Skip to content

openshift-mcp-server: Auto-ff daily - #83135

Draft
2uasimojo wants to merge 1 commit into
openshift:mainfrom
2uasimojo:mcp-server-auto-ff
Draft

openshift-mcp-server: Auto-ff daily#83135
2uasimojo wants to merge 1 commit into
openshift:mainfrom
2uasimojo:mcp-server-auto-ff

Conversation

@2uasimojo

@2uasimojo 2uasimojo commented Aug 7, 2026

Copy link
Copy Markdown
Member

Co-Authored-By: claude

Summary by CodeRabbit

This PR adds daily OpenShift CI automation for the openshift/openshift-mcp-server repository.

  • Runs a fast-forward-release-0-4 job daily at 06:00 UTC.
  • Fast-forwards main from the release-0.4 branch.
  • Adds the required CI step, workflow, metadata, ownership, and fast-forward script.
  • Validates branches and uses fast-forward-only Git operations before pushing updates.

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 7, 2026
@2uasimojo
2uasimojo force-pushed the mcp-server-auto-ff branch from 3696cd3 to 7c615b6 Compare August 7, 2026 22:12
@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 2uasimojo
Once this PR has been reviewed and has the lgtm label, please assign manusa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

Adds a CI fast-forward command, registers its step and workflow, and schedules a daily job to update the release-0.4 branch in the OpenShift MCP server repository.

Changes

MCP server fast-forward automation

Layer / File(s) Summary
Fast-forward command implementation
ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-commands.sh
The script creates isolated workspaces, validates branch settings, clones branches, applies git pull --ff-only, pushes updates, and reports failures.
CI step and workflow wiring
ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-ref.yaml, ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml, ci-operator/step-registry/openshift/mcp-server/fastforward/*.metadata.json
The step defines the image, resources, credentials, and branch variables. The workflow references the step. Metadata maps both definitions and assigns reviewers and approvers.
Scheduled release branch job
ci-operator/config/openshift/openshift-mcp-server/openshift-openshift-mcp-server-main.yaml, ci-operator/step-registry/openshift/mcp-server/fastforward/OWNERS
The configuration runs the fast-forward workflow daily at 06:00 UTC with release-0.4 as the destination branch. Ownership metadata identifies the component reviewers and approvers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ScheduledJob
  participant CIWorkflow
  participant FastforwardStep
  participant GitRepository
  ScheduledJob->>CIWorkflow: run daily at 06:00 UTC
  CIWorkflow->>FastforwardStep: invoke fast-forward workflow
  FastforwardStep->>GitRepository: clone source or destination branch
  FastforwardStep->>GitRepository: fast-forward destination with --ff-only
  FastforwardStep->>GitRepository: push release-0.4
Loading

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error The script embeds the OAuth token in repo_url (lines 27-28) and writes all git clone/pull/push output to fastforward.log via tee (lines 31, 33, 39, 47, 53). Do not place the token in a logged Git URL. Use a credential helper or protected auth mechanism, and redact Git output before writing artifacts.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the OpenShift MCP server and its daily automatic fast-forward change.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR changes CI YAML, metadata, OWNERS, and a shell script. It adds no Ginkgo tests or test-title declarations, so the check is not applicable.
Test Structure And Quality ✅ Passed The pull request adds CI YAML, OWNERS, metadata, and a Bash workflow only; no Ginkgo test files, It blocks, or test lifecycle calls were added or modified.
Microshift Test Compatibility ✅ Passed The pull request adds only CI YAML, metadata, OWNERS, and a shell script; the complete diff adds no Ginkgo e2e tests or MicroShift-relevant API usage.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The commit changes only CI YAML, JSON, OWNERS, and a shell workflow; no Go/test paths or added Ginkgo constructs were found, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility ✅ Passed The patch adds CI configuration, a Prow job, metadata, and a Git fast-forward script; it adds no deployment, operator, controller, or topology scheduling constraints.
Ote Binary Stdout Contract ✅ Passed The PR adds CI YAML, metadata, and a Bash command script only; no OTE binary or Go process-level entrypoint is changed.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The pull request adds CI configuration and a shell fast-forward workflow, but no new Ginkgo e2e tests or test source files. The IPv6/disconnected test check is not applicable.
No-Weak-Crypto ✅ Passed Changed files contain no MD5, SHA1, DES, RC4, Blowfish, ECB, or custom crypto; the token is only read for HTTPS Git authentication and is not compared.
Container-Privileges ✅ Passed Changed manifests and the generated periodic job contain no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root user settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

