Require remaining osac CI checks in merge gate

[minmzzhang]

Summary

• Resubmit of Require remaining osac CI checks in merge gate #205 after Revert "Require remaining osac CI checks in merge gate" #206 revert, now that osac-project/osac#717 is merged
• Add remaining cheap osac CI jobs to repo_osac merge-queue required checks
• Covers ansible-lint, FS python/go/binaries, helm CRD sync, installer helm lint, darwin keychain, operator/BMF unit tests, metering generated-code, dependency-review
• Step skip still reports success, so unrelated PRs are not blocked

osac#717 makes those workflows always report these names on pull_request/merge_group. Applying this ruleset before that left the merge queue waiting for checks that never started.

Jira

N/A

Test plan

• osac#717 merged
• Context names match osac GitHub Actions job name: (or job id if unnamed)
• Docs-only / unrelated-component PRs still merge (names report, work skipped)

---

This PR description was drafted with AI assistance (create-pr v0.1.3). Review for accuracy

Summary

• CI: Adds inexpensive repo_osac merge-queue required checks for linting, filesystem language and binary checks, Helm validation, Darwin keychain tests, operator and BMF unit tests, metering generated code, and dependency review.
• CI behavior: Skipped jobs still report success. Unrelated pull requests remain unblocked.
• API surface, controllers, database, auth, deployment, tests, documentation: No direct changes.
• Backward compatibility: No runtime or API compatibility impact. The change can affect merge eligibility when a required check fails.

Risk classification

risk:ship — The change only updates CI required-check declarations. It does not change runtime code, deployment behavior, data, authentication, or public interfaces. It is close to risk:show because required checks can affect merge workflows, but it does not meet that threshold because the checks are inexpensive and skipped steps report success.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f91e663e-3fd6-4efd-be65-0d33cbb2cc14

📥 Commits

Reviewing files that changed from the base of the PR and between b352828 and 6e4ecf3.

📒 Files selected for processing (1)

• repositories.tf

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The repo_osac module now requires additional GitHub status checks for linting, generated-code validation, language validation, builds, dependency review, Helm validation, and targeted tests.

Changes

OSAC required status checks

Layer / File(s)	Summary
Configure required OSAC checks repositories.tf	Adds required status checks for OSAC linting, code generation, Python, Go, proto, binary, dependency, Helm, Darwin keychain, and operator component validation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 6e4ec

This change makes additional OSAC checks mandatory before merging. If any required check name is not emitted by its workflow, otherwise valid pull requests could remain unable to merge; compatibility should be confirmed before merge.

Suggested labels: risk:ask

Suggested reviewers: larsks, omer-vishlitzky, eliorerz

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the remaining OSAC CI checks to the merge gate.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PASS. The pull request changes only repositories.tf and adds 14 status-check declarations. Added string literals contain workflow names only, and no added line contains API keys, tokens, passwords, …
No-Weak-Crypto	✅ Passed	PASS: The pull request adds only GitHub status-check entries and comments in repositories.tf. The exact added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto, or constant-time comparison…
No-Injection-Vectors	✅ Passed	PASS. The pull request changes only repositories.tf and adds 12 static GitHub status-check context strings plus comments. No SQL concatenation, shell execution, eval/exec, pickle.loads, unsafe…
Container-Privileges	✅ Passed	PASS: The pull request changes only repositories.tf and adds GitHub required status-check entries. The added lines contain no container or Kubernetes manifest settings for privileged: true, host P…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request changes only repositories.tf by adding GitHub required status-check context strings. The module passes these values to github_repository_ruleset.required_status_checks; it d…
Ai-Attribution	✅ Passed	The PR explicitly states that AI assisted the drafting. The changed commit includes the required Assisted-by: Cursor <cursoragent@cursor.com> trailer and a Red Hat Signed-off-by trailer. The PR co…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

PASS. The pull request changes only repositories.tf and adds 14 status-check declarations. Added string literals contain workflow names only, and no added line contains API keys, tokens, passwords, credentials, private-key material, embedded-credential URLs, or long base64/hex strings. No secret-related variable assignment was introduced.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request adds only GitHub status-check entries and comments in repositories.tf. The exact added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto, or constant-time comparison usage. The module consumes these values as status-check context strings, not cryptographic code.

Full details: No-Injection-Vectors

Explanation

PASS. The pull request changes only repositories.tf and adds 12 static GitHub status-check context strings plus comments. No SQL concatenation, shell execution, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerouslySetInnerHTML appears in the diff. The added values contain no user-controlled data or executable interpolation.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only repositories.tf and adds GitHub required status-check entries. The added lines contain no container or Kubernetes manifest settings for privileged: true, host PID/network/IPC, SYS_ADMIN, root execution, or allowPrivilegeEscalation: true. The custom check failure conditions are not introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request changes only repositories.tf by adding GitHub required status-check context strings. The module passes these values to github_repository_ruleset.required_status_checks; it does not log them. The added lines contain no passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

Full details: Ai-Attribution

Explanation

The PR explicitly states that AI assisted the drafting. The changed commit includes the required Assisted-by: Cursor <cursoragent@cursor.com> trailer and a Red Hat Signed-off-by trailer. The PR commit has no AI Co-Authored-By trailer. The historical Co-authored-by: Cursor entry is outside this PR's one-commit change range.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[eliorerz]

/lgtm

[eliorerz]

/approve