SDCICD-1942: Add branch protection for hp-gitops-manifests overlay branches

[ritmun]

Summary

• Adds branch protection for overlays/int, overlays/stage, overlays/prod and their -next variants in openshift-online/hp-gitops-manifests

###Why
https://github.com/argoproj-labs/gitops-promoter/blob/main/docs/getting-started.md

Make sure your staging branches are not auto-deleted when PRs are merged.

• Restricts pushes to the gitops-automator GitHub App, mirroring the pattern used by openshift-online/gcp-hcp-infra
• Adds gitops-automator as a trusted app in the plugin config

###Why
following risk-averse config used by openshift-online/gcp-hcp-infra

Test plan

• make prow-config passes without errors
• Verify branch protection rules are applied after merge via GitHub branch settings

🤖 Generated with Claude Code

Summary by CodeRabbit

• Added branch protection for six overlays and overlays-next branches in openshift-online/hp-gitops-manifests.
• Restricted pushes to the gitops-automator GitHub App.
• Added gitops-automator as a trusted application in the Prow plugin configuration.
• make prow-config passes. Verification of the applied GitHub settings remains pending.

[openshift-ci-robot]

@ritmun: This pull request references SDCICD-1942 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds branch protection for overlays/int, overlays/stage, overlays/prod and their -next variants in openshift-online/hp-gitops-manifests
• Restricts pushes to the gitops-automator GitHub App, mirroring the pattern used by openshift-online/gcp-hcp-infra
• Adds gitops-automator as a trusted app in the plugin config

Test plan

• make prow-config passes without errors
• Verify branch protection rules are applied after merge via GitHub branch settings

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The trigger configuration trusts gitops-automator. Branch protection configuration covers six overlay branches and restricts permitted applications to gitops-automator.

Changes

GitOps automator protection

Layer / File(s)	Summary
Trusted automation and branch protection core-services/prow/02_config/openshift-online/hp-gitops-manifests/_pluginconfig.yaml, core-services/prow/02_config/openshift-online/hp-gitops-manifests/_prowconfig.yaml	The trigger trusts gitops-automator. The int, int-next, prod, prod-next, stage, and stage-next branches restrict permitted applications to gitops-automator. The non-next branches require zero pull-request approvals.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	This PR modifies only YAML configuration files (Prow plugin and branch protection configs) with no Ginkgo test code. The check for stable test names is not applicable.
Test Structure And Quality	✅ Passed	The PR modifies only YAML configuration files for Prow CI/CD system. No Ginkgo test code or Go test files exist in this PR. The check for Ginkgo test quality is not applicable.
Microshift Test Compatibility	✅ Passed	Pull request contains only Prow CI/CD configuration YAML files (_pluginconfig.yaml and _prowconfig.yaml). No Ginkgo e2e tests (It(), Describe(), Context(), etc.) are present, so MicroShift test com...
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only Prow YAML configuration files and adds no Ginkgo e2e tests or other test code; the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Pull request modifies Prow CI/CD configuration files (_pluginconfig.yaml, _prowconfig.yaml) that define branch protection rules and trusted applications. No deployment manifests, operator code, con...
Ote Binary Stdout Contract	✅ Passed	The PR modifies only Prow YAML configuration files. The custom check addresses OTE binary stdout contracts in Go test code. No Go code, test binaries, or stdout-producing code exists in this PR.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The custom check targets Ginkgo e2e tests. This PR modifies only Prow YAML configuration files (_pluginconfig.yaml, _prowconfig.yaml) and contains no Ginkgo test code. The check is not applicable.
No-Weak-Crypto	✅ Passed	The pull request modifies only Prow configuration files (YAML) that set branch protection rules and plugin settings; they contain no cryptographic code, weak algorithms, or secret comparisons.
Container-Privileges	✅ Passed	The pull request modifies only Prow configuration files (_pluginconfig.yaml and _prowconfig.yaml), not Kubernetes manifests. These files contain CI/CD and branch protection settings with no contain...
No-Sensitive-Data-In-Logs	✅ Passed	Pull request adds only configuration data with public identifiers and framework keywords. No logging statements, passwords, tokens, API keys, PII, or customer data are introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding branch protection for the hp-gitops-manifests overlay branches.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ritmun: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

@ritmun: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@core-services/prow/02_config/openshift-online/hp-gitops-manifests/_prowconfig.yaml`:
- Around line 7-42: Update each branch protection entry under overlays/int,
overlays/int-next, overlays/prod, overlays/prod-next, overlays/stage, and
overlays/stage-next to set enforce_admins to true, alongside the existing
protect and restrictions configuration. Verify the resulting GitHub protection
rules apply administrator enforcement to all six branches.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 92fd0649-65ba-4740-b15c-cac230d0ca45

📥 Commits

Reviewing files that changed from the base of the PR and between f34bc05 and 561bc1b.

📒 Files selected for processing (2)

• core-services/prow/02_config/openshift-online/hp-gitops-manifests/_pluginconfig.yaml
• core-services/prow/02_config/openshift-online/hp-gitops-manifests/_prowconfig.yaml

[jfchevrette]

/approve

[jfchevrette]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jfchevrette, ritmun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/openshift-online/hp-gitops-manifests/OWNERS [jfchevrette,ritmun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@ritmun: Updated the following 2 configmaps:

• config configmap in namespace ci at cluster app.ci using the following files:
  • key core-services-prow-02_config-openshift-online-hp-gitops-manifests-_prowconfig.yaml using file core-services/prow/02_config/openshift-online/hp-gitops-manifests/_prowconfig.yaml
• config configmap in namespace ci at cluster core-ci using the following files:
  • key core-services-prow-02_config-openshift-online-hp-gitops-manifests-_prowconfig.yaml using file core-services/prow/02_config/openshift-online/hp-gitops-manifests/_prowconfig.yaml

Details

In response to this:

Summary

• Adds branch protection for overlays/int, overlays/stage, overlays/prod and their -next variants in openshift-online/hp-gitops-manifests

###Why
https://github.com/argoproj-labs/gitops-promoter/blob/main/docs/getting-started.md

Make sure your staging branches are not auto-deleted when PRs are merged.

• Restricts pushes to the gitops-automator GitHub App, mirroring the pattern used by openshift-online/gcp-hcp-infra
• Adds gitops-automator as a trusted app in the plugin config

###Why
following risk-averse config used by openshift-online/gcp-hcp-infra

Test plan

• make prow-config passes without errors
• Verify branch protection rules are applied after merge via GitHub branch settings

🤖 Generated with Claude Code

Summary by CodeRabbit

• Added branch protection for six overlays and overlays-next branches in openshift-online/hp-gitops-manifests.
• Restricted pushes to the gitops-automator GitHub App.
• Added gitops-automator as a trusted application in the Prow plugin configuration.
• make prow-config passes. Verification of the applied GitHub settings remains pending.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.