Skip to content

Skill to make it easier to create Prow-based agents - #532

Closed
stbenjam wants to merge 9 commits into
openshift-eng:mainfrom
stbenjam:create-prow-agent-skill
Closed

stbenjam wants to merge 9 commits into
openshift-eng:mainfrom
stbenjam:create-prow-agent-skill

Conversation

@stbenjam

@stbenjam stbenjam commented Jun 5, 2026

Copy link
Copy Markdown
Member

Interactive guide that walks developers through building a new Prow-based
AI agent: brainstorming the design, then generating step registry refs,
commands scripts, and ci-operator configs with a prerequisites checklist
for credentials to fill in while the openshift/release PR is in review.

image

Summary by CodeRabbit

Release Notes

  • New Features

    • Added a new “create-prow-agent” CI skill and surfaced it in the CI plugin’s available skills list for building Prow-based autonomous AI agents for OpenShift CI.
  • Documentation

    • Added an in-depth skill guide covering end-to-end agent design, CI workflow generation, credential/data source setup, and evaluation strategy examples (including prompt-based test cases and templates).

@openshift-ci
openshift-ci Bot requested review from mrunalp and theobarberbany June 5, 2026 20:31
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 5, 2026
@coderabbitai

coderabbitai Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

A new create-prow-agent skill is added to the ci plugin. The change consists of a 642-line SKILL.md providing a two-phase guide for designing and generating Prow-based AI agent artifacts for OpenShift CI, a corresponding manifest entry in docs/index.html, and a .gitattributes rule marking that HTML file as linguist-generated.

Changes

create-prow-agent skill addition

Layer / File(s) Summary
Skill metadata registration
plugins/ci/skills/create-prow-agent/SKILL.md, docs/index.html, .gitattributes
Defines the skill frontmatter (name, description, user_invocable), inserts the create-prow-agent object into the DATA.plugins manifest, and marks docs/index.html as linguist-generated.
Skill introduction and prerequisites check
plugins/ci/skills/create-prow-agent/SKILL.md
Documents the skill's purpose and existing agent background, defines when-to-use criteria, and specifies the prerequisites workflow (Chai Bot MCP availability, openshift/release clone verification, gh CLI auth).
Phase 1: interactive agent design
plugins/ci/skills/create-prow-agent/SKILL.md
Covers problem definition, trigger type selection with Gangway ad-hoc override behavior, data sources/actions inventory with credentials table, ai-helpers skill audit, multi-phase pipeline design summary, and evals design (smoke/golden-path/guardrail plus promptfoo harness) with a confirmation gate before Phase 2.
Phase 2: step-registry artifact generation
plugins/ci/skills/create-prow-agent/SKILL.md
Guides exploration of existing agent patterns, establishes branch naming and step-registry directory conventions, and specifies generation of workflow YAML, setup step ref YAML and commands, process step ref YAML and script structure (Gangway override mapping, state files, GitHub App JWT/token generation, Jira/Slack credential loading, Claude invocation, token/cost extraction, per-item loop, rate limiting), and an optional HTML report step.
CI-operator job templates, evals, checklists, and notes
plugins/ci/skills/create-prow-agent/SKILL.md
Provides CI-operator job configuration templates for periodic, presubmit, and Gangway ad-hoc triggers; a promptfooconfig.yaml eval harness template; optional CLAUDE.md guidance; a prerequisites checklist (Vertex AI, GitHub App, Jira, Slack, vault secret key mapping); PR/review checklist with reminders; and closing notes on the claude-ai-helpers container and internal doc references.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

