MCO-2451: Make tls-pqc-readiness a required presubmit test

[isabella-janssen]

This is a follow-up to #82232. It bumps the tls-pqc-readiness job to required and adds the test for the 5.1 branch.

Summary by CodeRabbit

• Makes the tls-pqc-readiness job a required presubmit for the Machine Config Operator, while skipping it for documentation-only and other non-code changes.
• Adds the same readiness test configuration to the MCO 5.1 branch, including PQC scanning settings and AWS execution workflow.
• Updates the 5.0 branch to use the conditional skip behavior.

[openshift-ci-robot]

@isabella-janssen: This pull request references MCO-2451 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This bumps the tls-pqc-readiness job to required and adds the test for the 5.1 branch.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The CI configuration updates TLS PQC readiness job skip conditions for main and release 5.0, and adds the job to release 5.1 with AWS execution, PQC scanning settings, referenced TLS test steps, and the ipi-aws workflow.

Changes

TLS PQC readiness CI

Layer / File(s)	Summary
TLS PQC readiness job configuration ci-operator/config/openshift/machine-config-operator/openshift-machine-config-operator-*.yaml	Existing main and release 5.0 jobs gain path-based skip rules, while release 5.1 adds a disabled-by-default AWS job with PQC scanning environment variables, tls-13 and tls-scanner-run steps, and the ipi-aws workflow.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82254: Introduces the TLS scanner test and step setup used by the PQC readiness job.
• openshift/release#82555: Wires the tls-scanner-run step and PQC environment settings into CI jobs.
• openshift/release#82659: Adds related TLS scanning jobs using the same TLS test steps and PQC settings.

Suggested reviewers: sergiordlr

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Touched files are only ci-operator YAML/job configs; no Ginkgo test titles were added or changed, so no unstable names were introduced.
Test Structure And Quality	✅ Passed	Only ci-operator YAML changed; no Ginkgo/spec test code was touched, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS — The PR only changes ci-operator job/config YAML; no new Go/Ginkgo e2e tests or test bodies were added, so MicroShift compatibility isn’t implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only CI config/job YAML changed; no new Ginkgo e2e test code was added, and the referenced TLS steps are existing workflows/scripts.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only changes CI/job config and presubmit metadata; no deployment manifests, controllers, or scheduling logic were modified.
Ote Binary Stdout Contract	✅ Passed	PR only changes ci-operator/job YAML; no binary process code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only CI YAML changed; no new Ginkgo test code was added, and the referenced tls-13/tls-scanner-run steps show no IPv4-only or public-internet assumptions.
No-Weak-Crypto	✅ Passed	Changes only adjust CI job metadata and add a presubmit wiring to existing tls-13/tls-scanner-run refs; no MD5/SHA1/DES/RC4/3DES/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Changed CI/job YAMLs add tls-pqc-readiness only; no privileged, hostPID/Network/IPC, allowPrivilegeEscalation, SYS_ADMIN, or root settings appear.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes CI job wiring/skip rules; I found no passwords, tokens, PII, internal hostnames, or other sensitive log data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: promoting tls-pqc-readiness in CI and adding it for the 5.1 branch.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@isabella-janssen: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-machine-config-operator-main-tls-pqc-readiness	openshift/machine-config-operator	presubmit	Presubmit changed
pull-ci-openshift-machine-config-operator-release-5.0-tls-pqc-readiness	openshift/machine-config-operator	presubmit	Presubmit changed
pull-ci-openshift-machine-config-operator-release-5.1-tls-pqc-readiness	openshift/machine-config-operator	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[isabella-janssen]

/pj-rehearse skip

We can post-merge verify this by tracking the success rate on MCO PRs.

[openshift-merge-bot]

@isabella-janssen: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[pablintino]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: isabella-janssen, pablintino

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/machine-config-operator/OWNERS [isabella-janssen,pablintino]
• ci-operator/jobs/openshift/machine-config-operator/OWNERS [isabella-janssen,pablintino]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@isabella-janssen: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.