CNTRLPLANE-3352: force HTTPS for GHA plugin dependency clones

[bryan-cox]

What this PR does / why we need it:

The claude plugin install openshift-developer@ai-helpers step in the
reusable GHA workflow fails because plugin dependencies with external
source repos (prodsec-skills, gopls-lsp) are cloned via SSH. The
GHA runners don't have SSH keys for GitHub, so the clone fails with
Host key verification failed.

This adds GIT_CONFIG env vars to redirect all git@github.com: URLs
to https://github.com/, which is the standard pattern for CI
environments without SSH access.

Evidence of failure: https://github.com/openshift/hypershift/actions/runs/28036121179/job/82989822214

✘ Failed to install plugin "openshift-developer@ai-helpers":
  Failed to clone repository: Host key verification failed.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3352

Special notes for your reviewer:

The external plugin dependencies (gopls-lsp, prodsec-skills) were
bundled into the ai-helpers marketplace in openshift-eng/ai-helpers#565,
so only the ai-helpers marketplace needs to be added. But the source
repos still need to be cloned during install, which is what this SSH→HTTPS
redirect fixes.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3352 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Fixes the GHA address-review-comments workflow failing to install the
openshift-developer plugin bundle.

Two issues:

1. The openshift-developer bundle's transitive dependencies (gopls-lsp,
   prodsec-skills) have external source repos. When claude plugin install
   resolves these, it attempts SSH clones — which fail on GHA runners that
   don't have SSH keys configured (Host key verification failed). Fix:
   add GIT_CONFIG env vars to redirect git@github.com: to
   https://github.com/ for all git operations in the step.

2. The extra claude plugin marketplace add commands for
   anthropics/claude-plugins-official and
   RedHatProductSecurity/prodsec-skills are no longer needed — these
   plugins are now bundled in the ai-helpers marketplace
   (fix: bundle external deps into ai-helpers marketplace openshift-eng/ai-helpers#565).

Evidence of failure: https://github.com/openshift/hypershift/actions/runs/28036121179/job/82989822214

✘ Failed to install plugin "openshift-developer@ai-helpers":
 Failed to clone repository: Host key verification failed.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3352

Special notes for your reviewer:

Depends on openshift-eng/ai-helpers#565 which is already merged.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

In .github/workflows/reusable-claude-on-pr.yaml, three environment variables are added to the "Run Claude" step: GIT_CONFIG_COUNT=1, GIT_CONFIG_KEY_0=url.https://github.com/.insteadOf, and GIT_CONFIG_VALUE_0=https://github.com. These variables configure Git URL rewriting so that https://github.com URLs are rewritten to git@github.com: format during the step's execution.

Suggested Reviewers

• csrwng
• jparrill

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Stable And Deterministic Test Names	❌ Error	PR adds Ginkgo tests with dynamic test names using variables (e.g., Context(workload.Name, ...) in test/e2e/v2/tests/control_plane_workloads_test.go), violating the stable test name requirement.	Replace variable-based test names with static descriptive strings; move dynamic values into test setup/assertions instead of test titles.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Structure And Quality	✅ Passed	The PR modifies only a GitHub Actions workflow YAML file (.github/workflows/reusable-claude-on-pr.yaml) and does not include any Ginkgo test code. The custom check is not applicable to this PR.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies a GitHub Actions workflow file (.github/workflows/reusable-claude-on-pr.yaml) to add Git configuration environment variables. No deployment manifests, operator code, or Kubernetes...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR modifies a GitHub Actions workflow file (.github/workflows/reusable-claude-on-pr.yaml), not Ginkgo e2e tests. The custom check is designed to flag only new Ginkgo e2e tests (It(), Describe(...
No-Weak-Crypto	✅ Passed	The PR adds only Git URL redirection configuration via environment variables; no weak crypto algorithms, custom implementations, or insecure comparisons are present.
Container-Privileges	✅ Passed	PR modifies GitHub Actions workflow files only; no container/K8s manifests with privilege escalation settings (privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation:tr...
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds GIT_CONFIG environment variables (url rewrite rules) that are public git configuration, not passwords, tokens, API keys, PII, session IDs, internal hostnames, or customer data.
Title check	✅ Passed	The title clearly references the main change: adding Git configuration to force HTTPS for GHA plugin dependency clones, which directly addresses the SSH clone failure issue described in the PR objectives.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/area ai
/area ci-tooling

[csrwng]

/lgtm

[bryan-cox]

/verified later @bryan-cox

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @bryan-cox.

Details

In response to this:

/verified later @bryan-cox

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.