NO-JIRA: fix(ci): harden Claude WIF test workflow

[cblecker]

Summary

• Fix operator precedence bug in the job's if condition — && binds tighter than || in GitHub Actions expressions, so the original condition allowed any OWNER comment on any issue (not just PRs with /test-wif) to trigger the workflow with GCP credentials. Added parentheses to properly scope the author association check.
• Replace curl | bash installation with the official anthropics/claude-code-action GitHub Action (pinned by SHA), which handles Claude Code installation internally and is tracked by dependabot via the existing github-actions ecosystem config. This eliminates unverified code execution on a runner holding a GCP WIF token.
• Add COLLABORATOR to the allowed author associations for the /test-wif trigger.

Test plan

• Trigger the workflow via workflow_dispatch to verify the basic auth flow works
• Test /test-wif on a PR comment to verify issue_comment handling with claude-code-action
• Verify the if condition correctly rejects: non-PR issue comments, comments without /test-wif, and comments from external contributors

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow configuration for internal testing processes.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@cblecker: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Fix operator precedence bug in the job's if condition — && binds tighter than || in GitHub Actions expressions, so the original condition allowed any OWNER comment on any issue (not just PRs with /test-wif) to trigger the workflow with GCP credentials. Added parentheses to properly scope the author association check.
• Replace curl | bash installation with the official anthropics/claude-code-action GitHub Action (pinned by SHA), which handles Claude Code installation internally and is tracked by dependabot via the existing github-actions ecosystem config. This eliminates unverified code execution on a runner holding a GCP WIF token.
• Add COLLABORATOR to the allowed author associations for the /test-wif trigger.

Test plan

• Trigger the workflow via workflow_dispatch to verify the basic auth flow works
• Test /test-wif on a PR comment to verify issue_comment handling with claude-code-action
• Verify the if condition correctly rejects: non-PR issue comments, comments without /test-wif, and comments from external contributors

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7c15d019-8370-472d-bb24-5877bc73d32e

📥 Commits

Reviewing files that changed from the base of the PR and between 09c7701 and 8b393d9.

📒 Files selected for processing (1)

• .github/workflows/claude-wif-test.yaml

---

📝 Walkthrough

Walkthrough

This PR updates the GitHub Actions workflow .github/workflows/claude-wif-test.yaml with two key changes. First, the job's trigger condition now permits issue comment authors with the COLLABORATOR association to initiate the workflow, expanding access beyond the existing allowed associations. Second, the Claude Code execution approach is restructured: the workflow removes steps that manually fetched the PR ref, checked out code, installed the claude CLI, and invoked it via shell; these are replaced by a single anthropics/claude-code-action step preconfigured for Vertex AI testing. The new action passes the prompt and --max-turns 1 argument with required Vertex project/region environment variables. The existing GCP Workload Identity Federation authentication remains in place with the same action pin, project, and service account settings.

Possibly related PRs

• openshift/hypershift#8598: Both PRs modify the same .github/workflows/claude-wif-test.yaml workflow—specifically around PR metadata preparation and Claude Code install/execution in the test-wif job—though the main PR swaps to anthropics/claude-code-action while #8598 adjusts runner-compatible install and ref lookup.
• openshift/hypershift#8588: Both PRs modify .github/workflows/claude-wif-test.yaml to run Claude Code against Vertex using GCP Workload Identity Federation, with the main PR further refining the workflow trigger and execution step for WIF testing.

Suggested reviewers

• muraee
• Nirshal

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main objective: hardening a Claude WIF test workflow by fixing operator precedence, replacing unsafe curl|bash installation with an official GitHub Action, and adding COLLABORATOR access.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies GitHub Actions workflow file (.github/workflows/claude-wif-test.yaml), not Ginkgo tests. No Ginkgo test names are affected.
Test Structure And Quality	✅ Passed	Custom check for Ginkgo test quality is not applicable; PR modifies GitHub Actions workflow YAML (.github/workflows/claude-wif-test.yaml), not Go test code.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only a GitHub Actions workflow file (.github/workflows/claude-wif-test.yaml), not K8s manifests, operator code, or controllers. No scheduling constraints introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies only GitHub Actions workflow configuration; no new Ginkgo e2e tests are added, making this IPv6/disconnected network compatibility check not applicable.
No-Weak-Crypto	✅ Passed	No weak crypto algorithms, custom implementations, or insecure comparisons found in the workflow YAML file changed by this PR.
Container-Privileges	✅ Passed	PR modifies only GitHub Actions workflow file (.github/workflows/claude-wif-test.yaml), not container/K8s manifests. Check is not applicable to this PR context.
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements found that expose sensitive data. Environment variables contain only public configuration values; credentials handled securely by official GitHub Actions.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

Please specify an area label

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cblecker

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cblecker]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/test-wif

[bryan-cox]

/test-wif

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hypershift-jira-solve-ci]

I now have the complete root cause. Here is the analysis:

Test Failure Analysis Complete

Job Information

• Prow Job: tide
• Build ID: N/A (tide is a merge controller, not a test job)
• PR: #8606 — NO-JIRA: fix(ci): harden Claude WIF test workflow
• Branch: fix/harden-claude-wif-test
• State: ERROR

Test Failure Analysis

Error

tide: Not mergeable. PR has a merge conflict.

Summary

This is not a test failure — it is a merge conflict preventing tide (the Prow merge controller) from merging the PR. PR #8606 modifies .github/workflows/claude-wif-test.yaml, but two other PRs (#8609 and #8611) by bryan-cox were created after #8606 and merged into main first, both modifying the same file in overlapping regions. The main branch now contains changes (container image setup, curl | bash reinstated, ai-helpers plugin setup steps) that directly conflict with #8606's approach (which replaced curl | bash with anthropics/claude-code-action). The PR's if condition fix for operator precedence and COLLABORATOR addition were already independently incorporated by PR #8609, making parts of #8606 redundant.

Root Cause

The tide ERROR state is caused by a git merge conflict on the sole file changed by this PR: .github/workflows/claude-wif-test.yaml.

Timeline of events:

1. 2026-05-27T17:34Z — PR NO-JIRA: fix(ci): harden Claude WIF test workflow #8606 created by cblecker, based on the old version of claude-wif-test.yaml (commit fd7571d). It makes three changes: fixes the if condition operator precedence, adds COLLABORATOR, and replaces curl | bash + manual steps with anthropics/claude-code-action.
2. 2026-05-27T19:12Z — PR NO-JIRA: use ai-helpers container image for Claude WIF test #8609 by bryan-cox merges into main. It independently makes the same if condition fix (operator precedence + COLLABORATOR), removes curl | bash install, adds a container image, and changes the test prompt.
3. 2026-05-27T20:19Z — PR NO-JIRA: replace container image with workflow-step plugin setup #8611 by bryan-cox merges into main. It reverts the container image from NO-JIRA: use ai-helpers container image for Claude WIF test #8609, restores curl | bash install, and adds ai-helpers plugin setup steps.

After #8609 and #8611 merged, main has a substantially different version of the file than what #8606's branch was based on. The conflict regions include:

• Steps section (lines 25–60): NO-JIRA: fix(ci): harden Claude WIF test workflow #8606 removed checkout/PR-ref/install steps and replaced with claude-code-action; main now has checkout + install + ai-helpers plugin setup.
• Env/run block: NO-JIRA: fix(ci): harden Claude WIF test workflow #8606 uses action with: parameters; main uses env: + run: blocks.

The PR is 4 commits behind main and 1 commit ahead, and GitHub reports mergeable: false, mergeable_state: "dirty". The needs-rebase label was automatically applied by the OpenShift CI bot.

Notably, the operator precedence fix and COLLABORATOR addition from #8606 are already on main (landed via #8609), so only the claude-code-action migration aspect of this PR remains novel.

Recommendations

1. Rebase the branch onto current main to resolve the merge conflict. The if condition changes are already on main, so the rebase should focus on deciding whether to keep the current curl | bash + ai-helpers plugin approach (from NO-JIRA: replace container image with workflow-step plugin setup #8611) or switch to anthropics/claude-code-action (from NO-JIRA: fix(ci): harden Claude WIF test workflow #8606).

2. Evaluate if the PR is still needed: The operator precedence fix and COLLABORATOR addition already shipped in NO-JIRA: use ai-helpers container image for Claude WIF test #8609. The remaining unique change is replacing curl | bash with claude-code-action. Decide whether this migration is still desired given that NO-JIRA: replace container image with workflow-step plugin setup #8611 intentionally added plugin setup steps that claude-code-action may not support.

3. If rebasing: Resolve the steps section conflict by choosing one approach — either the claude-code-action GitHub Action (cleaner, but may not support the ai-helpers plugin setup added in NO-JIRA: replace container image with workflow-step plugin setup #8611) or the current manual install (supports plugins, but uses curl | bash).

4. Consider closing the PR if the remaining changes are no longer desired, since the critical security fix (operator precedence) is already merged.

Evidence

Evidence	Detail
Tide status	state: "error", description: "Not mergeable. PR has a merge conflict."
GitHub merge state	mergeable: false, mergeable_state: "dirty", rebaseable: false
PR labels	needs-rebase, do-not-merge/work-in-progress, do-not-merge/needs-area
Conflicting file	.github/workflows/claude-wif-test.yaml (sole file in PR)
PR #8609 (merged)	NO-JIRA: use ai-helpers container image for Claude WIF test — merged 2026-05-27T19:12Z, independently fixed same if condition
PR #8611 (merged)	NO-JIRA: replace container image with workflow-step plugin setup — merged 2026-05-27T20:19Z, further modified same file
Divergence	PR branch is 4 commits behind main, 1 ahead; main has 14 line changes in the conflicting file
OpenShift CI bot	Posted "PR needs rebase." at 2026-05-28T08:53:23Z

---

[bryan-cox]

/close

This job is getting removed

[openshift-ci]

@bryan-cox: Closed this PR.

Details

In response to this:

/close

This job is getting removed

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.