CNTRLPLANE-3255: enable CodeRabbit reviews on draft PRs

[bryan-cox]

What this PR does / why we need it:

Enables CodeRabbit to run reviews on draft PRs by adding auto_review.drafts: true to .coderabbit.yaml. Currently CodeRabbit skips draft PRs, which means developers don't get early AI review feedback while work is still in progress.

Reference: CodeRabbit YAML Configuration - auto_review.drafts

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-3255

Special notes for your reviewer:

None

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Chores
  • Enhanced code review configuration to enable automatic review generation for draft items.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 57af01be-2c4c-41d1-a3e8-144d561d72a1

📥 Commits

Reviewing files that changed from the base of the PR and between e687746 and 25db507.

📒 Files selected for processing (1)

• .coderabbit.yaml

✅ Files skipped from review due to trivial changes (1)

• .coderabbit.yaml

---

📝 Walkthrough

Walkthrough

This change updates .coderabbit.yaml by adding the configuration key reviews.auto_review.drafts: true, enabling automatic review behavior for draft items in addition to existing reviews settings. No other review-related keys, configuration structure, or functionality are modified.

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and clearly describes the main change: enabling CodeRabbit reviews on draft PRs by adding the auto_review.drafts configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	This custom check regarding stable and deterministic Ginkgo test names is not applicable to this pull request as the PR exclusively modifies configuration files and vendor dependencies.
Test Structure And Quality	✅ Passed	PR only modifies .coderabbit.yaml to enable auto_review for drafts; no Ginkgo test code changes present.
Microshift Test Compatibility	✅ Passed	The custom check for MicroShift test compatibility is designed to validate new Ginkgo e2e tests against MicroShift's limited API support. This PR only modifies .coderabbit.yaml and does not add or modify any test files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only modifies .coderabbit.yaml configuration file. No new Ginkgo e2e tests are added, so SNO Test Compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	This PR only modifies .coderabbit.yaml to enable CodeRabbit reviews on draft PRs. It contains no Kubernetes deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	OTE Binary Stdout Contract check is not applicable; PR only modifies .coderabbit.yaml configuration with no changes to test code or binaries.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only modifies .coderabbit.yaml configuration and adds no new Ginkgo e2e tests, so custom check does not apply.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3255 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Enable CodeRabbit to run reviews on draft PRs by adding drafts: true to .coderabbit.yaml

Test plan

• Open a draft PR and verify CodeRabbit runs its review

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
• Enabled draft code reviews functionality

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.coderabbit.yaml:
- Line 4: The `drafts: true` key is incorrectly placed under `reviews`; move it
into the nested `reviews.auto_review.drafts` location so the schema is
satisfied: remove the top-level `drafts` key and add `drafts: true` under the
existing `reviews.auto_review` mapping (preserve YAML boolean and correct
indentation), ensuring `reviews`, `auto_review`, and `drafts` are proper nested
keys.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a62e757-8b51-44a1-92f1-c2daac6d7644

📥 Commits

Reviewing files that changed from the base of the PR and between 0903f6b and 3f2217d.

📒 Files selected for processing (1)

• .coderabbit.yaml

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3255 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Enable CodeRabbit to run reviews on draft PRs by adding drafts: true to .coderabbit.yaml

Test plan

• Open a draft PR and verify CodeRabbit runs its review

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
• Enabled draft code reviews functionality.
• No other review settings or behaviors were changed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3255 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Enables CodeRabbit to run reviews on draft PRs by adding auto_review.drafts: true to .coderabbit.yaml. Currently CodeRabbit skips draft PRs, which means developers don't get early AI review feedback while work is still in progress.

Reference: CodeRabbit YAML Configuration - auto_review.drafts

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-3255

Special notes for your reviewer:

None

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3255 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Enables CodeRabbit to run reviews on draft PRs by adding auto_review.drafts: true to .coderabbit.yaml. Currently CodeRabbit skips draft PRs, which means developers don't get early AI review feedback while work is still in progress.

Reference: CodeRabbit YAML Configuration - auto_review.drafts

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-3255

Special notes for your reviewer:

None

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Chores
• Enhanced code review configuration to enable automatic review generation for draft items.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/area ci-tooling

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 34.65%. Comparing base (0903f6b) to head (25db507).
⚠️ Report is 41 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8250   +/-   ##
=======================================
  Coverage   34.65%   34.65%           
=======================================
  Files         767      767           
  Lines       93263    93263           
=======================================
  Hits        32318    32318           
  Misses      58266    58266           
  Partials     2679     2679           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[hypershift-jira-solve-ci]

Now I have all the evidence. Here is the final analysis:

Test Failure Analysis Complete

Job Information

• Prow Job: Red Hat Konflux / enterprise-contract-mce-217 / hypershift-release-mce-217
• Build ID: enterprise-contract-mce-217-p49s6 (Konflux PipelineRun)
• Component: hypershift-release-mce-217
• Application: release-mce-217
• Snapshot: release-mce-217-20260415-153259-000
• PR: #8250 — CNTRLPLANE-3255: enable CodeRabbit reviews on draft PRs
• Check Run: 71483704703

Test Failure Analysis

Error

Integration test for component hypershift-release-mce-217 snapshot
release-mce-217-20260415-153259-000 and scenario enterprise-contract-mce-217
has failed.

verify task: 260 success(es), 31 warning(s), 2 failure(s)

Summary

This is a transient Konflux Enterprise Contract (EC) verification failure completely unrelated to the PR's code changes (which only modify .coderabbit.yaml). The hypershift-release-mce-217 container image failed 2 out of 293 EC policy checks during a narrow window on April 15, 2026. The same EC scenario passes for other PRs both before (PR #8246 at 12:53 UTC) and after (PR #8251 at 17:52 UTC) this run. The EC check is not a required status check for PR merging — only ci/prow/* checks are required. Re-triggering the Konflux pipeline (e.g., by pushing an empty commit or using the Konflux UI) will resolve the failure.

Root Cause

The failure is a transient infrastructure issue in the Konflux Enterprise Contract verification pipeline, coinciding with the same-day release of EC policies v1.0.21 (enterprise-contract/ec-policies tag v1.0.21, published at 09:29 UTC on April 15, 2026).

What happened:

• EC policies v1.0.21 was released at 09:29 UTC on April 15, introducing changes to attestation validation logic (policy/release/lib/attestations.rego), including:
  • Refactoring hardcoded pipelinerun_att_build_types / slsav1_pipelinerun_att_build_types to configurable allowed_provenance_build_types via rule_data
  • Changing PipelineRun vs TaskRun attestation filtering logic
  • Adding SLSA v1 spec-compliant finishedOn timestamp support
  • Adding a new hermetic_task policy package (with a future effective_on: 2026-06-01)
• PR OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246's EC check passed at 12:53 UTC (262 successes, 31 warnings, 0 failures)
• PR CNTRLPLANE-3255: enable CodeRabbit reviews on draft PRs #8250's EC check failed at 15:32 UTC (260 successes, 31 warnings, 2 failures)
• PR OCPBUGS-77040: Add AWS ISO domains to konnectivity IsCloudAPI #8251's EC check passed at 17:52 UTC (neutral/warning, 0 failures)
• PR OCPBUGS-83328: fix skipProxyForKAS to use standard NO_PROXY matching #8254's EC check passed at 18:11 UTC (262 successes, 43 warnings, 0 failures)

The 2 failures are specific to the hypershift-release-mce-217 image — the hypershift-cli-mce-217 component in the same snapshot passed EC. Both components are built from the same source code but use different Containerfiles (Containerfile.operator vs Containerfile.cli). The failure window was approximately 15:32–17:52 UTC (~2.5 hours), consistent with a policy rollout or infrastructure propagation delay.

Why it's not the PR's fault:

• The PR only changes .coderabbit.yaml — a CodeRabbit configuration file with zero impact on container image content, build process, or SLSA attestations.
• The build pipeline (hypershift-release-mce-217-on-pull-request) succeeded — the image was built correctly.
• The failure is in the post-build Enterprise Contract policy verification, which validates image attestations, signatures, and compliance independently of source code changes.

Recommendations

1. Re-trigger the Konflux EC check — The transient issue has resolved itself (later PRs pass). Options:

   • Push an empty commit to the PR branch: git commit --allow-empty -m "ci: retrigger Konflux checks" && git push
   • Use the Konflux UI to re-run the enterprise-contract-mce-217 pipeline for this snapshot
   • Comment /retest if the Konflux Pipelines-as-Code bot supports it

2. No code changes needed — The PR content is correct and unrelated to the failure.

3. This check is not required — Only ci/prow/images, ci/prow/okd-scos-images, and ci/prow/verify-deps are required status checks. The Konflux EC check will not block merging.

4. If the failure persists after re-triggering, investigate with the Konflux/EC team:

   • Check the enterprise-contract/ec-policies v1.0.21 release for regressions in attestation validation
   • Verify the EC policy configuration for enterprise-contract-mce-217 scenario is referencing the correct policy version
   • Check Konflux platform status for any known incidents during the April 15 15:00–18:00 UTC window

Evidence

Evidence	Detail
Failing check	Red Hat Konflux / enterprise-contract-mce-217 / hypershift-release-mce-217
Conclusion	failure (2 policy violations out of 293 checks)
Check result breakdown	260 successes, 31 warnings, 2 failures
PR files changed	.coderabbit.yaml only (zero image/build impact)
Build pipeline result	hypershift-release-mce-217-on-pull-request: success
Image	quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-release-mce-217:on-pr-25db507 (digest: sha256:027867a7...)
Same-snapshot CLI check	hypershift-cli-mce-217: passed (neutral, 260 successes, 64 warnings, 0 failures)
EC policy release	enterprise-contract/ec-policies v1.0.21 released same day (09:29 UTC)
PR #8246 EC result (12:53 UTC)	success — 262 successes, 31 warnings, 0 failures
PR #8250 EC result (15:32 UTC)	failure — 260 successes, 31 warnings, 2 failures
PR #8251 EC result (17:52 UTC)	neutral/warning — 0 failures
PR #8254 EC result (18:11 UTC)	neutral/warning — 262 successes, 43 warnings, 0 failures
Required check?	No — only ci/prow/* checks are required for merging
Failure window	~15:32–17:52 UTC on April 15, 2026 (~2.5 hours)
Containerfile	Containerfile.operator (hermetic build, registry.access.redhat.com/ubi9/ubi-minimal:9.7 base)

---

[cblecker]

/verified bypass
/lgtm

[openshift-ci-robot]

@cblecker: The verified label has been added.

Details

In response to this:

/verified bypass
/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[bryan-cox]

/override "Red Hat Konflux / enterprise-contract-mce-217 / hypershift-release-mce-217"

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: Red Hat Konflux / enterprise-contract-mce-217 / hypershift-release-mce-217

Details

In response to this:

/override "Red Hat Konflux / enterprise-contract-mce-217 / hypershift-release-mce-217"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.