer/review-agent/installer-review-agent-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"bryan-cox",
+			"csrwng",
+			"celebdor",
+			"enxebre"
+		],
+		"reviewers": [
+			"bryan-cox",
+			"csrwng",
+			"celebdor",
+			"enxebre"
+		]
+	}
+}

ci-operator/step-registry/installer/review-agent/installer-review-agent-workflow.yaml

@@ -0,0 +1,19 @@
+workflow:
+  as: installer-review-agent
+  steps:
+    pre:
+      - ref: review-agent-setup
+    test:
+      - ref: review-agent-process
+    post:
+      - ref: review-agent-report
+    env:
+      REVIEW_AGENT_AUTH_MODE: "pat"
+      REVIEW_AGENT_FORK_ORG: "jira-solve-bot"
+      REVIEW_AGENT_UPSTREAM_REPO: "openshift/installer"
+  documentation: |-
+    Installer-specific wrapper for the generic review-agent workflow.
+    Uses PAT auth mode — auto-forks openshift/installer into jira-solve-bot
+    for push operations.
+
+    Credentials: Uses hypershift-team-claude-prow (shared secret with gh-pat).

ci-operator/step-registry/installer/review-agent/trigger/OWNERS

@@ -0,0 +1,10 @@
+approvers:
+- bryan-cox
+- csrwng
+- celebdor
+- enxebre
+reviewers:
+- bryan-cox
+- csrwng
+- celebdor
+- enxebre

ci-operator/step-registry/installer/review-agent/trigger/installer-review-agent-trigger-commands.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "=== Installer Review Agent Trigger ==="
+
+PR_NUMBER="${PULL_NUMBER:-}"
+if [ -z "$PR_NUMBER" ]; then
+  echo "ERROR: PULL_NUMBER not set. This step must run as a presubmit."
+  exit 1
+fi
+echo "Triggering review agent for PR #$PR_NUMBER"
+
+UPSTREAM_REPO="${REVIEW_AGENT_UPSTREAM_REPO:-openshift/installer}"
+CREDS_DIR="/var/run/claude-code-service-account"
+TOKEN_FILE="${CREDS_DIR}/gangway-token"
+PAT_FILE="${CREDS_DIR}/${REVIEW_AGENT_PAT_KEY:-gh-pat}"
+
+if [ ! -f "$TOKEN_FILE" ]; then
+  echo "ERROR: Gangway token not found at ${TOKEN_FILE}"
+  exit 1
+fi
+
+POST_DATA=$(jq -n --arg pr "$PR_NUMBER" \
+  '{job_execution_type: "1", pod_spec_options: {envs: {MULTISTAGE_PARAM_OVERRIDE_REVIEW_AGENT_TARGET_PR: $pr}}}')
+
+echo "Triggering periodic job: ${PERIODIC_JOB_NAME}"
+
+MAX_RETRIES=10
+RETRY_INTERVAL=10
+JOB_ID=""
+
+for ((i=1; i<=MAX_RETRIES; i++)); do
+  set +x
+  RESPONSE=$(curl -s -X POST -d "${POST_DATA}" \
+    -H "Authorization: Bearer $(cat "${TOKEN_FILE}")" \
+    "${GANGWAY_API}/v1/executions/${PERIODIC_JOB_NAME}" \
+    -w "\n%{http_code}")
+  set -x
+  HTTP_STATUS=$(echo "$RESPONSE" | tail -1)
+  JSON_BODY=$(echo "$RESPONSE" | sed '$d')
+
+  if [ "$HTTP_STATUS" -eq 200 ]; then
+    JOB_ID=$(echo "$JSON_BODY" | jq -r '.id')
+    echo "Job triggered successfully. Job ID: ${JOB_ID}"
+    break
+  else
+    echo "[$i/$MAX_RETRIES] Gangway API returned HTTP $HTTP_STATUS. Retrying in ${RETRY_INTERVAL}s..."
+    sleep "$RETRY_INTERVAL"
+  fi
+done
+
+if [ -z "$JOB_ID" ] || [ "$JOB_ID" = "null" ]; then
+  echo "ERROR: Failed to trigger periodic job after $MAX_RETRIES retries"
+  exit 1
+fi
+
+# Poll gangway for the Prow job URL (up to ~60s)
+sleep 10
+
+set +x
+JOB_URL=""
+for ((i=1; i<=10; i++)); do
+  STATUS_RESPONSE=$(curl -s -X GET \
+    -H "Authorization: Bearer $(cat "${TOKEN_FILE}")" \
+    "${GANGWAY_API}/v1/executions/${JOB_ID}" \
+    -w "\n%{http_code}")
+  STATUS_HTTP=$(echo "$STATUS_RESPONSE" | tail -1)
+  STATUS_BODY=$(echo "$STATUS_RESPONSE" | sed '$d')
+
+  if [ "$STATUS_HTTP" -eq 200 ]; then
+    JOB_URL=$(echo "$STATUS_BODY" | jq -r '.job_url // empty')
+    if [ -n "$JOB_URL" ]; then
+      echo "Job URL: ${JOB_URL}"
+      break
+    fi
+  fi
+  echo "[$i/10] Waiting for Prow job URL..."
+  sleep 5
+done
+set -x
+
+# Post a comment on the PR using the PAT
+if [ -f "$PAT_FILE" ]; then
+  echo "Posting PR comment..."
+  [[ $- == *x* ]] && _was_tracing=true || _was_tracing=false
+  set +x
+
+  GITHUB_TOKEN_PAT=$(cat "$PAT_FILE")
+
+  if [ -n "$JOB_URL" ]; then
+    COMMENT_BODY="Review agent triggered. [View job](${JOB_URL})"
+  else
+    COMMENT_BODY="Review agent triggered (Gangway execution ID: \`${JOB_ID}\`). The Prow job has not started yet — check the [job history](https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/${PERIODIC_JOB_NAME}) for the run once it begins."
+  fi
+
+  curl --fail --silent --show-error -X POST \
+    -H "Authorization: token ${GITHUB_TOKEN_PAT}" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/${UPSTREAM_REPO}/issues/${PR_NUMBER}/comments" \
+    -d "$(jq -n --arg body "$COMMENT_BODY" '{body: $body}')" > /dev/null
+
+  $_was_tracing && set -x || true
+  echo "Comment posted on PR #$PR_NUMBER"
+else
+  echo "WARNING: PAT not found at ${PAT_FILE}, skipping PR comment"
+fi
+
+echo "=== Trigger Complete ==="
+echo "Job ID: ${JOB_ID}"
+echo "Job URL: ${JOB_URL:-pending}"