lgtm

Suggested reviewers

  • theobarberbany
  • mrunalp

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
No Assumed Git Remote Names ❌ Error The SKILL.md document uses gh repo fork openshift/release --clone --remote (line 55) which implicitly assumes "origin" and "upstream" remote names without explicitly documenting this assumption o... Add explicit documentation that gh repo fork --remote creates "origin" and "upstream" remotes, or provide a command like git remote -v to verify remote names after forking.
✅ Passed checks (9 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and directly describes the main change: adding a skill/guide to make creating Prow-based agents easier, which is exactly what the PR delivers.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References ✅ Passed No real people names found used as style references. Document uses only tool names (Claude Code, Chai Bot) and explicit technical descriptions without style comparisons to real people.
Git Push Safety Rules ✅ Passed SKILL.md explicitly requires asking user permission before pushing ("Ask the user for their GitHub fork to push to"), prohibits autonomous pushes, avoids main/master pushes, and contains no force p...
No Untrusted Mcp Servers ✅ Passed No MCP server installations from untrusted sources are introduced. The PR only adds documentation and manifest updates; no new MCP server packages, npm/npx installations, or arbitrary repository re...
Ai-Helpers Overlap Detection ✅ Passed No overlapping functionality detected. New create-prow-agent skill is distinct from existing skills in purpose (create vs analyze) and plugin domain (ci agent creation vs HyperShift/docs/analysis).
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
plugins/ci/skills/create-prow-agent/SKILL.md (1)

1-560: ⚠️ Potential issue | 🟠 Major

Resolve HIGH overlap with PR #532 for create-prow-agent

  • Open PR #532 (“Skill to make it easier to create Prow-based agents”) already modifies plugins/ci/skills/create-prow-agent/SKILL.md, indicating HIGH overlap and likely duplication/conflict—coordinate/merge with that PR or adjust scope to avoid overlapping functionality.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/ci/skills/create-prow-agent/SKILL.md` around lines 1 - 560, The
SKILL.md for the skill named "create-prow-agent" conflicts with an existing PR
`#532` that modifies the same skill; resolve by either coordinating/merging with
PR `#532` or scoping/renaming this skill to avoid duplication: inspect PR `#532`
changes, then either (A) merge your content into the same SKILL.md (preserve
frontmatter name: create-prow-agent, reconcile sections and remove duplicated
material, add a brief note referencing PR `#532` at the top), or (B) change this
skill’s identity (update the frontmatter name and description in SKILL.md to a
unique name, e.g., create-prow-agent-v2 or create-prow-agent-guides, and trim
overlapping sections), and ensure the user-invocable flag and internal
references match the new name so no further conflicts occur.
🧹 Nitpick comments (1)
plugins/ci/skills/create-prow-agent/SKILL.md (1)

152-154: 💤 Low value

Add language specifiers to fenced code blocks.

Several fenced code blocks lack language specifiers. Adding them improves syntax highlighting and markdown tooling support.

Suggested fixes

Line 152-154:

-```
+```text
 1. Gather data → 2. Analyze with Claude → 3. Report results

Line 157-159:
```diff
-```
+```text
 1. Query work items → 2. Solve each item → 3. Code review → 4. Fix review findings → 5. Create PR → 6. Notify

Line 162-164:
```diff
-```
+```text
 1. Poll until data ready → 2. Snapshot data → 3. Analyze → 4. Report → 5. Notify

