Skip to content

CNTRLPLANE-3642: ci: add top-level directory drift detection - #8773

Closed
mgencur wants to merge 1 commit into
openshift:mainfrom
mgencur:CNTRLPLANE-3642_skip_e2e_for_unittests_gh_action
Closed

CNTRLPLANE-3642: ci: add top-level directory drift detection#8773
mgencur wants to merge 1 commit into
openshift:mainfrom
mgencur:CNTRLPLANE-3642_skip_e2e_for_unittests_gh_action

Conversation

@mgencur

@mgencur mgencur commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

Add a verification script and tracked directory list that ensures the CI skip pattern (pipeline_skip_if_only_changed) stays in sync when new top-level directories are added to the repo. The check runs as part of make verify-parallel.

  • hack/ci/toplevel-dirs.txt: canonical list of top-level dirs
  • hack/ci/verify-toplevel-dirs.sh: diffs actual vs tracked dirs
  • Makefile: wire verify-toplevel-dirs into verify-parallel

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-3642

Special notes for your reviewer:

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Summary by CodeRabbit

  • Chores
    • Added CI validation check to ensure the top-level directory list stays synchronized with the actual repository structure, preventing manual tracking inconsistencies.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 18, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 18, 2026

Copy link
Copy Markdown

@mgencur: This pull request references CNTRLPLANE-3642 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Add a verification script and tracked directory list that ensures the CI skip pattern (pipeline_skip_if_only_changed) stays in sync when new top-level directories are added to the repo. The check runs as part of make verify-parallel.

  • hack/ci/toplevel-dirs.txt: canonical list of top-level dirs
  • hack/ci/verify-toplevel-dirs.sh: diffs actual vs tracked dirs
  • Makefile: wire verify-toplevel-dirs into verify-parallel

Which issue(s) this PR fixes:

Fixes https://redhat.atlassian.net/browse/CNTRLPLANE-3642

Special notes for your reviewer:

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 92a462e2-c3b7-40e6-8806-104e3d0120f3

📥 Commits

Reviewing files that changed from the base of the PR and between e4a1ba2 and 8b94ccf.

📒 Files selected for processing (3)
  • Makefile
  • hack/ci/toplevel-dirs.txt
  • hack/ci/verify-toplevel-dirs.sh

📝 Walkthrough

Walkthrough

A new CI verification mechanism is added to enforce that hack/ci/toplevel-dirs.txt stays in sync with the repository's actual Git-tracked top-level directories. The reference file is populated with 34 directory names. A new Bash script (hack/ci/verify-toplevel-dirs.sh) collects actual top-level directories from both HEAD and the staged index, filters hidden entries, and diffs the result against the reference file, exiting with status 1 on mismatch. The verify-toplevel-dirs Make target is declared .PHONY and added to the verify-parallel prerequisite list.

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: introducing CI drift detection for top-level directories, which is the central objective of the PR.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed This PR contains no Ginkgo tests. It adds CI tooling (Makefile, bash script, and config file) only. The "Stable and Deterministic Test Names" check is not applicable.
Test Structure And Quality ✅ Passed This PR contains no Ginkgo test code; it only adds CI infrastructure (bash script, config file, and Makefile targets). The custom check is not applicable to this PR.
Topology-Aware Scheduling Compatibility ✅ Passed No deployment manifests, operator code, or controllers are present in this PR. Changes are purely CI tooling (Makefile verification target, directory list, and validation script). No topology-aware...
Ipv6 And Disconnected Network Test Compatibility ✅ Passed This PR does not add any Ginkgo e2e tests. It only adds CI infrastructure (Makefile target, a bash verification script, and a directory list file), so the IPv6/disconnected network compatibility ch...
No-Weak-Crypto ✅ Passed PR adds CI verification scripts (Makefile, bash script, and directory list) for tracking top-level repositories. No cryptographic operations, weak ciphers, or secret comparisons present.
Container-Privileges ✅ Passed PR contains no Kubernetes manifests or container definitions. Changes are limited to Makefile, a bash script, and a text file for CI verification infrastructure. No container privilege escalation i...
No-Sensitive-Data-In-Logs ✅ Passed PR introduces CI verification for top-level directories. Output logging is limited to directory names and static guidance messages; no sensitive data like passwords, tokens, API keys, PII, or crede...

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@openshift-ci openshift-ci Bot added area/ci-tooling Indicates the PR includes changes for CI or tooling and removed do-not-merge/needs-area labels Jun 18, 2026
@openshift-ci

openshift-ci Bot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mgencur
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
openshift-ci Bot requested review from Nirshal and jparrill June 18, 2026 13:12
@codecov

codecov Bot commented Jun 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.88%. Comparing base (c35f662) to head (2e1e122).
⚠️ Report is 83 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8773      +/-   ##
==========================================
+ Coverage   41.84%   41.88%   +0.04%     
==========================================
  Files         759      759              
  Lines       94073    94155      +82     
==========================================
+ Hits        39361    39434      +73     
- Misses      51956    51961       +5     
- Partials     2756     2760       +4     

see 8 files with indirect coverage changes

Flag Coverage Δ
cmd-support 35.16% <ø> (+0.02%) ⬆️
cpo-hostedcontrolplane 44.16% <ø> (+0.06%) ⬆️
cpo-other 43.52% <ø> (+0.06%) ⬆️
hypershift-operator 52.05% <ø> (+0.03%) ⬆️
other 31.56% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread hack/ci/toplevel-dirs.txt
@@ -0,0 +1,34 @@
api

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file is a plain list with no context. Someone encountering it cold won't know what it's for, why it exists, or what to do when they add a directory. A two-line comment at the top would save confusion:

# Tracked list of top-level directories in this repo.
# Used by hack/ci/verify-toplevel-dirs.sh to detect drift in the CI skip pattern.
# When adding a new top-level directory, update this file AND the pipeline_skip_if_only_changed
# regex in ci-operator (unless the new directory contains E2E tests — see CNTRLPLANE-3642).

@mgencur mgencur Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is read by a script so I can't easily add the description. Also, next to this file is verify-toplevel-dirs.sh which has this text:

# Verifies that the tracked top-level directory list stays in sync with
# the actual git-tracked directories. This prevents the CI skip pattern
# (pipeline_skip_if_only_changed) from silently going stale when new
# top-level directories are added to the repo.

Isn't it enough? I could possibly add a README.txt to this folder and mention this file but since it's already mentioned in the script that is named very similarly, I thought this would be enough. Please let me know.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh sorry, I missed it. I guess it would be fine then :)

Comment thread hack/ci/toplevel-dirs.txt
support
sync-fg-configmap
sync-global-pullsecret
test

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test/ is in toplevel-dirs.txt — but NOT in the CI skip pattern, and the script doesn't enforce that distinction:
hack/ci/toplevel-dirs.txt line 32 includes test. The verify script checks that the tracked list matches actual top-level directories — that's correct. But the pipeline_skip_if_only_changed regex in PR #80732 intentionally excludes test/ because it contains E2E tests.

This means:

  • Someone adds a new top-level directory → verify fails → they update toplevel-dirs.txt ✅
  • They are then also told (by the error message on line 29) to update the CI operator regex ✅
  • But the script has no way to distinguish "this dir should be in the regex" from "this dir is intentionally excluded from the regex (like test/)"

The error message on line 29 says:

"Also update the pipeline_skip_if_only_changed regex in the ci-operator config."

This is misleading for test/ — if someone adds a new directory that also contains E2E tests (like a hypothetical test-extended/), they should NOT add it to the skip regex, but the error message implies they should. There's no documentation of the exclusion logic.

Suggested fix: Add a comment in toplevel-dirs.txt above test (or in a separate excluded-from-skip.txt section) and update the error message to reference the distinction explicitly:

# Directories listed here are tracked top-level dirs.
# NOT all of them belong in the pipeline_skip_if_only_changed regex.
# Dirs containing E2E tests (e.g. test/) must be excluded from the regex.
# See hack/ci/verify-toplevel-dirs.sh and CNTRLPLANE-3642 for context.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. Let me update the text.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Hopefully.

Add a verification script and tracked directory list that ensures
the CI skip pattern (pipeline_skip_if_only_changed) stays in sync
when new top-level directories are added to the repo. The check
runs as part of `make verify-parallel`.

- hack/ci/toplevel-dirs.txt: canonical list of top-level dirs
- hack/ci/verify-toplevel-dirs.sh: diffs actual vs tracked dirs
- Makefile: wire verify-toplevel-dirs into verify-parallel

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@mgencur
mgencur force-pushed the CNTRLPLANE-3642_skip_e2e_for_unittests_gh_action branch from 8b94ccf to 2e1e122 Compare June 19, 2026 11:30
@openshift-ci

openshift-ci Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

@mgencur: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 23, 2026
@openshift-ci

openshift-ci Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@hypershift-jira-solve-ci

hypershift-jira-solve-ci Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Test Failure Analysis Complete

Job Information

Test Failure Analysis

Error

tide: Not mergeable. Must be by author dependabot[bot] OR Must be by author 
hypershift-jira-solve-ci[bot] OR Needs approved, lgtm, verified labels. 
Has: needs-rebase (forbidden). Merge state: CONFLICTING.

Summary

This is not a test execution failure — no Prow CI test actually ran and failed. The tide status is in ERROR state because PR #8773 has merge conflicts with the main branch and is missing multiple required labels (approved, lgtm, verified). The needs-rebase label was automatically applied by Prow because the PR's branch has diverged from main and has conflicts (mergeable: CONFLICTING). Additionally, the PR has an unresolved CHANGES_REQUESTED review from mehabhalodiya. The 7 e2e Prow jobs (e2e-aws, e2e-aks, e2e-v2-aws, etc.) are all stuck in PENDING with "Waiting for pipeline condition to trigger this job" because they are configured as always_run: false with pipeline_skip_if_only_changed — they require explicit /test commands or tide to trigger them, neither of which can happen while the PR is in an unmergeable state.

Root Cause

The tide ERROR is caused by multiple compounding issues, all of which must be resolved before the PR can be merged:

  1. Merge conflicts (mergeable: CONFLICTING, mergeStateStatus: DIRTY): The PR branch has diverged from main since it was last updated (last push was before June 18, 2026). This caused Prow to automatically apply the needs-rebase label, which is a forbidden label in the tide merge query for main.

  2. Missing required labels: The tide query for openshift/hypershift on main requires all four of: approved, jira/valid-reference, lgtm, verified. Currently only jira/valid-reference is present. The approved and lgtm labels require OWNERS-file approvers to /approve and /lgtm the PR, while verified typically requires all required CI checks to pass.

  3. Unresolved review: mehabhalodiya submitted a CHANGES_REQUESTED review on June 19, 2026, which has not been resolved or dismissed.

  4. E2E jobs never triggered: All 7 e2e jobs (e2e-aws, e2e-aks, e2e-v2-aws, e2e-v2-gke, e2e-azure-v2-self-managed, e2e-kubevirt-aws-ovn-reduced, e2e-aws-upgrade-hypershift-operator) are configured as always_run: false with pipeline_skip_if_only_changed. They are in perpetual PENDING ("Waiting for pipeline condition to trigger this job") and were never triggered via /test. Since the changed files (Makefile, hack/ci/toplevel-dirs.txt, hack/ci/verify-toplevel-dirs.sh) do NOT match the skip pattern, these jobs would run if explicitly triggered, but no one has done so.

The tide configuration from core-services/prow/02_config/openshift/hypershift/_prowconfig.yaml defines the merge requirements:

  • Required labels: approved, jira/valid-reference, lgtm, verified
  • Forbidden labels: needs-rebase, do-not-merge/*, jira/invalid-bug, backports/unvalidated-commits, keep-main-query-separate
Recommendations
  1. Rebase the PR onto the latest main to resolve merge conflicts. This will automatically remove the needs-rebase label:

    git fetch upstream && git rebase upstream/main && git push --force-with-lease
  2. Address the review feedback from mehabhalodiya (CHANGES_REQUESTED on June 19) — either update the code to address the requested changes or discuss resolution.

  3. Trigger e2e tests after rebasing by commenting /test e2e-aws (or other specific jobs) on the PR, or use /test remaining-required to trigger all untriggered required jobs.

  4. Obtain approvals — an OWNERS-file approver needs to /lgtm and /approve the PR once the code changes are addressed.

  5. Note: The verified label will likely be applied automatically once the required CI jobs pass. The 4 non-e2e Prow jobs (images, okd-scos-images, security, verify-deps) already passed on the current commit.

Evidence
Evidence Detail
Tide status pending — "Not mergeable. Must be by author dependabot[bot] OR Must be by author hypershift-jira-solve-ci[bot] OR Needs approved, lgtm, verified lab..."
PR mergeable state CONFLICTING (GitHub reports mergeStateStatus: DIRTY)
Labels present needs-rebase, jira/valid-reference, area/ci-tooling
Labels missing approved, lgtm, verified
Forbidden label present needs-rebase (auto-applied due to merge conflicts)
Review status CHANGES_REQUESTED by mehabhalodiya (2026-06-19)
E2E jobs status All 7 PENDING — "Waiting for pipeline condition to trigger this job"
Passed Prow jobs images, okd-scos-images, security, verify-deps (all succeeded)
Changed files Makefile, hack/ci/toplevel-dirs.txt, hack/ci/verify-toplevel-dirs.sh
Tide config source openshift/release/core-services/prow/02_config/openshift/hypershift/_prowconfig.yaml
CI job config source openshift/release/ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml

@mgencur

mgencur commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Closing. This is too complicated. There will be a simpler regex that doesn't need updates, in openshift/release#80732

@mgencur mgencur closed this Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci-tooling Indicates the PR includes changes for CI or tooling jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants