CNTRLPLANE-3944: Regenerate requirements.txt files with pinned --hash entries by mgencur · Pull Request #9135 · openshift/hypershift

mgencur · 2026-07-28T06:44:07Z

What this PR does / why we need it:

Regenerates all three Python requirements.txt files in the repo so every dependency is pinned to an exact version and carries --hash=sha256:... entries for its published artifacts, enabling pip's hash-checking mode (pip install --require-hashes). This protects against a compromised or tampered package matching a version pin but not the originally published artifact — a practice increasingly adopted across OpenShift repositories.

hypershift-ci-python/requirements.txt — was already == pinned; hashes added via uv pip compile --generate-hashes.
docs/requirements.txt — normalized from PEP 440 arbitrary-equality (===) to standard ==, then regenerated to the full transitive closure with hashes. Verified with a real mkdocs build --strict run.
contrib/oidc/requirements.txt — open-ended boto3>=/botocore>= ranges resolved to exact pins and hashed in one step.

Also adds/updates READMEs (new hypershift-ci-python/README.md, updates to docs/README.md and contrib/oidc/README.md) documenting how to add a new dependency or update an existing one's hash going forward, using uv pip compile --generate-hashes.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3944

Special notes for your reviewer:

Because pip's --require-hashes mode requires every installed package — including transitive dependencies — to be pinned and hashed, docs/requirements.txt and contrib/oidc/requirements.txt grew substantially (they previously listed only top-level packages). This is expected/standard behavior of pip-compile/uv pip compile --generate-hashes lock files, not scope creep.
All three files were validated locally with pip install --dry-run --require-hashes -r <file>, and docs/requirements.txt was additionally verified with a real mkdocs build --strict.
One known follow-up (not blocking, noted in the Jira ticket): confirm Dependabot can still open update PRs against the now-hashed files once the next automated PR lands — dependabot-core has explicit hash-regeneration logic for plain requirements.txt files, but this hasn't been observed against this repo's setup yet.

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve https://redhat.atlassian.net/browse/CNTRLPLANE-3944 mgencur

Summary by CodeRabbit

Documentation
- Added “Managing Python dependencies” guidance for strict docs builds, including regenerating and validating hash-pinned requirements.txt.
- Added HyperShift CI Python README with a hash-checked dependency update workflow.
Chores
- Regenerated OIDC, docs, and CI Python requirements into fully pinned, SHA-256 hash-checked sets.
- Updated docs/CI Dockerfiles and the reusable docs workflow to install dependencies with pip --require-hashes.
- Tweaked the docs image-version parsing logic for mkdocs-material.
- Extended the docs build workflow trigger to run when the reusable workflow changes.

Regenerate hypershift-ci-python/requirements.txt via `uv pip compile --generate-hashes` so every dependency carries --hash=sha256 entries for its published artifacts. This enables pip's hash-checking mode (pip install --require-hashes), protecting the CI Python image build against a compromised or tampered package matching a version pin but not the originally published artifact. Part of CNTRLPLANE-3944.

Normalize the top-level pins from PEP 440 arbitrary-equality (===) to standard version matching (==), then regenerate the full dependency lock via `uv pip compile --generate-hashes`. Pip's hash-checking mode requires every installed package -- including transitive dependencies of mkdocs-material, mkdocs-mermaid2-plugin, and mkdocs-glightbox -- to be pinned and hashed, so the file now lists the complete resolved closure instead of just the three top-level packages. Verified with `pip install --require-hashes` and a real `mkdocs build --strict` run against the regenerated lock. Part of CNTRLPLANE-3944.

Replace the open-ended boto3/botocore version ranges with exact pins resolved via `uv pip compile --generate-hashes`, and add sha256 hashes for every package in the resolved closure (boto3, botocore, jmespath, python-dateutil, s3transfer, six, urllib3). Pip's hash-checking mode requires exact pins, so this also satisfies that precondition for the OIDC/Dex demo playbook setup described in contrib/oidc/README.md. Part of CNTRLPLANE-3944.