Line 226-238:
```diff
-```
+```text
 ci-operator/step-registry/{path}/
 ├── {agent-name}-workflow.yaml
 ├── setup/
 │   ├── {agent-name}-setup-ref.yaml
 │   └── {agent-name}-setup-commands.sh
 ├── process/
 │   ├── {agent-name}-process-ref.yaml
 │   └── {agent-name}-process-commands.sh
 └── report/                              (optional)
     ├── {agent-name}-report-ref.yaml
     └── {agent-name}-report-commands.sh

</details>


Also applies to: 157-159, 162-164, 226-238

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @plugins/ci/skills/create-prow-agent/SKILL.md around lines 152 - 154, In
SKILL.md several fenced code blocks (the sequences containing "1. Gather data →
2. Analyze with Claude → 3. Report results", "1. Query work items → 2. Solve
each item → 3. Code review → 4. Fix review findings → 5. Create PR → 6. Notify",
"1. Poll until data ready → 2. Snapshot data → 3. Analyze → 4. Report → 5.
Notify", and the ci-operator tree block starting with
"ci-operator/step-registry/{path}/") are missing language specifiers; update
each opening triple-backtick to include a language (e.g., ```text) so the blocks
become fenced with a language specifier for proper syntax highlighting.


</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @plugins/ci/skills/create-prow-agent/SKILL.md:

  • Around line 1-560: The SKILL.md for the skill named "create-prow-agent"
    conflicts with an existing PR #532 that modifies the same skill; resolve by
    either coordinating/merging with PR #532 or scoping/renaming this skill to avoid
    duplication: inspect PR #532 changes, then either (A) merge your content into
    the same SKILL.md (preserve frontmatter name: create-prow-agent, reconcile
    sections and remove duplicated material, add a brief note referencing PR #532 at
    the top), or (B) change this skill’s identity (update the frontmatter name and
    description in SKILL.md to a unique name, e.g., create-prow-agent-v2 or
    create-prow-agent-guides, and trim overlapping sections), and ensure the
    user-invocable flag and internal references match the new name so no further
    conflicts occur.

Nitpick comments:
In @plugins/ci/skills/create-prow-agent/SKILL.md:

  • Around line 152-154: In SKILL.md several fenced code blocks (the sequences
    containing "1. Gather data → 2. Analyze with Claude → 3. Report results", "1.
    Query work items → 2. Solve each item → 3. Code review → 4. Fix review findings
    → 5. Create PR → 6. Notify", "1. Poll until data ready → 2. Snapshot data → 3.
    Analyze → 4. Report → 5. Notify", and the ci-operator tree block starting with
    "ci-operator/step-registry/{path}/") are missing language specifiers; update
    each opening triple-backtick to include a language (e.g., ```text) so the blocks
    become fenced with a language specifier for proper syntax highlighting.

</details>

---

<details>
<summary>ℹ️ Review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: Path: .coderabbit.yaml

**Review profile**: CHILL

**Plan**: Enterprise

**Run ID**: `a24f1ab2-3fb1-49d3-9914-b92f20f4150d`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 7ce876b9ac4d2068e3e21f33132745feb2cf80e5 and 6bef82cf2d463a7da3fa7a2ae7302d4db7317ea8.

</details>

<details>
<summary>📒 Files selected for processing (5)</summary>

* `.claude-plugin/marketplace.json`
* `.gitattributes`
* `docs/index.html`
* `plugins/ci/.claude-plugin/plugin.json`
* `plugins/ci/skills/create-prow-agent/SKILL.md`

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 10, 2026
1. Poll until data ready → 2. Snapshot data → 3. Analyze → 4. Report → 5. Notify
```

Write a design summary capturing:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We wanna encourage people (especially if they're gonna run these in prow) to have evals thought about at the design stage, and implemented pre merge.


#### Step 2.8: Write Custom Skills (If Needed)

If the design identified gaps in existing ai-helpers skills, help the user write custom skills. Each skill needs:

@theobarberbany theobarberbany Jun 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again on evals here, we may wanna think up some base 'this functions as intended' evals for all prow skills that we ship by default / strongly encourage by default.

@stbenjam

stbenjam commented Jun 11, 2026

Copy link
Copy Markdown
Member Author

Addressed @theobarberbany's feedback:

  • Step 1.6: Design Evals — evals are now a required part of the design phase. Every agent must plan at least smoke, golden-path, and guardrail evals before moving to implementation. Includes a table of domain-specific eval examples.
  • Step 2.9: Implement Evals — new implementation step with a promptfoo config template and a presubmit job config so evals run before merge.

not-stbenjam and others added 7 commits June 11, 2026 17:43
Interactive guide that walks developers through building a new Prow-based
AI agent: brainstorming the design, then generating step registry refs,
commands scripts, and ci-operator configs with a prerequisites checklist
for credentials to fill in while the openshift/release PR is in review.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…attern exploration

- Add prerequisites check: Chai Bot MCP, openshift/release clone, gh CLI
- Explore existing agent patterns in openshift/release before writing files
- Work directly in openshift/release clone instead of temp .work/ directory
- Add references section (Autonomous AI Usage doc, HyperShift docs)
- Update payload agent description (Chai Bot handoff, multi-agent system)
- Fix GitHub App prereqs to mention app configuration and install-id

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Step 1.6 (Design Evals) requiring evals at design time with baseline
  smoke, golden-path, and guardrail evals for every agent
- Add Step 2.9 (Implement Evals) with promptfoo config template and
  presubmit job for running evals before merge
- Add language specifiers to fenced code blocks
- Bump skillsaw from v0.11.4 to v0.13.1 in all GitHub Actions workflows

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The skillsaw version update belongs in PR openshift-eng#534, not here.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@stbenjam
stbenjam force-pushed the create-prow-agent-skill branch from 2f068e6 to c407589 Compare June 11, 2026 21:44
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 11, 2026
@openshift-ci

openshift-ci Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stbenjam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment


Evals must be designed alongside the agent, not added after the fact. Ask the user:

> How will we verify this agent works correctly? Let's define evals now so they ship with the initial PR.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ warning (content-weak-language): Weak language (vagueness): 'correctly' — Remove 'correctly' — describe what correct behavior looks like


1. **Smoke test** — Does the agent start, authenticate, and complete without errors on a trivial input?
2. **Golden-path eval** — Given a known input (e.g., a specific Jira issue, a test PR, a sample payload), does the agent produce the expected output?
3. **Guardrail eval** — Does the agent correctly refuse or skip inputs outside its scope?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ warning (content-weak-language): Weak language (vagueness): 'correctly' — Remove 'correctly' — describe what correct behavior looks like

| Code generation | Generated code compiles, passes lint, tests pass |
| Triage/analysis | Output matches human-labeled ground truth on N sample inputs |
| PR creation | PR has correct base branch, labels, description format |
| Jira updates | Fields set correctly, no duplicate comments |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ warning (content-weak-language): Weak language (vagueness): 'correctly' — Remove 'correctly' — describe what correct behavior looks like

@stbenjam

Copy link
Copy Markdown
Member Author

Lol Claude made a mess of this branch lol, will fix on Monday.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)
plugins/ci/skills/create-prow-agent/SKILL.md (3)

612-626: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Require explicit user permission before opening a PR.

Line 614 calls gh pr create without asking the user for permission first. Per coding guidelines, commands and skills must never push without explicit user permission — always ask the user before pushing.

Revise Step 2.12 to prompt the user for approval before executing gh pr create. Example: "Ready to open a PR to openshift/release? Shall I create it?"

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/ci/skills/create-prow-agent/SKILL.md` around lines 612 - 626, Step
2.12 currently calls `gh pr create` without explicit user approval; update the
SKILL.md step (the "Review and Open PR" section / Step 2.12) to insert an
explicit user prompt before executing the `gh pr create` command (e.g., "Ready
to open a PR to `openshift/release`? Shall I create it?") and only proceed to
run the `gh pr create` invocation after the user responds affirmatively; ensure
the prompt stores the user's consent, do not auto-run or auto-merge, and
reaffirm the agent will restrict `--allowedTools`, set `--max-turns` and step
timeouts before creating the PR.

Source: Coding guidelines


226-244: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Discover git remotes before checking out branches.

Lines 226–244 instruct the user to clone and check out a branch, but do not verify available remotes. Per coding guidelines, code should never assume git remote names ('origin', 'upstream') without first discovering them via git remote -v or git branch -vv.

Insert a git remote -v call after cloning to confirm the remote configuration, and if needed, help the user configure the correct push remote for the feature branch.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/ci/skills/create-prow-agent/SKILL.md` around lines 226 - 244, The
instructions assume remote names without verifying them; after cloning the
release repo, run git remote -v to discover configured remotes before creating
the feature branch add-{agent-name}, and if the desired push remote is missing
or different, configure it and set the branch's upstream (so the subsequent git
checkout -b add-{agent-name} and push target are correct). Use the discovered
remote name when configuring the push upstream for the add-{agent-name} branch
to avoid assuming origin/upstream.

Source: Coding guidelines


55-55: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use git remote -v to discover remotes before constructing fork/push commands.

Line 55 uses gh repo fork openshift/release --clone --remote without first discovering available remotes. Per coding guidelines, code must not assume git remote names like 'origin' or 'upstream'; use git remote -v or git branch -vv to discover actual remotes before constructing any git commands.

Suggested fix: Add a discovery step before forking, or ensure the user is prompted to select the target remote configuration.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/ci/skills/create-prow-agent/SKILL.md` at line 55, The guidance text
currently runs the literal command "gh repo fork openshift/release --clone
--remote" without discovering existing git remotes; update SKILL.md to add a
discovery step that runs "git remote -v" (or "git branch -vv") first, parse or
display the results, prompt the user to choose which remote name to use (or
document how to map remotes), and then construct the fork/push command using the
selected remote name instead of assuming a default; reference the existing
command string "gh repo fork openshift/release --clone --remote" when replacing
it so the doc shows the new flow (discover remotes → select remote → run gh repo
fork with the chosen remote).

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/lint-plugins.yml:
- Around line 20-23: CI workflows use skillsaw 0.13.1 but local config pins
0.11.4; update the local pins to match CI by changing the .skillsaw.yaml version
value to "0.13.1" and updating the Makefile SKILLSAW_IMAGE variable to
ghcr.io/stbenjam/skillsaw:0.13.1 (ensure any other occurrences of '0.11.4' are
replaced), so all uses: stbenjam/skillsaw@... and version: '...' entries are
consistent at 0.13.1 across configs.

---

Outside diff comments:
In `@plugins/ci/skills/create-prow-agent/SKILL.md`:
- Around line 612-626: Step 2.12 currently calls `gh pr create` without explicit
user approval; update the SKILL.md step (the "Review and Open PR" section / Step
2.12) to insert an explicit user prompt before executing the `gh pr create`
command (e.g., "Ready to open a PR to `openshift/release`? Shall I create it?")
and only proceed to run the `gh pr create` invocation after the user responds
affirmatively; ensure the prompt stores the user's consent, do not auto-run or
auto-merge, and reaffirm the agent will restrict `--allowedTools`, set
`--max-turns` and step timeouts before creating the PR.
- Around line 226-244: The instructions assume remote names without verifying
them; after cloning the release repo, run git remote -v to discover configured
remotes before creating the feature branch add-{agent-name}, and if the desired
push remote is missing or different, configure it and set the branch's upstream
(so the subsequent git checkout -b add-{agent-name} and push target are
correct). Use the discovered remote name when configuring the push upstream for
the add-{agent-name} branch to avoid assuming origin/upstream.
- Line 55: The guidance text currently runs the literal command "gh repo fork
openshift/release --clone --remote" without discovering existing git remotes;
update SKILL.md to add a discovery step that runs "git remote -v" (or "git
branch -vv") first, parse or display the results, prompt the user to choose
which remote name to use (or document how to map remotes), and then construct
the fork/push command using the selected remote name instead of assuming a
default; reference the existing command string "gh repo fork openshift/release
--clone --remote" when replacing it so the doc shows the new flow (discover
remotes → select remote → run gh repo fork with the chosen remote).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6bb1b5b5-b2d2-48d6-bdb0-47172506258f

📥 Commits

Reviewing files that changed from the base of the PR and between 6bef82c and 2f068e6.

📒 Files selected for processing (4)
  • .github/workflows/lint-plugins.yml
  • .github/workflows/lint-review.yml
  • .github/workflows/update-docs.yml
  • plugins/ci/skills/create-prow-agent/SKILL.md
✅ Files skipped from review due to trivial changes (1)
  • .github/workflows/lint-review.yml

Comment thread .github/workflows/lint-plugins.yml Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@plugins/ci/skills/create-prow-agent/SKILL.md`:
- Around line 412-439: The loop reads into variable item but later uses
uninitialized ITEM_ID and STATUS (and writes to
"${SHARED_DIR}/claude-${ITEM_ID}-tokens.json" and appends to "$STATE_FILE"),
which breaks under set -u; fix by parsing item at loop start (e.g., split item
into ITEM_ID and STATUS or assign ITEM_ID=item and set a default STATUS) so the
rest of the body consistently references the initialized variables (ITEM_ID,
STATUS, SHARED_DIR, STATE_FILE) before they are used; ensure any variables
referenced in the grep/jq output path and the echo state line are defined for
every iteration.
- Around line 584-589: Update the checklist to stop instructing users to store a
generated/installation token in the vault and instead only persist the GitHub
App's private-key and installation-id; remove the bullet that says "Store the
app's `private-key` and `installation-id` (one per org) in your vault secret,
along with a generated token for authentication" and replace it with guidance to
persist only `private-key` and `installation-id` and to mint installation tokens
at runtime (use the existing "commands script generates JWT tokens at runtime
using RS256 signing" behavior) so short-lived installation tokens are not
persisted.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7f2e8889-2d27-4010-a64b-a90c9f6bd8e1

📥 Commits

Reviewing files that changed from the base of the PR and between 2f068e6 and c407589.

📒 Files selected for processing (5)
  • .claude-plugin/marketplace.json
  • .gitattributes
  • docs/index.html
  • plugins/ci/.claude-plugin/plugin.json
  • plugins/ci/skills/create-prow-agent/SKILL.md
✅ Files skipped from review due to trivial changes (4)
  • .gitattributes
  • plugins/ci/.claude-plugin/plugin.json
  • .claude-plugin/marketplace.json
  • docs/index.html

Comment thread plugins/ci/skills/create-prow-agent/SKILL.md
Comment thread plugins/ci/skills/create-prow-agent/SKILL.md
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 17, 2026
…kill

# Conflicts:
#	.claude-plugin/marketplace.json
#	docs/index.html
#	plugins/ci/.claude-plugin/plugin.json
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 23, 2026
- Replace 'correctly' with specific descriptions (lines 179, 185, 194)
- Initialize ITEM_ID and STATUS from loop variable before use
- Clarify that only private-key and installation-id should be stored
  in vault, not short-lived generated tokens

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
plugins/ci/skills/create-prow-agent/SKILL.md (1)

35-41: 📐 Maintainability & Code Quality | 🔴 Critical

Remove undocumented Chai Bot MCP server reference or document it as officially approved.

The recommendation to enable "Chai Bot MCP server" (lines 35-41) references an external Slack app without documenting it as an officially approved/trusted tool. This violates the requirement that MCP server installations must come from trusted sources with justification and security review. Either remove this recommendation, replace it with a documented and approved alternative, or add explicit approval documentation to the repository establishing Chai Bot as an official OpenShift internal tool.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/ci/skills/create-prow-agent/SKILL.md` around lines 35 - 41, Remove
the entire "Chai Bot MCP" section (from the heading through the recommendation
block about enabling the Chai Bot MCP server in the Home Page of Slack) unless
you have official approval documentation. If Chai Bot is intended to remain as a
recommended tool, you must add explicit documentation to the repository
establishing it as an officially approved OpenShift internal tool with security
review justification, then update the recommendation to reference that approval
documentation. The current reference to an external Slack app without documented
approval violates MCP server installation requirements.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@plugins/ci/skills/create-prow-agent/SKILL.md`:
- Around line 35-41: Remove the entire "Chai Bot MCP" section (from the heading
through the recommendation block about enabling the Chai Bot MCP server in the
Home Page of Slack) unless you have official approval documentation. If Chai Bot
is intended to remain as a recommended tool, you must add explicit documentation
to the repository establishing it as an officially approved OpenShift internal
tool with security review justification, then update the recommendation to
reference that approval documentation. The current reference to an external
Slack app without documented approval violates MCP server installation
requirements.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: abe89520-3251-43cf-b47c-852b88191e88

📥 Commits

Reviewing files that changed from the base of the PR and between b9a2846 and c11da0f.

📒 Files selected for processing (1)
  • plugins/ci/skills/create-prow-agent/SKILL.md


2. **HyperShift Jira Agent** ([`hypershift/jira-agent/`](https://github.com/openshift/release/tree/main/ci-operator/step-registry/hypershift/jira-agent)) — Runs on a cron schedule. Queries Jira for issues labeled `issue-for-agent`, processes each through a four-phase pipeline (solve → code review → fix → PR creation), tracks state via Jira labels, and uses GitHub App tokens with separate fork/upstream installations.

3. **HyperShift Review Agent** ([`hypershift/review-agent/`](https://github.com/openshift/release/tree/main/ci-operator/step-registry/hypershift/review-agent)) — Runs periodically on weekdays. Finds agent-created PRs with unresolved review threads, rebases stale branches, addresses reviewer feedback via Claude, and fixes failing CI checks. Uses a comment analyzer to prevent duplicate bot responses.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

address review runs only on presubmits atm
hypershift also runs ready-to-solve atm
#618
openshift/release#81553
openshift/release#81820


#### Chai Bot MCP

Check if the Chai Bot MCP server is available. If not, strongly recommend it:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this mcp come as dep of this plugin?

> To enable it, go to the **Home Page** of the Chai Bot app in Slack — it will give you a copy-paste command to configure the MCP server.

#### openshift/release Clone

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does it make sense for any of this bash scripting to be injected as dynamic context https://code.claude.com/docs/en/skills#inject-dynamic-context?


- `/jira:solve` — Analyze a Jira issue and create a PR to solve it
- `/code-review:pre-commit-review` — Review code changes before committing
- `/utils:address-reviews` — Address reviewer feedback on a PR

@enxebre enxebre Jul 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this one needs updating, might want to also point to openshift-developer plugin?


**Multi-phase (code changes):**
```text
1. Query work items → 2. Solve each item → 3. Code review → 4. Fix review findings → 5. Create PR → 6. Notify

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fwiw I would want the solve pipeline to explore running in a single claude session that enforce this steps as impl details via workflows, subagents... to alleviate the friction that running multiple sessions introduce for infra and higher level tooling for things like evals, otel

| PR creation | PR has correct base branch, labels, description format |
| Jira updates | Fields match expected values, no duplicate comments |

Use [promptfoo](https://www.promptfoo.dev/) for eval harness. Define eval cases in a `promptfooconfig.yaml` alongside the agent's step registry files. The eval suite should run in a presubmit job against the agent's own PR so regressions are caught before merge.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we please point to eval-harness instead, and all the examples we have in this repo and o/release for running them

Before writing any files, explore the `openshift/release` clone to understand current patterns for AI-based agents. Read the step registry refs, commands scripts, and workflow YAMLs of existing agents:

```bash
# Find all AI agent step registry entries

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would we want to have all generic steps in a common step-registry/asdlc
This made some steps in that direction openshift/release#80927


The step registry path determines the job's identity. Convention: `{team-or-component}/{agent-name}/`. For example:

- `hypershift/jira-agent/`

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To remove friction and facilitate experimentation with the solve pipeline and learn what it takes to share an agent across more than one team I would want to have something like openshift/claude/solve instead of hypershift/jira-agent/, and then opt in is just add a label to your jira ticket
Main barrier for that is gh creds I think.

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 21, 2026
@openshift-ci

openshift-ci Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@stbenjam

Copy link
Copy Markdown
Member Author

No plans to keep working on this, but it could be a foundation if someone else wants to pick it up. I think Alberto's done a good job about making it easy to onboard a Jira solve agent, which is people's primary use case.

@stbenjam stbenjam closed this Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants