KFLUXINFRA-2236: Broaden DR e2e trigger scope

[meyrevived]

Summary

Widens run_if_changed for the appstudio-konflux-disaster-recovery presubmit so it fires when any component exercised by the DR test changes — not just disaster-recovery/ itself.

The DR e2e test runs a full backup → disaster simulation → restore → rebuild cycle. Changes to the following components can break that cycle, but previously did not trigger the test.

Components added to trigger scope

Component	What the DR test does with it
application-api	Application and Component CRDs are core backup/restore targets; finalizers explicitly handled during disaster simulation
authentication	SA token rotation explicitly tested post-restore
backup	OADP/Velero, DPA, backup schedules, S3 credentials, resource modifiers — the core of backup/restore
build-service	PAC builds triggered pre- and post-restore; build-pipeline ServiceAccounts recreated after restore
cluster-secret-store	Backup S3 credentials sourced via ExternalSecret through this ClusterSecretStore
enterprise-contract	EC pipeline used as IntegrationTestScenario; EC policy created in managed namespace
external-secrets-operator	Operator that syncs ExternalSecrets — without it, backup S3 credentials cannot sync, breaking the entire backup chain
has	Hybrid Application Service manages Application/Component CRs that are created, backed up, and restored
image-controller	ImageRepository CRs verified post-restore; push/pull secret readiness polled; NetworkPolicy blocks it during disaster simulation
integration	IntegrationTestScenarios created; integration test PipelineRuns awaited both pre- and post-restore
pipeline-service	Runs all PipelineRuns (build, test, release); PAC Repositories backed up and verified post-restore; Tekton Chains signing key fetched
project-controller	Tenant namespace lifecycle is core to the test — namespaces created, destroyed, and restored
release	ReleasePlan, ReleasePlanAdmission, Release CRs created; release PipelineRuns in managed namespace awaited

What was NOT added (and why)

Components from the initial candidate list that were excluded after cross-referencing DR test code, SOPs, user docs, and infra-deployments structure:

• cluster-secret-store-rh — secondary vault store, not exercised by DR test
• internal-services — not referenced in test code
• konflux-operator — platform dependency but not DR-specific; caught by other tests
• monitoring — observability only, test does not validate metrics/alerts
• namespace-lister — not referenced anywhere in DR context
• repository-validator — not referenced anywhere in DR context
• trust-manager — not referenced anywhere in DR context

Test plan

• /pj-rehearse the DR presubmit to verify job triggers correctly on component path changes
• Verify generated job file matches config source after make jobs

🤖 Generated with Claude Code

Summary by CodeRabbit

The appstudio-konflux-disaster-recovery presubmit now runs when changes affect any component used by the disaster-recovery end-to-end test, not only components/disaster-recovery. This expands coverage across application management, authentication, backup and restore, builds, secrets, enterprise contracts, external secrets, image management, integrations, pipelines, project lifecycle, and releases.

[openshift-ci-robot]

@meyrevived: This pull request references KFLUXINFRA-2236 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Widens run_if_changed for the appstudio-konflux-disaster-recovery presubmit so it fires when any component exercised by the DR test changes — not just disaster-recovery/ itself.

The DR e2e test runs a full backup → disaster simulation → restore → rebuild cycle. Changes to the following components can break that cycle, but previously did not trigger the test.

Components added to trigger scope

Component	What the DR test does with it
application-api	Application and Component CRDs are core backup/restore targets; finalizers explicitly handled during disaster simulation
authentication	SA token rotation explicitly tested post-restore
backup	OADP/Velero, DPA, backup schedules, S3 credentials, resource modifiers — the core of backup/restore
build-service	PAC builds triggered pre- and post-restore; build-pipeline ServiceAccounts recreated after restore
cluster-secret-store	Backup S3 credentials sourced via ExternalSecret through this ClusterSecretStore
enterprise-contract	EC pipeline used as IntegrationTestScenario; EC policy created in managed namespace
external-secrets-operator	Operator that syncs ExternalSecrets — without it, backup S3 credentials cannot sync, breaking the entire backup chain
has	Hybrid Application Service manages Application/Component CRs that are created, backed up, and restored
image-controller	ImageRepository CRs verified post-restore; push/pull secret readiness polled; NetworkPolicy blocks it during disaster simulation
integration	IntegrationTestScenarios created; integration test PipelineRuns awaited both pre- and post-restore
pipeline-service	Runs all PipelineRuns (build, test, release); PAC Repositories backed up and verified post-restore; Tekton Chains signing key fetched
project-controller	Tenant namespace lifecycle is core to the test — namespaces created, destroyed, and restored
release	ReleasePlan, ReleasePlanAdmission, Release CRs created; release PipelineRuns in managed namespace awaited

What was NOT added (and why)

Components from the initial candidate list that were excluded after cross-referencing DR test code, SOPs, user docs, and infra-deployments structure:

• cluster-secret-store-rh — secondary vault store, not exercised by DR test
• internal-services — not referenced in test code
• konflux-operator — platform dependency but not DR-specific; caught by other tests
• monitoring — observability only, test does not validate metrics/alerts
• namespace-lister — not referenced anywhere in DR context
• repository-validator — not referenced anywhere in DR context
• trust-manager — not referenced anywhere in DR context

Test plan

• /pj-rehearse the DR presubmit to verify job triggers correctly on component path changes
• Verify generated job file matches config source after make jobs

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

@meyrevived, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto e96912ee301d2fc3ef481b504960dfb07f278966 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: meyrevived

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/redhat-appstudio/infra-deployments/OWNERS [meyrevived]
• ci-operator/jobs/redhat-appstudio/infra-deployments/OWNERS [meyrevived]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[meyrevived]

/pj-rehearse

[openshift-merge-bot]

@meyrevived: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@meyrevived, pj-rehearse: unable prepare a candidate for rehearsal; rehearsals will not be run. This could be due to a branch that needs to be rebased. ERROR:

couldn't rebase candidate onto e96912ee301d2fc3ef481b504960dfb07f278966 due to conflicts

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 12b10bcd-a33e-41ae-a66c-cbb7e9416383

📥 Commits

Reviewing files that changed from the base of the PR and between e96912e and 6d24665.

⛔ Files ignored due to path filters (1)

• ci-operator/jobs/redhat-appstudio/infra-deployments/redhat-appstudio-infra-deployments-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/redhat-appstudio/infra-deployments/redhat-appstudio-infra-deployments-main.yaml

---

Walkthrough

The disaster-recovery test trigger now covers multiple application and infrastructure component directories instead of only components/disaster-recovery.

Changes

Infrastructure deployment test triggers

Layer / File(s)	Summary
Disaster-recovery trigger pattern ci-operator/config/redhat-appstudio/infra-deployments/redhat-appstudio-infra-deployments-main.yaml	The run_if_changed pattern includes additional component directories.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to 6d246

This PR broadens when the disaster-recovery presubmit runs without changing runtime behavior. It is merge-ready after the routine configuration-generation check confirms the source and generated job remain synchronized, with no current merge-blocking risk.

Suggested reviewers: flacatus

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: broadening the disaster-recovery end-to-end trigger scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff only broadens a Prow run_if_changed regex and its generated job entry; it adds no Ginkgo test titles or dynamic test-name values.
Test Structure And Quality	✅ Passed	The custom check targets Ginkgo test code review. This PR modifies only a CI configuration file specifying test triggers, not any test code or test structure.
Microshift Test Compatibility	✅ Passed	PR modifies only CI configuration (run_if_changed pattern), not test code. No new Ginkgo e2e tests are added, so MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR modifies only CI configuration YAML files to broaden the trigger scope of an existing test. No new Ginkgo e2e tests are added, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR modifies only a CI configuration file that defines test triggers. It contains no deployment manifests, operator code, or controllers, and introduces no scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	Pull request modifies only CI configuration YAML files (run_if_changed patterns). No code changes to binaries, test files, or process-level code that could violate OTE stdout contract detected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only the DR job trigger regex and its generated presubmit; it adds no Ginkgo test, IPv4 assumption, or external connectivity requirement.
No-Weak-Crypto	✅ Passed	PR modifies only CI configuration YAML file with a regex pattern update; no cryptographic code, MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or secret comparisons are introduced.
Container-Privileges	✅ Passed	The PR modifies only two lines in CI operator configuration files to broaden test trigger patterns. No container specifications, securityContext definitions, privileged settings, or capability conf...
No-Sensitive-Data-In-Logs	✅ Passed	The diff only broadens a YAML run_if_changed regex; it adds no logging, credentials, tokens, PII, or other sensitive-data output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@meyrevived: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.