review-agent: switch hypershift workflow from GitHub App to PAT auth - #83182
review-agent: switch hypershift workflow from GitHub App to PAT auth#83182bryan-cox wants to merge 4 commits into
Conversation
The GitHub App token exchange in the trigger step was failing (exit code 6), causing the presubmit to report failure even though the periodic review agent job succeeded. Switch to PAT auth via jira-solve-bot, matching the pattern already used by the installer review-agent workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WalkthroughThe HyperShift review-agent now uses a configurable GitHub PAT instead of GitHub App credentials. The workflow uses automatic forking through ChangesHyperShift review-agent PAT flow
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Remove before merge. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh (1)
92-93: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDocument the tracing-disabled scope.
Add a comment immediately before
set +x. State that tracing is disabled while the script reads and sends the PAT.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh` around lines 92 - 93, Add a concise comment immediately before set +x in the tracing setup, documenting that command tracing is disabled while the script reads and sends the PAT; leave the existing _was_tracing handling unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh`:
- Around line 90-107: Update the PAT handling around PAT_FILE to read its
contents with shell tracing disabled, then only execute the comment-posting curl
flow when the resulting GITHUB_TOKEN_PAT is non-empty. Treat an empty PAT file
as unavailable while preserving the existing COMMENT_BODY selection and curl
request for valid credentials.
- Around line 6-12: Update the PR_NUMBER initialization in the trigger script to
use the PULL_NUMBER environment variable instead of the hardcoded value, and
restore the required-value validation that emits an error and exits when
PULL_NUMBER is unset. Remove the temporary commented-out implementation so each
presubmit targets its own pull request.
---
Nitpick comments:
In
`@ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh`:
- Around line 92-93: Add a concise comment immediately before set +x in the
tracing setup, documenting that command tracing is disabled while the script
reads and sends the PAT; leave the existing _was_tracing handling unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7580870f-78af-430b-8923-54533bf7abe8
📒 Files selected for processing (3)
ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yamlci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.shci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-ref.yaml
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0c015f5 to
e870b89
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/pj-rehearse pull-ci-openshift-hypershift-main-address-review-comments |
|
@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh (1)
91-91: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExplain why tracing is disabled.
At Line 91, add a comment before
set +xstating that tracing is disabled before reading and usingGITHUB_TOKEN_PAT. The scope correctly remains disabled through the authenticated request at Line 102.Proposed comment
[[ $- == *x* ]] && _was_tracing=true || _was_tracing=false + # Disable tracing before reading and using the PAT. set +xAs per coding guidelines, step-registry command scripts must keep the tracing-disabled scope minimal and add clear comments when disabling tracing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh` at line 91, Add a concise comment immediately before `set +x` explaining that tracing is disabled before reading and using `GITHUB_TOKEN_PAT`; keep tracing disabled through the authenticated request and do not change the existing scope.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh`:
- Line 91: Add a concise comment immediately before `set +x` explaining that
tracing is disabled before reading and using `GITHUB_TOKEN_PAT`; keep tracing
disabled through the authenticated request and do not change the existing scope.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 19323fcf-3f07-4c96-9633-305cd4e6760a
📒 Files selected for processing (2)
ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yamlci-operator/step-registry/hypershift/review-agent/trigger/hypershift-review-agent-trigger-commands.sh
💤 Files with no reviewable changes (1)
- ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse ack VerificationRehearsed the trigger step with PAT auth — it works end to end:
Dropping the hardcoded test PR now. |
|
@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
1 participant
Summary
jira-solve-botaccountjira-agent-github-app-authpre step (App-only) from the workflowTest plan
address-review-commentspresubmit on a HyperShift PR🤖 Generated with Claude Code
Summary by CodeRabbit
The HyperShift review-agent workflow now uses a
jira-solve-botGitHub PAT instead of GitHub App authentication. It removes JWT token generation and the GitHub App authentication step.The trigger reads the PAT from the credential key configured by
REVIEW_AGENT_PAT_KEY. If the PAT exists and is non-empty, the trigger posts the Gangway job result to the pull request. The workflow no longer uses a hardcoded test pull request.