Removed duplicated sections and moved build stuff to gsm

[hector-vido]

Moved build12 and build13 manifest-tool-local-pusher from _config.yaml to gsm-config.yaml and added missing push/pull build clusters secrets into _config.yaml.
De-duplicated sections.

The script used to de-duplicate sections was the following one:

import sys, yaml

with open("/home/hector/Projects/openshift/release/core-services/ci-secret-bootstrap/_config.yaml", "r") as file:
  data = yaml.safe_load(file)
  for secret1 in data["secret_configs"]:
    i = 0
    for secret2 in data["secret_configs"]:
      if secret1 == secret2:
        continue
      if secret1["from"] == secret2["from"]:
        print(secret1["to"])
        print("######################")
        print(secret2["to"])
        sys.exit(0)

NO AI WAS USED DURING THESE MODIFICATIONS, ONLY FOR VALIDATION.

Summary by CodeRabbit

• Moved build12 and build13 manifest-tool-local-pusher credentials from _config.yaml to gsm-config.yaml.
• Removed duplicate and obsolete CI secret mappings.
• Updated secret distribution for build registries and AWS, Azure, AlibabaCloud, Hypershift, OCI, virtualization, PowerVS, RHOAI, and other cluster destinations.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hector-vido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [hector-vido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2c5cc038-db69-4abc-96bd-f8bb50e624d9

📥 Commits

Reviewing files that changed from the base of the PR and between 6200a4e and f13c8ab.

📒 Files selected for processing (2)

• core-services/ci-secret-bootstrap/_config.yaml
• core-services/ci-secret-bootstrap/gsm-config.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• core-services/ci-secret-bootstrap/_config.yaml

---

Walkthrough

The CI secret bootstrap configuration adds registry credentials, expands cluster-secret destinations, removes obsolete mappings, and adds build12/build13 local image-pusher bundles.

Changes

CI secret bootstrap

Layer / File(s)	Summary
Registry credentials and local pushers core-services/ci-secret-bootstrap/_config.yaml, core-services/ci-secret-bootstrap/gsm-config.yaml	Registry pull credentials were added for build03–build08, build12, and build13. Obsolete build12/build13 push mappings were removed. Local image-pusher bundles now sync build12/build13 Docker secrets to the ci and test-credentials namespaces.
Cluster-secret destination coverage core-services/ci-secret-bootstrap/_config.yaml	Cluster-secret destinations were added, renamed, or retained for AWS, OCI, AlibabaCloud, Hypershift, PowerVS, libvirt, virtualization, Azure, Packet, and RHOAI targets.
Obsolete secret mapping cleanup core-services/ci-secret-bootstrap/_config.yaml	Obsolete AlibabaCloud, AWS, GCP, Azure virtualization, RHOAI, and IBM Cloud mappings were removed.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: danilo-gemoli, smg247, psalajova

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: de-duplicating secret configuration and moving build cluster configuration to GSM.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only two YAML configuration files. No Ginkgo declarations or test-title syntax appear in added lines or the repository's Go sources.
Test Structure And Quality	✅ Passed	The commit changes only two YAML configuration files; it adds no Ginkgo tests, It blocks, cluster operations, waits, or test setup requiring this check.
Microshift Test Compatibility	✅ Passed	The patch changes only two YAML CI secret configuration files and adds no Ginkgo e2e tests or test declarations requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only two YAML configuration files. The diff adds no Ginkgo tests or topology-dependent test code, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only two CI secret-bootstrap YAML files. Added entries are dockerconfig secret bundles; no deployment, replica, affinity, topology, node, toleration, or PDB scheduling constraint...
Ote Binary Stdout Contract	✅ Passed	The commit changes only two YAML configuration files; no OTE binary source, suite setup, or process-level stdout/logging code changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only two YAML secret-configuration files; no Ginkgo tests, test declarations, IPv4 assumptions, or connectivity code were added.
No-Weak-Crypto	✅ Passed	The PR changes only YAML secret mappings. Diff scans found no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto APIs, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR changes only secret-mapping YAML files. Searches found no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-user settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only YAML secret mappings. Added entries reference GSM fields and registry destinations; no logging, print, stdout, or stderr statements expose sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@hector-vido: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@hector-vido: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.