OSAC-3879: honor E2E path-ignore on merge queue

[minmzzhang]

Summary

• Apply the same docs/non-code path filter on merge_group as on pull_request, so merge-queue entries no longer always run full bmaas+caas+vmaas E2E
• Keep schedule / workflow_dispatch always-on; keep e2e-*-gate with if: always() so required ruleset checks still report when E2E is skipped
• Checkout with fetch-depth: 0 and persist-credentials: false for merge_group (dorny/paths-filter uses git diff)

Jira

https://redhat.atlassian.net/browse/OSAC-3879

Test plan

• Docs-only PR: expensive E2E skipped; gates pass
• Docs-only merge-queue entry: expensive E2E skipped; gates pass (no "Expected forever")
• Code PR / MQ entry: E2E still runs; gates reflect result
• schedule / workflow_dispatch: E2E still always runs
• Bugbot / security / CodeRabbit local reviews clean

Summary by CodeRabbit

• CI/CD
  • End-to-end installation checks now run for merge-group events.
  • Pull request and merge-group changes are filtered to determine when relevant checks should run.
  • Scheduled and manually triggered workflows continue to run without path filtering.
  • Improved repository history handling for merge-group validation.

[openshift-ci-robot]

@minmzzhang: This pull request references OSAC-3879 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Apply the same docs/non-code path filter on merge_group as on pull_request, so merge-queue entries no longer always run full bmaas+caas+vmaas E2E
• Keep schedule / workflow_dispatch always-on; keep e2e-*-gate with if: always() so required ruleset checks still report when E2E is skipped
• Checkout with fetch-depth: 0 and persist-credentials: false for merge_group (dorny/paths-filter uses git diff)

Jira

https://redhat.atlassian.net/browse/OSAC-3879

Test plan

• Docs-only PR: expensive E2E skipped; gates pass
• Docs-only merge-queue entry: expensive E2E skipped; gates pass (no "Expected forever")
• Code PR / MQ entry: E2E still runs; gates reflect result
• schedule / workflow_dispatch: E2E still always runs
• Bugbot / security / CodeRabbit local reviews clean

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The three E2E workflows now support merge_group events. They grant pull-request read access, apply path filtering to merge-group runs, preserve unconditional scheduled and manual runs, and use full repository history for merge-group path comparisons.

Changes

E2E merge-group workflow support

Layer / File(s)	Summary
Event handling and path filtering .github/workflows/e2e-*-full-install.yml	The workflows grant pull-requests: read, handle merge_group events, and preserve unconditional execution for scheduled and manually dispatched runs.
Merge-group repository checkout .github/workflows/e2e-*-full-install.yml	Merge-group runs check out full repository history without credentials before invoking dorny/paths-filter. Pull-request filtering remains enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osac-project/osac#169: Both changes add merge-group support and path-filtered execution to GitHub Actions E2E workflows.
• osac-project/osac#204: Both changes update GitHub Actions workflows for merge-queue events.
• osac-project/osac#222: Both changes modify the same three E2E workflows for merge-queue compatibility.

Suggested reviewers: eliorerz, omer-vishlitzky

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: applying E2E path-ignore behavior to merge-queue runs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The added workflow content contains no secret assignments, credential URLs, private-key material, or credential-shaped values; the only long hex strings are pinned GitHub Action commit SHAs.
No-Weak-Crypto	✅ Passed	The PR only changes GitHub Actions workflow control flow and checkout settings; scans found no MD5, weak cipher, custom crypto, or secret-comparison usage. The 40-hex value is an action commit pin.
No-Injection-Vectors	✅ Passed	The PR only adds GitHub Actions conditions, checkout options, and path filters; no SQL concatenation, shell=True, eval/exec, unsafe YAML/pickle loading, os.system, or dangerouslySetInnerHTML appears.
Container-Privileges	✅ Passed	The PR changes only GitHub Actions path filtering and checkout settings; no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation:true declarations were added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging commands or sensitive values; existing gate logs contain only job results, and merge-group checkout disables credential persistence.
Ai-Attribution	✅ Passed	The PR commit identifies Cursor as AI assistance with an Assisted-by trailer and contains no Co-Authored-By trailer.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-bmaas-full-install.yml:
- Line 50: Update the should-run conditions at
.github/workflows/e2e-bmaas-full-install.yml:50,
.github/workflows/e2e-caas-full-install.yml:50, and
.github/workflows/e2e-vmaas-full-install.yml:50 to fail closed for merge_group
events unless explicit authorization data is available, preventing reusable
workflows from fetching E2E secrets; preserve the existing behavior for
non-merge-group events and authorized pull requests.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 37810e5b-3cab-4e66-a0f5-4a83e78f5ecc

📥 Commits

Reviewing files that changed from the base of the PR and between 2c3160f and bfb1f48.

📒 Files selected for processing (3)

• .github/workflows/e2e-bmaas-full-install.yml
• .github/workflows/e2e-caas-full-install.yml
• .github/workflows/e2e-vmaas-full-install.yml

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz, minmzzhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eliorerz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Auto-dismissed: only Prow labels gate merging