From 650fc7bf8a6349aed6ae611bb17e5c6696c5bf51 Mon Sep 17 00:00:00 2001
From: Giulio Frasca <gfrasca@redhat.com>
Date: Thu, 16 Jul 2026 11:19:12 -0400
Subject: [PATCH] ARO-HCP: use Prow PULL_BASE_SHA instead of fetching main for
 e2e-upgrade

- Use the Prow-provided PULL_BASE_SHA to check out the exact merge base
commit, avoiding a redundant git fetch to GitHub.
- Falls back to fetching main for rehearsal runs (JOB_NAME=rehearsal-*)
- Fails fast if non-rehearsal job and PULL_BASE_SHA not found

Signed-off-by: Giulio Frasca <gfrasca@redhat.com>
---
 .../aro-hcp-provision-from-main-commands.sh   | 39 +++++++++++++++----
 .../aro-hcp-provision-from-main-ref.yaml      | 12 ++++--
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh b/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
index 108943df00b06..bc7aad97770e6 100644
--- a/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
+++ b/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-commands.sh
@@ -27,14 +27,37 @@ az account set --subscription "${INFRA_SUBSCRIPTION_ID}"
 oc version
 kubelogin --version
 
-# Check out main branch to provision the baseline environment.
-# The container image has the PR source baked in; we swap to main so that
-# Bicep templates, Helm charts, config, and pipeline definitions all come
-# from the current state of the default branch.
-echo "Fetching and checking out main for baseline provision ..."
-git fetch https://github.com/Azure/ARO-HCP.git main
-git checkout -f FETCH_HEAD
-echo "Checked out main at $(git rev-parse --short HEAD)"
+# Check out the base branch to provision the baseline environment.
+# The container has the PR merge commit baked in; we rewind to the base
+# so Bicep templates, Helm charts, config, and pipeline definitions all
+# come from what the PR is being merged into.
+#
+# Prow sets PULL_BASE_SHA to the exact base-branch commit used for the
+# merge. That commit is already in the local clone, so no fetch needed.
+# Rehearsal runs (JOB_NAME prefixed with "rehearse-") fetch main
+# explicitly, since PULL_BASE_SHA belongs to the openshift/release repo.
+IS_REHEARSAL=false
+if [[ "${JOB_NAME:-}" == rehearse-* ]]; then
+  IS_REHEARSAL=true
+fi
+
+if [[ "${IS_REHEARSAL}" == "true" ]]; then
+  echo "Rehearsal detected (JOB_NAME=${JOB_NAME:-unset}), fetching main ..."
+  git fetch https://github.com/Azure/ARO-HCP.git main
+  git checkout -f FETCH_HEAD
+else
+  if [[ -z "${PULL_BASE_SHA:-}" ]]; then
+    echo "ERROR: PULL_BASE_SHA is not set and this is not a rehearsal. Cannot determine base commit."
+    exit 1
+  fi
+  if ! git cat-file -e "${PULL_BASE_SHA}" 2>/dev/null; then
+    echo "ERROR: PULL_BASE_SHA=${PULL_BASE_SHA} not found in git history."
+    exit 1
+  fi
+  echo "Using Prow merge base ${PULL_BASE_SHA}"
+  git checkout -f "${PULL_BASE_SHA}"
+fi
+echo "Checked out base at $(git rev-parse --short HEAD)"
 
 # The images-push-postsubmit job runs the aro-hcp-images-push step on every
 # merge to main (DEPLOY_ENV=dev), mirroring CI-built service images into the
diff --git a/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml b/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
index 3c0dd95fd1be9..db81d91b3f069 100644
--- a/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
+++ b/ci-operator/step-registry/aro-hcp/provision/from-main/aro-hcp-provision-from-main-ref.yaml
@@ -37,7 +37,11 @@ ref:
     Provision an ARO HCP baseline environment from the main branch.
     Used as the first phase of upgrade-path validation: the environment
     is created from main, then upgraded to the PR branch in a subsequent step.
-    Resolves main's HEAD commit SHA and looks up the corresponding images
-    in ACR (pushed by the postsubmit images-push job), polling until
-    available. If HEAD's images never appear, walks back through recent
-    history to find the newest commit with images already pushed.
+    Uses the Prow-provided PULL_BASE_SHA to check out the exact base
+    commit (no network fetch required). Detects rehearsal runs via the
+    JOB_NAME prefix and fetches main explicitly; non-rehearsal runs
+    with an invalid PULL_BASE_SHA fail immediately.
+    Resolves the base commit's images in ACR (pushed by the postsubmit
+    images-push job), polling until available. If the base commit's
+    images never appear, walks back through recent history to find the
+    newest commit with images already pushed.