fix: add arm64 capability to tests

[jan-law]

Follow up to #63142

The images appear to build successfully, but the e2e tests were placed on a cluster (build04) without arm64:
https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/stolostron_governance-policy-framework/1064/pull-ci-stolostron-governance-policy-framework-release-2.17-test-e2e-grc-framework/2077493608629407744

1. Followed https://docs.ci.openshift.org/how-tos/capabilities/#configuration
2. EDIT: Manually update the e2e cluster. The rehearsals kept failing because make update does not select a new cluster after the capability was added.
3. Ran make update
4. Will need a follow up PR to remove the hardcoded cluster labels. The bot should reassign clusters periodically

Summary by CodeRabbit

Updates the Stolostron Governance Policy Framework CI configuration in ci-operator/config/stolostron/governance-policy-framework so the test-e2e-grc-framework e2e job is constrained to ARM64-capable clusters. The change adds a capabilities: [arm64] requirement to the e2e test step across stolostron-governance-policy-framework-main.yaml (targeting cluster: build09) and the release configs release-2.11 through release-2.16 (each targeting cluster: build07), plus release-2.17 (also cluster: build07) and release-5.0 (targeting cluster: build06).

Also bumps the Go builder image tag to go1.26-linux in release-2.17 and release-5.0.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Governance policy framework CI configurations now require arm64 for test-e2e-grc-framework; main targets build09, releases target build07, and releases 2.17 and 5.0 update builder images from Go 1.25 to Go 1.26.

Changes

Governance policy framework CI

Layer / File(s)	Summary
Architecture and cluster targeting ci-operator/config/stolostron/governance-policy-framework/*	Main and release configurations add arm64 capability constraints and cluster assignments for test-e2e-grc-framework.
Go builder image update ci-operator/config/stolostron/governance-policy-framework/...release-2.17.yaml, ...release-5.0.yaml	Release 2.17 and 5.0 builder references change from go1.25-linux to go1.26-linux.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• openshift/release#81956: Updates Go builder image references from go1.25-linux to go1.26-linux in related CI configurations.

Suggested labels: rehearsals-ack

Suggested reviewers: gparvin, yiraechristinekim

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only CI config YAML changed; no Go test files or Ginkgo It/Describe/Context/When titles were added or modified.
Test Structure And Quality	✅ Passed	PR only updates ci-operator YAML/job configs; no Ginkgo test code was changed, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: The PR only updates generated CI config/job YAML; no Ginkgo test code was added or modified, so MicroShift API compatibility is unchanged.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only generated CI YAML/presubmits changed; no Ginkgo test code or new test logic was added, so the SNO check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only ci-operator test configs changed; no deployment manifests, controllers, or scheduling primitives (affinity, selectors, PDBs) were introduced.
Ote Binary Stdout Contract	✅ Passed	PR only edits ci-operator YAML job configs; no process-level binary code or stdout logging changed, so the OTE stdout contract isn’t implicated.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: This PR only changes ci-operator config/job YAML; no Ginkgo test code was added or modified, so there are no new IPv4 or external-network assumptions to flag.
No-Weak-Crypto	✅ Passed	The PR only changes CI YAML (capabilities/cluster and Go image tags); no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	Touched ci-operator YAMLs only add arm64 scheduling/cluster selection; no privileged, hostPID/Network/IPC, allowPrivilegeEscalation, root, or SYS_ADMIN settings found.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only updates CI YAML (capabilities, cluster, image tags); no logging statements or sensitive values were added.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding arm64 capability support to tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[jan-law]

/pj-rehearse abort
/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse abort
/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0.yaml`:
- Around line 35-37: Update the arm64 test configuration in
stolostron-governance-policy-framework-release-5.0.yaml to use cluster build07
instead of build06, keeping the capabilities value unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 09d709d2-3c6a-4789-8645-1c45d783015b

📥 Commits

Reviewing files that changed from the base of the PR and between cb5d242 and 1110329.

⛔ Files ignored due to path filters (9)

• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-main-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.11-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.12-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.13-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.14-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.15-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.16-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.17-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (9)

• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-main.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.11.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.12.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.13.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.14.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.15.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.16.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.17.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0.yaml

🚧 Files skipped from review as they are similar to previous changes (8)

• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.15.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.12.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.13.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.14.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.11.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.16.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-2.17.yaml
• ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-main.yaml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- target file excerpt ---'
sed -n '1,120p' ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0.yaml

echo
echo '--- search arm64/build06/build07 in related config ---'
rg -n "arm64|build06|build07" ci-operator/config/stolostron/governance-policy-framework -g '*.yaml' -g '*.yml'

echo
echo '--- nearby release configs in same org/repo ---'
fd -a 'stolostron-governance-policy-framework-release-5.0.yaml|stolostron-governance-policy-framework-release-*.ya?ml' ci-operator/config/stolostron/governance-policy-framework

Repository: openshift/release

Length of output: 5991

---

Use build07 for this arm64 test
ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0.yaml is the only release config in this repo family still using cluster: build06 for capabilities: [arm64]; the matching configs use build07 instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/stolostron/governance-policy-framework/stolostron-governance-policy-framework-release-5.0.yaml`
around lines 35 - 37, Update the arm64 test configuration in
stolostron-governance-policy-framework-release-5.0.yaml to use cluster build07
instead of build06, keeping the capabilities value unchanged.

