[eliorerz]

Draft, step A of two. Do not merge before the osac switch window: merge it immediately before osac#1613 (the pull request that introduces the new pipeline) and then merge step B. Merged earlier, it would block every osac pull request, because the CI check does not exist on osac main until #1613 merges.

What it changes for osac:

• Required checks: the 26 old checks (the per-suite gates, check-labels and the per-component names) are replaced by CI and jira-reference. CI is one job that adds up every cheap check that applies to the change; jira-reference says the title names a Jira issue or NO-ISSUE.
• Approval: one native GitHub approval, dismissed when a new commit is pushed, instead of the Prow lgtm and approved labels.
• Unchanged: the merge queue, the bypass teams and organization admins.

Prow stays only for the Jira reference, the Jira lifecycle and cherry-picks.

Rollback: revert this commit. The old checks come back, and osac#1613 would have to be reverted with it, because the old checks no longer report once it is merged.

Summary

• CI and repository policy: The osac repository now requires the GitHub Actions checks CI and jira-reference. One native GitHub approval is required, and GitHub dismisses approvals after a new commit.
• Review and merge controls: Prow remains responsible for Jira references, Jira lifecycle, and cherry-picks. The configured bypass teams and merge-queue settings remain unchanged.
• Compatibility and rollout: This changes the required status-check names and review gate. Merge this change only after the new pipeline exists on main; the prior checks stop reporting after that pipeline merges. The full-install E2E check is deferred to a later step.
• Other areas: No API, database, application-controller, or test changes are described. Test results are not provided.

Risk classification

The applied risk label and its classification criteria are not available in the supplied evidence. I cannot determine whether risk:ship, risk:show, or risk:ask applies, or identify a close alternative.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 33d567d4-6c97-41d9-a63f-a94a1d2cfbfd

📥 Commits

Reviewing files that changed from the base of the PR and between 857a420 and d3e7d51.

📒 Files selected for processing: 1

• repositories.tf

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The repo_osac configuration now requires one native GitHub approval and dismisses stale approvals. It replaces the previous required checks with CI and jira-reference.

Changes

OSAC branch protection

Layer / File(s)	Summary
Update branch protection requirements repositories.tf	repo_osac now requires one native GitHub approval and dismisses stale approvals. Its required checks are CI and jira-reference; comments note that full-install E2E will be added later.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested labels: risk:ask

Suggested reviewers: minmzzhang, omer-vishlitzky

Merge Risk: ⚪ Minimal · up to d3e7d

No actionable merge blocker is established. Keep the planned close sequencing with osac#1613.

Pre-merge checks: 11

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main changes: requiring the CI and jira-reference checks and one native GitHub approval for osac.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets		The pull request changes only repositories.tf and adds review/check configuration. The added literals are 1, true, CI, jira-reference, and integration ID 15368; none is an API key, token, …
No-Weak-Crypto		The pull request changes only repositories.tf and adds repository rules for approvals and required CI checks. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or…
No-Injection-Vectors		PASS: The PR changes only Terraform repository settings and comments. Added values are fixed literals (1, true, CI, and jira-reference). The module passes them to GitHub review and status-chec…
Container-Privileges		PASS: The pull request changes only repositories.tf, which updates GitHub repository rules for repo_osac. The diff introduces no container or Kubernetes manifest and no privileged, hostPID, `h…
No-Sensitive-Data-In-Logs		The pull request changes only repositories.tf. The diff adds repository rules and comments for approvals and required checks. It adds no logging, output statements, or handling of passwords, tokens,…
Ai-Attribution		PASS: The authored PR description and the commit message do not mention AI tools. The reviewed commit has only a Signed-off-by trailer, with no Assisted-by, Generated-by, or Co-Authored-By trailer. Re…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

The pull request changes only repositories.tf and adds review/check configuration. The added literals are 1, true, CI, jira-reference, and integration ID 15368; none is an API key, token, password, private key, credential, embedded-credential URL, or secret-shaped encoded value.

Full details: No-Weak-Crypto

Explanation

The pull request changes only repositories.tf and adds repository rules for approvals and required CI checks. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret-comparison logic.

Full details: No-Injection-Vectors

Explanation

PASS: The PR changes only Terraform repository settings and comments. Added values are fixed literals (1, true, CI, and jira-reference). The module passes them to GitHub review and status-check resources. No SQL concatenation, shell execution, eval/exec, pickle or unsafe YAML loading, or dangerouslySetInnerHTML appears in the changed code.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only repositories.tf, which updates GitHub repository rules for repo_osac. The diff introduces no container or Kubernetes manifest and no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root-user, or allowPrivilegeEscalation setting.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes only repositories.tf. The diff adds repository rules and comments for approvals and required checks. It adds no logging, output statements, or handling of passwords, tokens, API keys, PII, session IDs, hostnames, or customer data.

Full details: Ai-Attribution

Explanation

PASS: The authored PR description and the commit message do not mention AI tools. The reviewed commit has only a Signed-off-by trailer, with no Assisted-by, Generated-by, or Co-Authored-By trailer. Red Hat AI attribution is therefore not required by this check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}