Skip to content

ARO-HCP: use Prow PULL_BASE_SHA instead of fetching main for upgrade presubmit - #82018

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
gmfrasca:arohcp-upgrade-usepullref
Jul 17, 2026
Merged

ARO-HCP: use Prow PULL_BASE_SHA instead of fetching main for upgrade presubmit#82018
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
gmfrasca:arohcp-upgrade-usepullref

Conversation

@gmfrasca

@gmfrasca gmfrasca commented Jul 16, 2026

Copy link
Copy Markdown
Member

Summary

The aro-hcp-provision-from-main step was doing git fetch https://github.com/Azure/ARO-HCP.git main to check out the base branch, which is redundant and non-deterministic. Prow already clones the repo and sets PULL_BASE_SHA to the exact base-branch commit used for the merge, so the commit is already
in the local clone.

This PR switches to using PULL_BASE_SHA directly (no network fetch needed).
Rehearsal runs are detected explicitly via the JOB_NAME prefix (rehearse-*)
Non-rehearsal runs with a missing or invalid PULL_BASE_SHA fail immediately with a clear error.

Changes

  • Detect rehearsals via JOB_NAME == rehearse-* and fetch main explicitly
  • Use PULL_BASE_SHA directly for non-rehearsal runs
  • Fail with clear errors if PULL_BASE_SHA is missing or invalid outside of rehearsals
  • Update ref documentation to describe the new behavior

Testing

  • Rehearsal via /pj-rehearse pull-ci-Azure-ARO-HCP-main-upgrade-e2e-parallel

Summary by CodeRabbit

  • Updated the ARO HCP upgrade presubmit provisioning step to use Prow’s PULL_BASE_SHA, ensuring tests provision from the pull request’s actual base commit rather than always using main.
  • Added explicit rehearsal handling: jobs with a rehearse-* JOB_NAME fetch and use main.
  • Added clear failures for missing or invalid base commit references in non-rehearsal runs.
  • Updated step documentation and image lookup behavior to target artifacts associated with the selected base commit.
  • Validated through an upgrade E2E rehearsal.

@gmfrasca

Copy link
Copy Markdown
Member Author

/pj-rehearse pull-ci-Azure-ARO-HCP-main-upgrade-e2e-parallel

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@gmfrasca: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci
openshift-ci Bot requested review from janboll and sclarkso July 16, 2026 15:31
@coderabbitai

coderabbitai Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d0a5ae4b-3af5-4ec6-802a-413f001d0690

📥 Commits

Reviewing files that changed from the base of the PR and between 25b8eec and 650fc7b.

📒 Files selected for processing (2)
  • ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
  • ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh

Walkthrough

The ARO HCP provision-from-main step now selects main only for rehearsal runs and otherwise requires a valid local PULL_BASE_SHA. Documentation reflects the selected commit, image resolution, and failure behavior.

Changes

ARO HCP base commit selection

Layer / File(s) Summary
Base checkout and image resolution
ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh, ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
Rehearsals fetch and check out main; other runs validate and check out PULL_BASE_SHA, failing when it is missing or unavailable. Documentation describes base-commit image resolution and history-walk fallback behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • openshift/release#81044: Both changes update ARO HCP provision-from-main checkout handling for base commits and rehearsal scenarios.