Source: Coding guidelines

[jan-law]

cluster: is temporary - I arbitrarily chose the same cluster as the one used to build images. The previous rehearsals kept using build04, which doesn't support arm64. Not sure if there is a better way to trigger a 'reselection' of clusters without specifying a cluster

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- capability and cluster selection documentation/references ---'
rg -n -i -C 3 'capabilities:|capabilit(y|ies)|rehearse|cluster.*select|select.*cluster|cluster:' \
  README.md docs ci-operator core-services 2>/dev/null || true

echo
echo '--- files with candidate documentation names ---'
fd -a -i '.*(capabilit|ci-operator|clusterpool|rehearse).*' . \
  -E .git -E vendor -E node_modules | head -200

echo
echo '--- current config family capability/cluster declarations ---'
rg -n -C 2 '^\s*(capabilities:|cluster:)|^\s*-\s*arm64\s*$' \
  ci-operator/config/stolostron/governance-policy-framework -g '*.yaml' -g '*.yml'

Length of output: 201195

---

@jan-law The search confirms that capabilities: [arm64] is the normal mechanism for declaring the requirement, but it did not uncover a documented user-facing way to force an existing rehearsal to reselect its build cluster.

It also shows the related jobs are pinned to different clusters (build07 for release branches and build09 on main), so that pattern does not make build07 a requirement. Keeping the temporary build06 pin to get the rehearsal onto an arm64-capable cluster is reasonable.

---

🧠 Learnings used

Learnt from: dustman9000
Repo: openshift/release PR: 80929
File: ci-operator/config/openshift-online/rosa-e2e/openshift-online-rosa-e2e-main__ocm-fvt-rosa-hcp-production.yaml:31-39
Timestamp: 2026-06-24T02:25:16.245Z
Learning: In the openshift/release repo, when a PR makes structural changes to CI operator config (e.g., adding/renaming tests, changing the pre/post steps, or adding allow_best_effort_post_steps), require that the contributor regenerated the downstream Prow job definitions/metadata by running exactly: `make registry-metadata && make ci-operator-config && make jobs`. If the contributor confirms those commands were run successfully and the relevant CI checks passed, then treat the regeneration requirement as satisfied for review purposes.

---

Learnt from: gcs278
Repo: openshift/release PR: 80171
File: ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml:156-168
Timestamp: 2026-07-08T01:52:09.228Z
Learning: When reviewing PRs in openshift/release that may have affected CI Operator/Prow job generation (e.g., changes under ci-operator/config/**, ci-operator/step-registry/**, or infra-*.yaml), treat the repo’s CI presubmit checks as the authoritative signal. If reviewers suspect that regenerated Prow job files under ci-operator/jobs/** are missing, don’t automatically insist on manual/local regeneration via `make update`—especially if the author reports local tooling problems (containerized tooling via podman/docker). Instead, first confirm whether CI presubmits such as `pj-rehearse` and `ci-operator-config` validation fail for regeneration/consistency reasons, and align review feedback with what those checks enforce.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@jan-law: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-stolostron-governance-policy-framework-main-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.11-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.12-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.13-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.14-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.15-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.16-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-2.17-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed
pull-ci-stolostron-governance-policy-framework-release-5.0-test-e2e-grc-framework	stolostron/governance-policy-framework	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[jan-law]

/retest-required

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/pj-rehearse skip

The remaining errors are unrelated to this PR:

 2026-07-22T17:45:21+00:00 Getting latest snapshot for 5.1-dev
2026-07-22T17:45:21+00:00 ERROR no manifest file found in pipeline/snapshots
2026-07-22T17:45:21+00:00 Contents of pipeline/snapshots
{"component":"entrypoint","error":"wrapped process failed: exit status 1","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:84","func":"sigs.k8s.io/prow/pkg/entrypoint.Options.internalRun","level":"error","msg":"Error executing test process","severity":"error","time":"2026-07-22T17:45:21Z"}
error: failed to execute wrapped command: exit status 1
INFO[2026-07-22T17:45:23Z] Step test-e2e-grc-framework-ocm-e2e-clusterpool-cluster-deploy failed after 1m23s.

 head: cannot open '/go/src/github.com/stolostron/governance-policy-framework/build/../CURRENT_VERSION' for reading: No such file or directory
{"component":"entrypoint","error":"wrapped process failed: exit status 1","file":"sigs.k8s.io/prow/pkg/entrypoint/run.go:84","func":"sigs.k8s.io/prow/pkg/entrypoint.Options.internalRun","level":"error","msg":"Error executing test process","severity":"error","time":"2026-07-22T17:13:26Z"}
error: failed to execute wrapped command: exit status 1
INFO[2026-07-22T17:13:27Z] Step test-e2e-grc-framework-e2e failed after 1m0s.
INFO[2026-07-22T17:13:27Z] Step phase test failed after 1m0s.

[openshift-merge-bot]

@jan-law: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[jan-law]

/cc @dhaiducek

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dhaiducek, jan-law

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/stolostron/governance-policy-framework/OWNERS [dhaiducek,jan-law]
• ci-operator/jobs/stolostron/governance-policy-framework/OWNERS [dhaiducek,jan-law]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jan-law: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/stolostron/governance-policy-framework/release-5.0/test-e2e-grc-framework	1ecb044	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-5.0-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.16/test-e2e-grc-framework	1ecb044	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.16-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.15/test-e2e-grc-framework	e6c317e	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.15-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.17/test-e2e-grc-framework	e6c317e	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.17-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.11/test-e2e-grc-framework	4efd338	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.11-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/main/test-e2e-grc-framework	4efd338	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-main-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.13/test-e2e-grc-framework	4efd338	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.13-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.14/test-e2e-grc-framework	4efd338	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.14-test-e2e-grc-framework
ci/rehearse/stolostron/governance-policy-framework/release-2.12/test-e2e-grc-framework	4efd338	link	unknown	/pj-rehearse pull-ci-stolostron-governance-policy-framework-release-2.12-test-e2e-grc-framework

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.