NO-ISSUE: run PR CI suites on merge_group by minmzzhang · Pull Request #418 · osac-project/osac

minmzzhang · 2026-08-20T13:46:08Z

Summary

Trigger pre-commit, unit tests, and integration tests on merge_group so merge queue gets real pass/fail on the speculative SHA (fixes the checks_timed_out kick from github-config#191 / osac#375).
Apply the same docs-only path filter on merge_group as on pull_request (checkout + git diff, because dorny/paths-filter has no PR Files API there).
Point gitleaks at merge_group.base_sha / head_sha; keep the rotation comment PR-only (no issue number on merge_group).

Test plan

PR event still runs real pre-commit / unit / integration on this PR
After enqueue, merge-group SHA shows those jobs running (not missing); failure must block merge
Docs-only change still skips unit/integration (success); pre-commit still runs
Do not re-apply github-config required checks until this is on main

Summary by CodeRabbit

Chores
- Updated automated integration and unit test workflows to support merge queue validation.
- Improved change detection for pull requests and merge-group builds, ensuring relevant checks run consistently.
- Updated pre-commit checks and secret scanning to work with merge-group revisions.
- Limited rotation reminder comments to pull requests, reducing unnecessary notifications in other workflow runs.

Merge queue waits for checks on the speculative SHA. Without a merge_group trigger those jobs never report, so GitHub kicks the PR (checks_timed_out).

openshift-ci-robot · 2026-08-20T13:46:13Z

@minmzzhang: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Trigger pre-commit, unit tests, and integration tests on merge_group so merge queue gets real pass/fail on the speculative SHA (fixes the checks_timed_out kick from github-config#191 / osac#375).

Apply the same docs-only path filter on merge_group as on pull_request (checkout + git diff, because dorny/paths-filter has no PR Files API there).

Point gitleaks at merge_group.base_sha / head_sha; keep the rotation comment PR-only (no issue number on merge_group).

Test plan

PR event still runs real pre-commit / unit / integration on this PR

After enqueue, merge-group SHA shows those jobs running (not missing); failure must block merge

Docs-only change still skips unit/integration (success); pre-commit still runs

Do not re-apply github-config required checks until this is on main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-20T13:46:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b261193e-d470-4990-ad22-0e0abfdaf2aa

📥 Commits

Reviewing files that changed from the base of the PR and between 2818548 and a185873.

📒 Files selected for processing (3)

.github/workflows/integration-tests.yml
.github/workflows/pre-commit.yaml
.github/workflows/unit-tests.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The workflows now trigger on merge_group events. Integration and unit tests apply path filtering with full history. Pre-commit Gitleaks scans use pull-request or merge-group revisions, while rotation reminders remain pull-request-only.

Changes

Merge queue CI support

Layer / File(s)	Summary
Merge-group path filtering `.github/workflows/integration-tests.yml`, `.github/workflows/unit-tests.yml`	The integration-test and unit-test workflows support `merge_group` events. Their `changes` jobs use full repository history for path filtering and retain pull-request-specific gating.
Merge-group secret-scan revisions `.github/workflows/pre-commit.yaml`	Gitleaks selects revisions from pull-request or merge-group metadata. The rotation reminder runs only after failed pull-request scans.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a1858

This PR updates CI workflows to run required suites for merge-queue commits; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

osac-project/osac#242: Both changes add merge_group support and full-history path filtering to GitHub workflows.
osac-project/osac#330: Both changes modify the same workflow files and event-handling logic.

Suggested reviewers: crystalchun, slintes, eliorerz

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: running PR CI suites on merge_group events.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The PR changes only workflow controls and SHA references. Added lines contain no hardcoded credentials, private keys, credential URLs, or secret-named string assignments; the checkout SHA already e...
No-Weak-Crypto	✅ Passed	The PR changes only three GitHub workflow files; added lines contain no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison logic.
No-Injection-Vectors	✅ Passed	The diff only changes GitHub workflow triggers, path filtering, and quoted SHA arguments; it adds no SQL concatenation, shell=True, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerou...
Container-Privileges	✅ Passed	The PR diff only updates three GitHub Actions workflows; it adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root container/Kubernetes settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds triggers, path filtering, checkout, and SHA fallbacks only. It adds no sensitive logging; existing hostname echoes are unchanged, and gitleaks retains --redact.
Ai-Attribution	✅ Passed	The authored PR description and HEAD commit do not mention an AI tool; HEAD has no attribution trailers, so the conditional attribution check is not applicable.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-08-20T13:47:23Z

🤖 Finished Review · ✅ Success · Started 1:47 PM UTC · Completed 1:59 PM UTC

Commit: a185873 · View workflow run →

fullsend-ai-review · 2026-08-20T13:59:48Z

Review

Findings

High

[protected-path] .github/workflows/integration-tests.yml, .github/workflows/pre-commit.yaml, .github/workflows/unit-tests.yml — All three modified files reside under .github/, which is a protected governance path. The PR has no linked issue (uses the NO-ISSUE: prefix), providing insufficient traceability for changes to governance and infrastructure files. Human approval is required for protected-path changes regardless of the change's technical merit.
Remediation: Link to an authorizing issue or obtain explicit human maintainer approval for these workflow changes.

Labels: PR modifies GitHub Actions workflow files under .github/workflows/

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review

See the review comment for full details.

Auto-dismissed: only Prow labels gate merging

minmzzhang · 2026-08-21T13:11:57Z

/retest

github-actions · 2026-08-21T13:12:16Z

Re-triggered failed runs:

label-gate (#32377484702)
label-gate (#32376164066)
label-gate (#32376160612)
label-gate (#32376157382)
E2E BMaaS Full Install (#32376157788)

openshift-ci · 2026-08-26T12:40:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz, minmzzhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [eliorerz,minmzzhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

NO-ISSUE: run PR CI suites on merge_group

a185873

Merge queue waits for checks on the speculative SHA. Without a merge_group trigger those jobs never report, so GitHub kicks the PR (checks_timed_out).

openshift-ci-robot added the jira/valid-reference label Aug 20, 2026

openshift-ci Bot requested review from CrystalChun and slintes August 20, 2026 13:46

openshift-ci Bot added the approved label Aug 20, 2026

minmzzhang had a problem deploying to e2e-test August 20, 2026 13:46 — with GitHub Actions Failure

minmzzhang temporarily deployed to e2e-test August 20, 2026 13:46 — with GitHub Actions Inactive

omer-vishlitzky enabled auto-merge August 20, 2026 13:46

minmzzhang temporarily deployed to e2e-test August 20, 2026 13:46 — with GitHub Actions Inactive

coderabbitai Bot approved these changes Aug 20, 2026

View reviewed changes

fullsend-ai-review Bot previously requested changes Aug 20, 2026

View reviewed changes

fullsend-ai-review Bot added the github_actions Pull requests that update GitHub Actions code label Aug 20, 2026

minmzzhang temporarily deployed to e2e-test August 21, 2026 13:12 — with GitHub Actions Inactive

eliorerz approved these changes Aug 26, 2026

View reviewed changes

openshift-ci Bot assigned eliorerz Aug 26, 2026

openshift-ci Bot added the lgtm label Aug 26, 2026

omer-vishlitzky added this pull request to the merge queue Aug 26, 2026

minmzzhang mentioned this pull request Aug 26, 2026

NO-ISSUE: report generated-code on merge_group #536

Merged

5 tasks

Merged via the queue into osac-project:main with commit d913486 Aug 26, 2026
124 of 134 checks passed

minmzzhang deleted the ci/mq-run-pr-ci branch August 26, 2026 18:58

eliorerz mentioned this pull request Aug 26, 2026

NO-ISSUE: Stop running full unit/integration test matrices on merge_group #544

Closed

5 tasks

eliorerz mentioned this pull request Aug 26, 2026

NO-ISSUE: Cancel stale merge-queue reruns on unit-tests/integration-tests/pre-commit #550

Open

4 tasks

Navigation Menu

Uh oh!

NO-ISSUE: run PR CI suites on merge_group - #418

NO-ISSUE: run PR CI suites on merge_group#418
omer-vishlitzky merged 1 commit into
osac-project:mainfrom
minmzzhang:ci/mq-run-pr-ci

minmzzhang commented Aug 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci-robot commented Aug 20, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026

Uh oh!

fullsend-ai-review Bot left a comment

Uh oh!

minmzzhang commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

minmzzhang commented Aug 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Aug 20, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Aug 20, 2026

Review

Findings

High

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

minmzzhang commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

minmzzhang commented Aug 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 20, 2026 •

edited

Loading