openshift-ligthspeed: make the on pull request pipeline required before merging PR

[raptorsun]

Summary by CodeRabbit

This change updates branch protection for several OpenShift Lightspeed repositories so their main branches now require the Konflux pull-request job to pass before merges are allowed. In practical terms, it makes the PR validation pipeline mandatory across the following components: agentic console, agentic operator, agentic sandbox, console, operator, and service. This strengthens merge gating and helps ensure changes are only merged after the required CI signal succeeds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 25bf032d-5dee-4a04-ade6-dc394d2ac2c0

📥 Commits

Reviewing files that changed from the base of the PR and between f68f542 and 34455a1.

📒 Files selected for processing (6)

• core-services/prow/02_config/openshift/lightspeed-agentic-console/_prowconfig.yaml
• core-services/prow/02_config/openshift/lightspeed-agentic-operator/_prowconfig.yaml
• core-services/prow/02_config/openshift/lightspeed-agentic-sandbox/_prowconfig.yaml
• core-services/prow/02_config/openshift/lightspeed-console/_prowconfig.yaml
• core-services/prow/02_config/openshift/lightspeed-operator/_prowconfig.yaml
• core-services/prow/02_config/openshift/lightspeed-service/_prowconfig.yaml

---

Walkthrough

Six Prow config files for openshift/lightspeed-* repositories each receive a new branch-protection block that enables protection on the main branch and requires the corresponding Red Hat Konflux on-pull-request status check context.

Lightspeed Branch Protection

Layer / File(s)

Summary

Branch protection for all six lightspeed repos core-services/prow/02_config/openshift/lightspeed-agentic-console/_prowconfig.yaml, core-services/prow/02_config/openshift/lightspeed-agentic-operator/_prowconfig.yaml, core-services/prow/02_config/openshift/lightspeed-agentic-sandbox/_prowconfig.yaml, core-services/prow/02_config/openshift/lightspeed-console/_prowconfig.yaml, core-services/prow/02_config/openshift/lightspeed-operator/_prowconfig.yaml, core-services/prow/02_config/openshift/lightspeed-service/_prowconfig.yaml

Each file adds protect: true and a required_status_checks.contexts entry for the repo's Red Hat Konflux / <repo>-on-pull-request context on the main branch.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• danilo-gemoli
• deepsm007
• Prucek

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes making the on-pull-request pipeline required for merging across the openshift lightspeed repos.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only adds prow branch-protection YAML; no Ginkgo/spec files or test titles are changed, so there are no unstable test names to flag.
Test Structure And Quality	✅ Passed	Not applicable: the PR only adds YAML branch-protection entries; it contains no Ginkgo test code or test setup to review.
Microshift Test Compatibility	✅ Passed	PR only adds prow branch-protection YAML under core-services/prow; no Ginkgo e2e tests or API usage changed, so MicroShift compatibility is unaffected.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only six _prowconfig.yaml files changed; no Ginkgo tests or test code were added, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Prow branch-protection YAML changed; no deployment manifests, operator code, or scheduling constraints appear in the touched files.
Ote Binary Stdout Contract	✅ Passed	Only Prow config YAMLs changed; no OTE binary code, main/init/TestMain/suite setup, or stdout writes were touched.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only _prowconfig.yaml branch-protection YAML changed; no new Ginkgo tests or network code/URLs were added, so the IPv6/disconnected check is not applicable.
No-Weak-Crypto	✅ Passed	Only Prow branch-protection YAML changed; touched files contain no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code.
Container-Privileges	✅ Passed	Changes are only Prow config YAMLs for branch protection; no container/K8s manifests or privilege flags appear.
No-Sensitive-Data-In-Logs	✅ Passed	Changed files only add branch-protection YAML entries; no log statements, secrets, PII, or other sensitive terms appear in the diffs or file contents.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@raptorsun: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

[openshift-ci]

@raptorsun: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[onmete]

/lgtm
/approve

[raptorsun]

/approve

[raptorsun]

/pj-rehearse auto-ack

[openshift-merge-bot]

@raptorsun: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@raptorsun: no rehearsable tests are affected by this change

[joshuawilson]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joshuawilson, onmete, raptorsun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/openshift/lightspeed-agentic-console/OWNERS [joshuawilson,onmete,raptorsun]
• core-services/prow/02_config/openshift/lightspeed-agentic-operator/OWNERS [joshuawilson,onmete,raptorsun]
• core-services/prow/02_config/openshift/lightspeed-agentic-sandbox/OWNERS [joshuawilson,onmete,raptorsun]
• core-services/prow/02_config/openshift/lightspeed-console/OWNERS [joshuawilson]
• core-services/prow/02_config/openshift/lightspeed-operator/OWNERS [joshuawilson,raptorsun]
• core-services/prow/02_config/openshift/lightspeed-service/OWNERS [joshuawilson,onmete,raptorsun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@raptorsun: Updated the following 2 configmaps:

• config configmap in namespace ci at cluster app.ci using the following files:
  • key core-services-prow-02_config-openshift-lightspeed-agentic-console-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-console/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-agentic-operator-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-operator/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-agentic-sandbox-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-sandbox/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-console-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-console/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-operator-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-operator/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-service-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-service/_prowconfig.yaml
• config configmap in namespace ci at cluster core-ci using the following files:
  • key core-services-prow-02_config-openshift-lightspeed-agentic-console-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-console/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-agentic-operator-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-operator/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-agentic-sandbox-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-agentic-sandbox/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-console-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-console/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-operator-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-operator/_prowconfig.yaml
  • key core-services-prow-02_config-openshift-lightspeed-service-_prowconfig.yaml using file core-services/prow/02_config/openshift/lightspeed-service/_prowconfig.yaml

Details

In response to this:

Summary by CodeRabbit

This change updates branch protection for several OpenShift Lightspeed repositories so their main branches now require the Konflux pull-request job to pass before merges are allowed. In practical terms, it makes the PR validation pipeline mandatory across the following components: agentic console, agentic operator, agentic sandbox, console, operator, and service. This strengthens merge gating and helps ensure changes are only merged after the required CI signal succeeds.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.