Co-Authored-By: claude
@2uasimojo
2uasimojo force-pushed the mcp-server-auto-ff branch from 7c615b6 to 050c2ad Compare August 7, 2026 22:15
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@2uasimojo: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-openshift-mcp-server-main-fast-forward-release-0-4 N/A periodic Periodic changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@2uasimojo: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-openshift-mcp-server-main-fast-forward-release-0-4 N/A periodic Periodic changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@2uasimojo: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-openshift-mcp-server-main-fast-forward-release-0-4 N/A periodic Periodic changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-commands.sh`:
- Around line 30-36: Update the destination-branch clone handling in the
fast-forward command script so only a confirmed missing $DESTINATION_BRANCH
enters the fallback clone and branch-creation path. Preserve and propagate
authentication, network, repository, and server errors instead of treating them
as absent branches; use the existing git/logging flow and symbols without
changing successful clone behavior.
- Around line 16-25: Update the fast-forward script’s startup validation to
check both SOURCE_BRANCH and DESTINATION_BRANCH before the settings log, using
${SOURCE_BRANCH:-} so an unset or empty source is rejected safely under set -u.
Preserve the existing error-and-exit behavior, then allow logging and subsequent
git clone operations only after both branch values are valid.

In
`@ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml`:
- Around line 3-5: Update the workflow’s steps declaration to include empty pre
and post phases alongside the existing test phase, preserving the
openshift-mcp-server-fastforward test reference. Then run make
validate-step-registry to verify the step registry.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: b753127d-7919-4dc0-9a94-015ed402f3e1

📥 Commits

Reviewing files that changed from the base of the PR and between 916113d and 050c2ad.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift/openshift-mcp-server/openshift-openshift-mcp-server-main-periodics.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (7)
  • ci-operator/config/openshift/openshift-mcp-server/openshift-openshift-mcp-server-main.yaml
  • ci-operator/step-registry/openshift/mcp-server/fastforward/OWNERS
  • ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-commands.sh
  • ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-ref.metadata.json
  • ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-ref.yaml
  • ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.metadata.json
  • ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml

Comment on lines +16 to +25
log "INFO Fast-forward settings"
log " REPO_OWNER = $REPO_OWNER"
log " REPO_NAME = $REPO_NAME"
log " SOURCE_BRANCH = $SOURCE_BRANCH"
log " DESTINATION_BRANCH = $DESTINATION_BRANCH"

if [[ -z "$DESTINATION_BRANCH" ]]; then
log "ERROR DESTINATION_BRANCH may not be empty"
exit 1
fi

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Validate SOURCE_BRANCH before logging and cloning.

The reference supplies main by default, but an override can be empty. The script checks only DESTINATION_BRANCH; an empty source reaches both git clone -b calls, and an unset source exits at the settings log because set -u runs before validation. Move both branch checks before the settings log and reject ${SOURCE_BRANCH:-}.

The analogous ci-operator/step-registry/windows/ci/fastforward/windows-ci-fastforward-commands.sh:114-122 validates both branch variables.

Proposed validation order
-log "INFO Fast-forward settings"
-log "    REPO_OWNER         = $REPO_OWNER"
-log "    REPO_NAME          = $REPO_NAME"
-log "    SOURCE_BRANCH      = $SOURCE_BRANCH"
-log "    DESTINATION_BRANCH = $DESTINATION_BRANCH"
-
-if [[ -z "$DESTINATION_BRANCH" ]]; then
+if [[ -z "${SOURCE_BRANCH:-}" ]]; then
+    log "ERROR SOURCE_BRANCH may not be empty"
+    exit 1
+fi
+if [[ -z "${DESTINATION_BRANCH:-}" ]]; then
     log "ERROR DESTINATION_BRANCH may not be empty"
     exit 1
 fi
+
+log "INFO Fast-forward settings"
+log "    REPO_OWNER         = $REPO_OWNER"
+log "    REPO_NAME          = $REPO_NAME"
+log "    SOURCE_BRANCH      = $SOURCE_BRANCH"
+log "    DESTINATION_BRANCH = $DESTINATION_BRANCH"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
log "INFO Fast-forward settings"
log " REPO_OWNER = $REPO_OWNER"
log " REPO_NAME = $REPO_NAME"
log " SOURCE_BRANCH = $SOURCE_BRANCH"
log " DESTINATION_BRANCH = $DESTINATION_BRANCH"
if [[ -z "$DESTINATION_BRANCH" ]]; then
log "ERROR DESTINATION_BRANCH may not be empty"
exit 1
fi
if [[ -z "${SOURCE_BRANCH:-}" ]]; then
log "ERROR SOURCE_BRANCH may not be empty"
exit 1
fi
if [[ -z "${DESTINATION_BRANCH:-}" ]]; then
log "ERROR DESTINATION_BRANCH may not be empty"
exit 1
fi
log "INFO Fast-forward settings"
log " REPO_OWNER = $REPO_OWNER"
log " REPO_NAME = $REPO_NAME"
log " SOURCE_BRANCH = $SOURCE_BRANCH"
log " DESTINATION_BRANCH = $DESTINATION_BRANCH"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-commands.sh`
around lines 16 - 25, Update the fast-forward script’s startup validation to
check both SOURCE_BRANCH and DESTINATION_BRANCH before the settings log, using
${SOURCE_BRANCH:-} so an unset or empty source is rejected safely under set -u.
Preserve the existing error-and-exit behavior, then allow logging and subsequent
git clone operations only after both branch values are valid.

Comment on lines +30 to +36
log "INFO Cloning $DESTINATION_BRANCH"
if ! git clone -b "$DESTINATION_BRANCH" "$repo_url" 2>&1 | tee -a "$log_file"; then
log "INFO $DESTINATION_BRANCH does not exist, creating from $SOURCE_BRANCH"
if ! git clone -b "$SOURCE_BRANCH" "$repo_url" 2>&1 | tee -a "$log_file"; then
log "ERROR Could not clone $SOURCE_BRANCH"
exit 1
fi

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Do not treat every destination clone failure as a missing branch.

The condition also catches authentication, network, repository, and server failures. The script then retries from the source branch and may attempt an unnecessary branch creation and push. Distinguish a missing destination branch from other clone failures before entering the creation path.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-commands.sh`
around lines 30 - 36, Update the destination-branch clone handling in the
fast-forward command script so only a confirmed missing $DESTINATION_BRANCH
enters the fallback clone and branch-creation path. Preserve and propagate
authentication, network, repository, and server errors instead of treating them
as absent branches; use the existing git/logging flow and symbols without
changing successful clone behavior.

Comment on lines +3 to +5
steps:
test:
- ref: openshift-mcp-server-fastforward

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

file='ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml'

printf '%s\n' '--- workflow ---'
cat -n "$file"

printf '%s\n' '--- related workflow phase declarations ---'
rg -n -U 'phases:|^[[:space:]]+(pre|test|post):' \
  ci-operator/step-registry/openshift/mcp-server \
  ci-operator/step-registry/openshift -g '*-workflow.yaml' | head -200

printf '%s\n' '--- workflow validation references ---'
rg -n 'validate-step-registry|workflow.*pre|workflow.*post|^[[:space:]]*pre:|^[[:space:]]*post:' \
  Makefile ci-operator/step-registry hack 2>/dev/null | head -240

printf '%s\n' '--- referenced step ---'
rg -n -U 'name: openshift-mcp-server-fastforward|openshift-mcp-server-fastforward' \
  ci-operator/step-registry | head -120

printf '%s\n' '--- file status ---'
git status --short -- "$file"
git diff --stat -- "$file"

Repository: openshift/release

Length of output: 50373


🏁 Script executed:

#!/bin/bash
set -eu

file='ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml'

printf '%s\n' '--- validation target ---'
sed -n '155,178p' Makefile

printf '%s\n' '--- validator implementation references ---'
rg -n -i --glob '*.go' --glob '*.sh' --glob '*.py' \
  'validate-step-registry|step-registry.*valid|workflow.*phase|pre.*test.*post' . \
  | head -160

printf '%s\n' '--- exact phase-shape examples ---'
for f in \
  ci-operator/step-registry/telco5g/kpi-results/telco5g-kpi-results-workflow.yaml \
  ci-operator/step-registry/openshift/edge-tooling/agent-eval/openshift-edge-tooling-agent-eval-workflow.yaml \
  ci-operator/step-registry/openshift/agentic/trt/jira-solver/openshift-agentic-trt-jira-solver-workflow.yaml
do
  if test -f "$f"; then
    echo "--- $f"
    cat -n "$f"
  fi
done

printf '%s\n' '--- file tracking and change status ---'
git ls-files --error-unmatch "$file"
git diff --name-status -- "$file"
git diff --numstat -- "$file"

printf '%s\n' '--- referenced step definitions ---'
rg -n -C 3 '^name: openshift-mcp-server-fastforward$|^  as: openshift-mcp-server-fastforward$|ref: openshift-mcp-server-fastforward' \
  ci-operator/step-registry

Repository: openshift/release

Length of output: 7119


Declare the required pre, test, and post phases.

Add empty pre: [] and post: [] phases, then run make validate-step-registry.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/openshift/mcp-server/fastforward/openshift-mcp-server-fastforward-workflow.yaml`
around lines 3 - 5, Update the workflow’s steps declaration to include empty pre
and post phases alongside the existing test phase, preserving the
openshift-mcp-server-fastforward test reference. Then run make
validate-step-registry to verify the step registry.

Source: Coding guidelines

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant