Skip to content

OSPRH-33247: Update openshift/release CAPO rebasebot periodic configs to reference hook script - #82967

Open
dlaw4608 wants to merge 1 commit into
openshift:mainfrom
shiftstack:post_rebase_hooks
Open

OSPRH-33247: Update openshift/release CAPO rebasebot periodic configs to reference hook script #82967
dlaw4608 wants to merge 1 commit into
openshift:mainfrom
shiftstack:post_rebase_hooks

Conversation

@dlaw4608

@dlaw4608 dlaw4608 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Why this is needed:

The CAPO rebasebot periodic jobs for main, release-4.21, and release-4.22 have been consistently failing since the upstream sigs.k8s.io/cluster-api module was split. The builtin _BUILTIN_/update_go_modules.sh hook resets all go.mod files to upstream versions and runs go mod tidy on every module in the repo, including ./hack/tools.

This cannot be fixed with the builtin because it wipes any downstream pins before running go mod tidy. The custom hook avoids this entirely by running make merge-bot, which uses the fork's own vendoring logic with pinned dependencies.

What this PR does:

  • Replace --update-go-modules with --post-rebase-hook git:dest/main:hack/rebasebot-helpers/post-rebase.sh across all 8 CAPO periodic rebasebot configs (main + release-4.16 through 4.22)
  • The builtin update_go_modules.sh hook resets go.mod to upstream and runs go mod tidy unconstrained, which resolves sigs.k8s.io/cluster-api/api@latest to v1.14.0-rc.0 — an incompatible pre-release that no longer contains the v1beta1
    package
  • The custom hook runs make merge-bot instead, which handles downstream vendoring with pinned dependencies

Depends on openshift/cluster-api-provider-openstack#428.

Summary by CodeRabbit

This PR updates the CAPO periodic rebasebot jobs for main and release branches 4.16 through 4.22.

It replaces the built-in --update-go-modules step with --post-rebase-hook git:dest/main:hack/rebasebot-helpers/post-rebase.sh.

This change makes the rebase flow run make merge-bot after each rebase. That keeps downstream dependency pins intact and avoids an incompatible resolution of sigs.k8s.io/cluster-api/api.

The change depends on openshift/cluster-api-provider-openstack#428.

…-rebase hook

  The builtin --update-go-modules hook fails on CAPO because go mod tidy
  resolves sigs.k8s.io/cluster-api/api@latest to an incompatible version
  (v1.14.0-rc.0) that no longer contains the v1beta1 package. Replace it
  with a custom --post-rebase-hook that runs make merge-bot, which handles
  downstream vendoring correctly with pinned dependencies.

  Depends on openshift/cluster-api-provider-openstack#428.

Signed-off-by: Daniel Lawton <dlawton@redhat.com>
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 5, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@dlaw4608: This pull request references OSPRH-33247 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Why this is needed:

The CAPO rebasebot periodic jobs for main, release-4.21, and release-4.22 have been consistently failing since the upstream sigs.k8s.io/cluster-api module was split. The builtin _BUILTIN_/update_go_modules.sh hook resets all go.mod files to upstream versions and runs go mod tidy on every module in the repo, including ./hack/tools.

This cannot be fixed with the builtin because it wipes any downstream pins before running go mod tidy. The custom hook avoids this entirely by running make merge-bot, which uses the fork's own vendoring logic with pinned dependencies.

What this PR does:

  • Replace --update-go-modules with --post-rebase-hook git:dest/main:hack/rebasebot-helpers/post-rebase.sh across all 8 CAPO periodic rebasebot configs (main + release-4.16 through 4.22)
  • The builtin update_go_modules.sh hook resets go.mod to upstream and runs go mod tidy unconstrained, which resolves sigs.k8s.io/cluster-api/api@latest to v1.14.0-rc.0 — an incompatible pre-release that no longer contains the v1beta1
    package
  • The custom hook runs make merge-bot instead, which handles downstream vendoring with pinned dependencies

Depends on openshift/cluster-api-provider-openstack#428.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@dlaw4608

dlaw4608 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

/hold

@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f5318e0-62ed-43d6-b8b8-7f069e8a3eb9

📥 Commits

Reviewing files that changed from the base of the PR and between d82fdb7 and 6fd6741.

📒 Files selected for processing (8)
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-main__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.16__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.17__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.18__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.19__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.20__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.21__periodics.yaml
  • ci-operator/config/openshift/cluster-api-provider-openstack/openshift-cluster-api-provider-openstack-release-4.22__periodics.yaml

Walkthrough

The OpenStack periodic rebasebot configurations now invoke hack/rebasebot-helpers/post-rebase.sh from the destination repository and remove the --update-go-modules option.

Changes

OpenStack periodic rebase workflows

Layer / File(s) Summary
Periodic rebasebot hook configuration
ci-operator/config/openshift/cluster-api-provider-openstack/*__periodics.yaml
All eight periodic commands replace --update-go-modules with the destination repository’s --post-rebase-hook targeting hack/rebasebot-helpers/post-rebase.sh.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes updating CAPO OpenShift release rebasebot periodic configurations to use a hook script.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PR contains only CI/CD YAML configuration files, not Ginkgo test code. The custom check for stable test names does not apply to non-test files.
Test Structure And Quality ✅ Passed The PR changes only eight YAML rebasebot periodic configs; no Ginkgo test files or Ginkgo constructs appear in the changed scope, so these test-quality requirements are not applicable.
Microshift Test Compatibility ✅ Passed The commit changes only eight YAML rebasebot configurations and adds no Ginkgo tests or test declarations, so MicroShift compatibility checks are not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The PR changes only eight periodic YAML command lines; it adds no Ginkgo tests or test source paths, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed Changes are CI/CD configuration files only (rebasebot job configs). No deployment manifests, operator code, or scheduling constraints are introduced.
Ote Binary Stdout Contract ✅ Passed This PR modifies only CI operator configuration YAML files for CAPO periodic jobs, not test binary code or Go source. The OTE Binary Stdout Contract check applies only to test binary stdout behavio...
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo e2e tests are added in this PR. Changes are limited to CI/CD YAML configuration files for rebasebot periodic jobs, making the IPv6/disconnected network compatibility check not applicable.
No-Weak-Crypto ✅ Passed The PR modifies only CI/CD YAML configuration files, replacing the --update-go-modules parameter with a custom post-rebase hook reference. No cryptographic algorithms, implementations, or weak cryp...
Container-Privileges ✅ Passed All eight modified YAML configuration files lack privileged container settings: no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root user indicators were found.
No-Sensitive-Data-In-Logs ✅ Passed The commit changes only eight lines to a non-sensitive hook path; no passwords, tokens, API keys, PII, hostnames, or customer data are added or logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 5, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@dlaw4608: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-cluster-api-provider-openstack-release-4.21-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-main-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.18-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.17-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.19-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.20-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.22-periodics-rebasebot N/A periodic Ci-operator config changed
periodic-ci-openshift-cluster-api-provider-openstack-release-4.16-periodics-rebasebot N/A periodic Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-ci
openshift-ci Bot requested review from mandre and stephenfin August 5, 2026 13:33
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dlaw4608
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@dlaw4608: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants