[release-controller] Adding default release configs for OKD ARM64

[bradmwilliams]

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

Summary by CodeRabbit

• Adds ARM64 release-controller configurations for OKD and OKD SCOS 4.x and 5.x release streams.
• Configures ARM64 mirroring, release limits, CLI images, credentials, publication tags, and verification settings.
• Adds ARM64 monitoring for the release endpoint.
• Updates release annotation automation for ARM64 namespaces and resources.
• Enables secret checking with pre-commit 2.4.0.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bradmwilliams: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

Walkthrough

The change adds ARM64 OKD and SCOS release-controller configurations for stable, next, artifact, and CI streams. It also wires ARM64 annotations and monitors the ARM64 origin release endpoint.

Changes

ARM64 release streams

Layer / File(s)	Summary
Stable and next channel configurations core-services/release-controller/_releases/release-okd-4.y-stable-arm64.json, core-services/release-controller/_releases/release-okd-scos-4.y-*-arm64.json, core-services/release-controller/_releases/release-okd-scos-5.y-*-arm64.json	Adds ARM64 stable and next channel metadata, lifecycle limits, CLI image overrides, pull secrets, and publication settings.
Artifact release configurations core-services/release-controller/_releases/release-okd-scos-4.*-art-arm64.json, core-services/release-controller/_releases/release-okd-scos-5.*-art-arm64.json	Adds ARM64 SCOS artifact streams for versions 4.21 through 5.1 with mirroring, lifecycle limits, CLI image overrides, publication tags, and verification settings.
CI release configurations core-services/release-controller/_releases/release-okd-scos-4.*-ci-arm64.json, core-services/release-controller/_releases/release-okd-scos-5.*-ci-arm64.json	Adds ARM64 SCOS CI streams with source references, credentials, lifecycle limits, CLI image overrides, publication tags, and verification settings.
Annotation and endpoint monitoring hack/annotate.sh, clusters/app.ci/openshift-user-workload-monitoring/blackbox_probe.yaml	Adds ARM64 annotation calls for release streams and monitors arm64.origin.releases.ci.openshift.org.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/release#83129: Adds monitoring for the same ARM64 origin release endpoint through release-controller ingress.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding default OKD ARM64 release configurations to the release controller.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML, JSON, and shell files; no Ginkgo test declarations or test-title strings were added or modified.
Test Structure And Quality	✅ Passed	The diff adds only YAML, JSON, and shell configuration. It contains no Ginkgo tests, cluster operations, waits, or assertions to review.
Microshift Test Compatibility	✅ Passed	The 17 changed files add YAML, JSON release configurations, and shell annotations only; no Ginkgo tests or It/Describe/Context/When declarations were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The patch adds only YAML, JSON, and shell release configuration changes; it adds no Ginkgo e2e tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch adds one Probe URL, release-controller JSON, and annotation calls; it adds no Deployment, controller, pod scheduling constraint, node selector, affinity, spread, or PDB.
Ote Binary Stdout Contract	✅ Passed	The PR changes only JSON, YAML, and shell configuration; no Go/OTE binary or suite setup files changed, and added lines contain no stdout-writing calls.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit adds release JSON, monitoring YAML, and shell annotations only; it adds no Ginkgo e2e tests or IPv4-specific test logic, so this check is not applicable.
No-Weak-Crypto	✅ Passed	The 17 changed files add only endpoints, release metadata, secret references, and annotation calls; scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto code, or secret comparisons.
Container-Privileges	✅ Passed	The changed Probe only adds an HTTPS target, and all new release JSON files plus annotate.sh contain no privileged, host*, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	Changed files add no logging statements or literal credentials; scans found no passwords, tokens, API keys, PII, session IDs, or customer data. Existing jq output prints only configuration values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[bradmwilliams]

/hold

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json`:
- Around line 19-23: Update the tagRef.name values in
core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json
(lines 19-23) from scos-5.0 to scos-5.0-ci, and in
core-services/release-controller/_releases/release-okd-scos-5.1-ci-arm64.json
(lines 19-23) from scos-5.1 to scos-5.1-ci.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 49618e0f-66ab-4166-a031-dd26eef17b6b

📥 Commits

Reviewing files that changed from the base of the PR and between 916113d and 7da7ea3.

📒 Files selected for processing (17)

• clusters/app.ci/openshift-user-workload-monitoring/blackbox_probe.yaml
• core-services/release-controller/_releases/release-okd-4.y-stable-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.21-art-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.21-ci-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.22-art-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.22-ci-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.23-art-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.23-ci-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.y-next-arm64.json
• core-services/release-controller/_releases/release-okd-scos-4.y-stable-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.0-art-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.1-art-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.1-ci-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.y-next-arm64.json
• core-services/release-controller/_releases/release-okd-scos-5.y-stable-arm64.json
• hack/annotate.sh

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Publish the 5.x CI streams with CI tag names.

Both files define CI release streams but publish generic tags. This diverges from the 4.21–4.23 CI configurations. Consumers of scos-5.0-ci and scos-5.1-ci will not receive these ARM64 CI releases.

• core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json#L19-L23: change scos-5.0 to scos-5.0-ci.
• core-services/release-controller/_releases/release-okd-scos-5.1-ci-arm64.json#L19-L23: change scos-5.1 to scos-5.1-ci.

📍 Affects 2 files

• core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json#L19-L23 (this comment)
• core-services/release-controller/_releases/release-okd-scos-5.1-ci-arm64.json#L19-L23

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json`
around lines 19 - 23, Update the tagRef.name values in
core-services/release-controller/_releases/release-okd-scos-5.0-ci-arm64.json
(lines 19-23) from scos-5.0 to scos-5.0-ci, and in
core-services/release-controller/_releases/release-okd-scos-5.1-ci-arm64.json
(lines 19-23) from scos-5.1 to scos-5.1-ci.

[openshift-ci]

@bradmwilliams: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jupierce]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, jupierce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jupierce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment