Add integration test presubmit for openshift/sippy

[redhat-chai-bot]

What

Adds a presubmit job that runs sippy's integration tests using testcontainers-go with nested podman support.

How

The test image is built inline using dockerfile_literal — it extends the devcontainer (.devcontainer/Dockerfile, which has podman + fuse-overlayfs + the nested-podman entrypoint) with the source tree. No Dockerfile.integration file is needed in the sippy repo.

Image build (inline)

- dockerfile_literal: |
    FROM sippy-devcontainer
    COPY --chown=1000:0 . /workspace
    WORKDIR /workspace
  to: sippy-integration

ci-operator resolves FROM sippy-devcontainer to the pipeline image built from .devcontainer/Dockerfile.

Integration test

- as: integration
  capabilities:
  - nested-podman
  commands: /nested-podman-entrypoint.sh make integration
  container:
    from: sippy-integration
  nested_podman: true
  skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$

• nested_podman: true grants the pod user namespace support, /dev/fuse, and SETUID/SETGID capabilities via the nested-podman SCC
• The entrypoint script configures rootless podman (subuid/subgid, storage, API socket) so testcontainers-go can start PostgreSQL

Generated presubmit

• Job name: pull-ci-openshift-sippy-main-integration
• Trigger: /test integration
• Required for merge (not optional)
• Skips doc-only changes

Companion PR (adds podman to devcontainer, deletes Dockerfile.integration): openshift/sippy#3882

Jira: TRT-2865

[redhat-chai-bot]

/pj-rehearse auto-ack

---

AI-generated. Review for accuracy.

[redhat-chai-bot]

This PR replaces the closed #82968 and addresses @smg247's review feedback: the integration test image now extends sippy-devcontainer (from .devcontainer/Dockerfile) instead of maintaining a separate Dockerfile.integration with its own podman installation.

The companion sippy PR adding podman support to the devcontainer is openshift/sippy#3882 — the rehearsal will pass once that merges.

---

AI-generated. Review for accuracy.

[openshift-merge-bot]

@redhat-chai-bot: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[coderabbitai]

Walkthrough

The CI configuration adds a sippy-integration image and an integration test that uses nested Podman to run make integration.

Changes

Sippy integration testing

Layer / File(s)	Summary
Define integration image ci-operator/config/openshift/sippy/openshift-sippy-main.yaml	Adds the Dockerfile.integration image definition targeting sippy-integration.
Run integration test ci-operator/config/openshift/sippy/openshift-sippy-main.yaml	Adds a nested-Podman test that runs /nested-podman-entrypoint.sh make integration with the sippy-integration image and the existing documentation-only skip filter.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch changes only CI YAML and generated Prow jobs; it adds no Ginkgo test declarations or dynamic test titles.
Test Structure And Quality	✅ Passed	The PR changes only CI YAML and generated job files; it adds no Ginkgo It blocks or cluster-test code to assess against these requirements.
Microshift Test Compatibility	✅ Passed	The pull request changes only CI configuration and generated job YAML; it adds no Ginkgo e2e tests or test declarations requiring MicroShift API compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only CI YAML and generated job files; it adds no Ginkgo e2e tests or multi-node cluster assumptions requiring SNO review.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only CI image and Prow presubmit/postsubmit metadata; it adds no deployment, controller, or workload scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The pull request changes only three YAML CI files. It adds no Go or OTE binary process code, so the stdout contract check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit adds only CI YAML and no Ginkgo test code, IPv4 literals, URL construction, or public-network access; the new job runs the existing integration target.
No-Weak-Crypto	✅ Passed	The commit adds only CI YAML and generated job configuration; no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons appear in the changed content.
Container-Privileges	✅ Passed	The added CI config and generated job contain no privileged:true, host namespace, SYS_ADMIN, root, securityContext, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The patch adds CI image and integration-job configuration only; searches found no logging commands or literal passwords, tokens, API keys, PII, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding an integration test presubmit for openshift/sippy.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign jupierce for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

@redhat-chai-bot, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto ceaff8c653850126b964f14876f9acde7ca73014 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ci-operator-config	3a6f4d5	link	true	/test ci-operator-config
ci/prow/check-gh-automation	3a6f4d5	link	true	/test check-gh-automation
ci/prow/generated-config	3a6f4d5	link	true	/test generated-config
ci/prow/yamllint	3a6f4d5	link	true	/test yamllint
ci/prow/ci-operator-registry	3a6f4d5	link	true	/test ci-operator-registry
ci/prow/ordered-prow-config	3a6f4d5	link	true	/test ordered-prow-config
ci/prow/prow-config-filenames	3a6f4d5	link	true	/test prow-config-filenames
ci/prow/ci-operator-config-metadata	3a6f4d5	link	true	/test ci-operator-config-metadata
ci/prow/owners	3a6f4d5	link	true	/test owners
ci/prow/core-valid	3a6f4d5	link	true	/test core-valid
ci/prow/openshift-image-mirror-mappings	3a6f4d5	link	true	/test openshift-image-mirror-mappings
ci/prow/release-controller-config	3a6f4d5	link	true	/test release-controller-config

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.