NO-ISSUE: Require the E2E check from the OSAC CI app and code owner review on osac

[eliorerz]

Draft, step B of two, stacked on step A: its diff shows both until step A is merged, and I rebase it then. Merge it right after osac#1613 has merged.

Adds the E2E check to the required checks of osac, pinned to the OSAC CI app (integration id 4966101), which writes it for pull requests and for merge queue entries. A workflow that is not that app cannot satisfy it. Also turns on code owner review: CODEOWNERS on main (after #1613) lists only the paths that need an owner (.github/, proto/ and the installer), so this asks for a code owner on those paths only.

It cannot be merged before #1613, because E2E is not written by anything until the new workflows are on osac main.

Summary

• CI and repository governance: repo_osac now requires one approval, dismisses stale approvals after new commits, and requires code-owner approval for paths listed in CODEOWNERS.
• Required checks: The rules require CI and jira-reference from GitHub Actions integration 15368, plus E2E from the OSAC CI app integration 4966101. The E2E check must come from that app.
• Other areas: No API, controller, database, authentication, deployment, test, or documentation changes are shown. This changes merge requirements, so pull requests that do not meet the new review and check requirements may no longer merge. The stated dependency on osac#1613 remains relevant: E2E must be reported on osac main before this requirement can be met.

Risk classification

The applied risk label and its criteria are not available in the supplied evidence. I cannot determine whether risk:ship, risk:show, or risk:ask was applied, or which alternative classification was close.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 91008a78-f8eb-45f5-a335-58e8a326e9e3

📥 Commits

Reviewing files that changed from the base of the PR and between 14e4a52 and 1b45066.

📒 Files selected for processing: 1

• repositories.tf

+-------------------------------------+
| No code too small, no bug too tall. |
+-------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 412b8d8e-db4c-46f9-b3d2-58d895522bef

📥 Commits

Reviewing files that changed from the base of the PR and between 857a420 and 14e4a52.

📒 Files selected for processing: 1

• repositories.tf

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

Walkthrough

The repo_osac configuration replaces Prow label-based approval and individual CI gates with native GitHub review requirements and three required status checks.

Changes

OSAC Review Requirements

Layer / File(s)	Summary
Approval settings and required checks repositories.tf	repo_osac requires one approval, dismisses stale approvals, and requires code-owner approval. Required checks are CI and jira-reference from integration 15368, and E2E from integration 4966101.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested labels: risk:ask

Suggested reviewers: omer-vishlitzky, minmzzhang

Merge Risk: ⚪ Minimal · up to 14e4a

This change requires the E2E check from the OSAC CI app and code owner review on osac. It must merge only after osac#1613 so that E2E is reported on main. Otherwise there are no concrete code risks.

Pre-merge checks: 11

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the two main changes: requiring the OSAC CI app E2E check and enabling code owner review for osac.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets		The pull request changes only repositories.tf. Added values are review settings, status-check names, and integration IDs. No API key, token, password, private key, credential, embedded-credential UR…
No-Weak-Crypto		PASS. The pull request changes only repositories.tf and updates repository review and status-check settings. The reviewed diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, …
No-Injection-Vectors		PASS: The pull request changes only static GitHub repository settings in repositories.tf. The added lines define review requirements and required status checks; they do not introduce SQL concatenati…
Container-Privileges		The pull request changes only repositories.tf, which configures GitHub repository rules and required checks. It introduces no container or Kubernetes manifest and no privileged, hostPID, `hostNe…
No-Sensitive-Data-In-Logs		The pull request changes only Terraform repository settings and comments in repositories.tf. It adds review and status-check requirements and removes prior requirements. The diff adds no logging, ou…
Ai-Attribution		No AI tool use is mentioned in the pull request description or the two commit messages. The commit trailers contain only Signed-off-by; no Assisted-by, Generated-by, or AI-related Co-Authored-By trail…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: No-Hardcoded-Secrets

Explanation

The pull request changes only repositories.tf. Added values are review settings, status-check names, and integration IDs. No API key, token, password, private key, credential, embedded-credential URL, or base64/hex secret blob appears in the added lines.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request changes only repositories.tf and updates repository review and status-check settings. The reviewed diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret-comparison code.

Full details: No-Injection-Vectors

Explanation

PASS: The pull request changes only static GitHub repository settings in repositories.tf. The added lines define review requirements and required status checks; they do not introduce SQL concatenation, shell execution, dynamic evaluation, unsafe deserialization, unsafe YAML loading, os.system, or dangerouslySetInnerHTML. No user-input interpolation appears in the changed lines.

Full details: Container-Privileges

Explanation

The pull request changes only repositories.tf, which configures GitHub repository rules and required checks. It introduces no container or Kubernetes manifest and no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root user, or allowPrivilegeEscalation setting.

Full details: No-Sensitive-Data-In-Logs

Explanation

The pull request changes only Terraform repository settings and comments in repositories.tf. It adds review and status-check requirements and removes prior requirements. The diff adds no logging, output, credentials, tokens, personal data, hostnames, or customer data.

Full details: Ai-Attribution

Explanation

No AI tool use is mentioned in the pull request description or the two commit messages. The commit trailers contain only Signed-off-by; no Assisted-by, Generated-by, or AI-related Co-Authored-By trailer appears.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}