Suggested labels: rehearsals-ack

Suggested reviewers: janboll, sclarkso

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: switching the upgrade presubmit step from fetching main to using Prow's PULL_BASE_SHA.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only step-registry script/YAML files changed; no Ginkgo test titles or test code were added or modified.
Test Structure And Quality ✅ Passed PR only changes a shell step and YAML docs; no Ginkgo test code was added or modified, so the test-structure checks don’t apply.
Microshift Test Compatibility ✅ Passed The PR only changes a shell step and its ref docs; no new or modified Ginkgo e2e tests were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed This PR only changes a shell step and its YAML reference; no new Ginkgo tests, contexts, or It() blocks were added.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only changes a provisioning shell script and its docs; no manifests, operators, controllers, or topology/scheduling constraints were added.
Ote Binary Stdout Contract ✅ Passed Diff only changes a ci-operator shell step and docs; no OTE binary main/init/TestMain/suite code or stdout contract risk is present.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No Ginkgo e2e tests were added or modified; the PR only changes a shell step and its ref docs, with no IPv4/test-network assumptions.
No-Weak-Crypto ✅ Passed The PR only updates git checkout and ACR digest wiring; no weak ciphers, custom crypto, or secret/token comparisons are introduced.
Container-Privileges ✅ Passed No privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings appear in the modified step files.
No-Sensitive-Data-In-Logs ✅ Passed PASS: The new log lines only emit JOB_NAME, PULL_BASE_SHA, and commit SHAs; no passwords, tokens, PII, or other sensitive data are introduced.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

#
# Prow sets PULL_BASE_SHA to the exact base-branch commit used for the
# merge. That commit is already in the local clone, so no fetch needed.
# For rehearsal runs (openshift/release PRs), PULL_BASE_SHA belongs to a

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the rehearsal set any env that lets you know that you're in one? If so, detect it and use main explicitly, not implicitly. Make it so a non-rehearsal + invalid PULL_BASE_SHA -> failure.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could use the convention that rehearsal jobs are all prefixed with rehearse-. I am not finding any official documentation for that convention, but it is hardcoded here and various other jobs across the repo are using a similar check

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternatively we could simply check against REPO_OWNER/REPO_NAME but that's a bit more fragile IMO when dealing with forks, renames, etc

- Use the Prow-provided PULL_BASE_SHA to check out the exact merge base
commit, avoiding a redundant git fetch to GitHub.
- Falls back to fetching main for rehearsal runs (JOB_NAME=rehearsal-*)
- Fails fast if non-rehearsal job and PULL_BASE_SHA not found

Signed-off-by: Giulio Frasca <gfrasca@redhat.com>
@gmfrasca
gmfrasca force-pushed the arohcp-upgrade-usepullref branch from 25b8eec to 650fc7b Compare July 16, 2026 17:30
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@gmfrasca: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-Azure-ARO-HCP-main-upgrade-e2e-parallel Azure/ARO-HCP presubmit Registry content changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@gmfrasca

Copy link
Copy Markdown
Member Author

/pj-rehearse pull-ci-Azure-ARO-HCP-main-upgrade-e2e-parallel

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@gmfrasca: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@janboll

janboll commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 17, 2026
@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gmfrasca, janboll

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 17, 2026
@gmfrasca

Copy link
Copy Markdown
Member Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@gmfrasca: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 17, 2026
@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

@gmfrasca: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot
openshift-merge-bot Bot merged commit 3f5f152 into openshift:main Jul 17, 2026
12 checks passed
fracappa pushed a commit to fracappa/release that referenced this pull request Jul 22, 2026
…ade (openshift#82018)

- Use the Prow-provided PULL_BASE_SHA to check out the exact merge base
commit, avoiding a redundant git fetch to GitHub.
- Falls back to fetching main for rehearsal runs (JOB_NAME=rehearsal-*)
- Fails fast if non-rehearsal job and PULL_BASE_SHA not found

Signed-off-by: Giulio Frasca <gfrasca@redhat.com>
amogh-redhat pushed a commit to amogh-redhat/release that referenced this pull request Aug 5, 2026
…ade (openshift#82018)

- Use the Prow-provided PULL_BASE_SHA to check out the exact merge base
commit, avoiding a redundant git fetch to GitHub.
- Falls back to fetching main for rehearsal runs (JOB_NAME=rehearsal-*)
- Fails fast if non-rehearsal job and PULL_BASE_SHA not found

Signed-off-by: Giulio Frasca <gfrasca@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants