CLID-721: Add e2e OTE workflow for oc-mirror

[adolfo-ab]

Summary by CodeRabbit

Adds an optional end-to-end OTE test for the oc-mirror component repository. The test uses the AWS IPI workflow, runs the oc-mirror extension test suite, and skips unrelated changes such as documentation-only updates.

[openshift-ci-robot]

@adolfo-ab: This pull request references CLID-721 which is a valid jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b45f5ca0-dea0-45f2-b0ac-822f9b1a9d2e

📥 Commits

Reviewing files that changed from the base of the PR and between a1ba28d and fd937b1.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/openshift/oc-mirror/openshift-oc-mirror-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift/oc-mirror/openshift-oc-mirror-main.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

Adds an optional e2e-aws-oc-mirror-ote CI test. The test uses AWS infrastructure, the oc-mirror extension image, configured environment variables, and extension end-to-end test steps.

Changes

OC Mirror AWS end-to-end validation

Layer / File(s)	Summary
Configure the AWS end-to-end test ci-operator/config/openshift/oc-mirror/openshift-oc-mirror-main.yaml	Adds the optional e2e-aws-oc-mirror-ote test with change filters, AWS workflow settings, the oc-mirror extension image dependency, required environment variables, and test references.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to fd937

This localized CI change adds the intended e2e OTE presubmit workflow without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: jmguzik

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding an end-to-end OTE workflow for oc-mirror.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The PR adds CI configuration and a generated Prow job only. The exact diff adds no Ginkgo declarations or test titles. The new identifiers and TEST_SUITE value are literal, stable strings, wit…
Test Structure And Quality	✅ Passed	PASS — The commit changes only CI YAML configuration and generated Prow job metadata. It adds no Ginkgo test code, assertions, resource setup or cleanup, cluster waits, or test messages. Therefore, no…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds CI configuration and a generated presubmit job only. The diff changes ci-operator/config/openshift/oc-mirror/openshift-oc-mirror-main.yaml and `ci-operator/jobs/openshift…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only CI YAML files. The diff adds an e2e-aws-oc-mirror-ote job and its presubmit registration; it adds no Ginkgo test source or It(), Describe(), Context(), or `…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only CI configuration and a generated Prow presubmit job. The added entries select the ipi-aws workflow and openshift-org-aws profile, but they add no deployment, op…
Ote Binary Stdout Contract	✅ Passed	PASS: The commit changes only two YAML CI configuration files. It adds the OTE job and generated Prow job wiring, but it does not change an OTE binary, main(), suite setup, or any process-level loggin…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS. The pull request changes only CI configuration and the generated Prow job. It adds no Ginkgo test code or test source files. The new job runs the existing oc-mirror/conformance/serial suite, u…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds CI YAML for the e2e-aws-oc-mirror-ote workflow and its generated presubmit job. The added settings contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, custom cr…
Container-Privileges	✅ Passed	PASS. The pull request changes only the oc-mirror CI test definition and its generated presubmit job. The added YAML and generated Kubernetes pod spec contain no privileged: true, hostPID, `hostNe…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The exact HEAD diff adds only CI YAML in the test definition and generated presubmit job. The new job passes credential file paths and mounts named CI secrets, but it contains no credential valu…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS. The PR adds CI configuration and a generated Prow job only. The exact diff adds no Ginkgo declarations or test titles. The new identifiers and TEST_SUITE value are literal, stable strings, with no pod names, timestamps, UUIDs, node names, namespaces, IP addresses, or generated values.

Full details: Test Structure And Quality

Explanation

PASS — The commit changes only CI YAML configuration and generated Prow job metadata. It adds no Ginkgo test code, assertions, resource setup or cleanup, cluster waits, or test messages. Therefore, none of the stated Ginkgo quality failure conditions apply.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds CI configuration and a generated presubmit job only. The diff changes ci-operator/config/openshift/oc-mirror/openshift-oc-mirror-main.yaml and ci-operator/jobs/openshift/oc-mirror/openshift-oc-mirror-main-presubmits.yaml; it adds no Ginkgo It, Describe, Context, or When tests and references no OpenShift API or MicroShift-incompatible resource. The MicroShift Test Compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only CI YAML files. The diff adds an e2e-aws-oc-mirror-ote job and its presubmit registration; it adds no Ginkgo test source or It(), Describe(), Context(), or When() declarations. Therefore, this SNO compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only CI configuration and a generated Prow presubmit job. The added entries select the ipi-aws workflow and openshift-org-aws profile, but they add no deployment, operator, or controller scheduling constraints. The diff contains no anti-affinity, topology spread, replica, PDB, node selector/affinity, toleration, or control-plane/worker/arbiter scheduling fields. Therefore, none of the explicit topology failure conditions applies.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The commit changes only two YAML CI configuration files. It adds the OTE job and generated Prow job wiring, but it does not change an OTE binary, main(), suite setup, or any process-level logging or stdout write. The repository contains no oc-mirror implementation for this commit, and the added configuration has no fmt, klog, log, or stdout operation. Therefore, the custom failure condition is not introduced.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS. The pull request changes only CI configuration and the generated Prow job. It adds no Ginkgo test code or test source files. The new job runs the existing oc-mirror/conformance/serial suite, uses the built oc-mirror image dependency, and contains no hardcoded IPv4 address, public URL, or external host. The custom check is therefore not triggered.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request adds CI YAML for the e2e-aws-oc-mirror-ote workflow and its generated presubmit job. The added settings contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, custom cryptography, or secret/token comparisons. The secret references in the generated CI job only mount CI credentials and do not implement cryptographic operations.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only the oc-mirror CI test definition and its generated presubmit job. The added YAML and generated Kubernetes pod spec contain no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-user declaration. The referenced ipi-aws, ipi-aws-pre, OTE setup, and openshift-e2e-test definitions also contain none of these privilege fields. The generated job uses the same ordinary ci-operator container pattern as existing jobs.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The exact HEAD diff adds only CI YAML in the test definition and generated presubmit job. The new job passes credential file paths and mounts named CI secrets, but it contains no credential values. The added configuration has no logging commands and no passwords, tokens, API keys, PII, session IDs, customer data, or data-dumping behavior. Comparable OTE configurations use the same non-secret extension settings and workflow pattern.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@adolfo-ab: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-oc-mirror-main-e2e-aws-oc-mirror-ote	openshift/oc-mirror	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[adolfo-ab]

/pj-rehearse --pull=openshift/oc-mirror#1517 e2e-aws-oc-mirror-ote

[openshift-merge-bot]

@adolfo-ab: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@adolfo-ab: job(s): --pull=openshift/oc-mirror#1517, e2e-aws-oc-mirror-ote either don't exist or were not found to be affected, and cannot be rehearsed

[adolfo-ab]

/pj-rehearse e2e-aws-oc-mirror-ote

[openshift-merge-bot]

@adolfo-ab: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@adolfo-ab: job(s): e2e-aws-oc-mirror-ote either don't exist or were not found to be affected, and cannot be rehearsed

[adolfo-ab]

/pj-rehearse

[openshift-merge-bot]

@adolfo-ab: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[r4f4]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adolfo-ab, r4f4

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/oc-mirror/OWNERS [adolfo-ab,r4f4]
• ci-operator/jobs/openshift/oc-mirror/OWNERS [adolfo-ab,r4f4]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aguidirh]

/pj-rehearse auto-ack

[openshift-merge-bot]

@aguidirh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@adolfo-ab: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.