Add a new hypershift-ci-python/README.md and extend docs/README.md and contrib/oidc/README.md with instructions for regenerating each requirements.txt via `uv pip compile --generate-hashes` when adding a new dependency or bumping an existing one, plus how to validate the result with `pip install --require-hashes`. Part of CNTRLPLANE-3944.

openshift-merge-bot · 2026-07-28T06:44:09Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-28T06:44:10Z

@mgencur: This pull request references CNTRLPLANE-3944 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What this PR does / why we need it:

Regenerates all three Python requirements.txt files in the repo so every dependency is pinned to an exact version and carries --hash=sha256:... entries for its published artifacts, enabling pip's hash-checking mode (pip install --require-hashes). This protects against a compromised or tampered package matching a version pin but not the originally published artifact — a practice increasingly adopted across OpenShift repositories.

hypershift-ci-python/requirements.txt — was already == pinned; hashes added via uv pip compile --generate-hashes.

docs/requirements.txt — normalized from PEP 440 arbitrary-equality (===) to standard ==, then regenerated to the full transitive closure with hashes. Verified with a real mkdocs build --strict run.

contrib/oidc/requirements.txt — open-ended boto3>=/botocore>= ranges resolved to exact pins and hashed in one step.

Also adds/updates READMEs (new hypershift-ci-python/README.md, updates to docs/README.md and contrib/oidc/README.md) documenting how to add a new dependency or update an existing one's hash going forward, using uv pip compile --generate-hashes.

Which issue(s) this PR fixes:

Fixes CNTRLPLANE-3944

Special notes for your reviewer:

Because pip's --require-hashes mode requires every installed package — including transitive dependencies — to be pinned and hashed, docs/requirements.txt and contrib/oidc/requirements.txt grew substantially (they previously listed only top-level packages). This is expected/standard behavior of pip-compile/uv pip compile --generate-hashes lock files, not scope creep.

All three files were validated locally with pip install --dry-run --require-hashes -r <file>, and docs/requirements.txt was additionally verified with a real mkdocs build --strict.

One known follow-up (not blocking, noted in the Jira ticket): confirm Dependabot can still open update PRs against the now-hashed files once the next automated PR lands — dependabot-core has explicit hash-regeneration logic for plain requirements.txt files, but this hasn't been observed against this repo's setup yet.

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

🤖 Generated with Claude Code via /jira:solve https://redhat.atlassian.net/browse/CNTRLPLANE-3944 mgencur

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-28T06:44:19Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-07-28T06:44:26Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The change converts OIDC, documentation, and HyperShift CI Python requirements into generated exact-version dependency sets with SHA-256 hashes and transitive dependency provenance. README files document regeneration with uv pip compile --generate-hashes, hash-checked validation, and strict documentation builds. Dockerfiles and the reusable docs workflow enforce hash verification during installation, and the docs workflow trigger now includes changes to its reusable workflow.

Possibly related PRs

openshift/hypershift#9124: Updates httplib2 in the same HyperShift CI Python requirements set.
openshift/hypershift#9133: Also changes the reusable docs workflow to install documentation dependencies explicitly.

Suggested reviewers: ironcladlou, devguyio

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: regenerating requirements files with pinned hash entries.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No test files or Ginkgo titles were changed; the PR only touches docs, Dockerfiles, workflows, and requirements files.
Test Structure And Quality	✅ Passed	No Ginkgo test files or test logic changed; the PR only adjusts a docs workflow install command, so this test-quality check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only changes docs, requirements, Dockerfiles, and docs workflows; no manifests/controllers or scheduling logic were added or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the only changed file is a workflow YAML, so there are no IPv4/network assumptions to review.
No-Weak-Crypto	✅ Passed	No PR-changed files introduce MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret comparisons; changes are docs, hashes, and pip install flags only.
Container-Privileges	✅ Passed	No touched manifest adds privileged/root settings; docs/Dockerfile runs as USER docs and ubi9/python-312 is marked unprivileged.
No-Sensitive-Data-In-Logs	✅ Passed	No new log statements or sensitive-output paths were added; changes are limited to dependency pins, hashes, and README/workflow instructions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

contrib/oidc/requirements.txt (1)
1-35: 🔒 Security & Privacy | 🔵 Trivial

Verify SBOM, provenance, signing, and license checks in the consuming pipeline.

The lockfiles improve artifact integrity, but the supplied changes do not demonstrate SBOM generation, provenance attestations, Sigstore/cosign signing, or license compatibility checks for the expanded dependency closures.

contrib/oidc/requirements.txt#L1-L35: verify these controls cover the OIDC dependency set.

docs/requirements.txt#L1-L451: verify these controls cover the expanded documentation dependency closure.

hypershift-ci-python/requirements.txt#L1-L237: verify these controls cover the HyperShift CI dependency set.

As per path instructions, “New deps: justify need, check license compatibility,” “SBOM: ensure build produces provenance attestations,” and “Signing: artifacts signed with Sigstore/cosign.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@contrib/oidc/requirements.txt` around lines 1 - 35, Verify the consuming
pipeline applies SBOM generation, provenance attestations, Sigstore/cosign
signing, and license compatibility checks to every dependency closure:
contrib/oidc/requirements.txt lines 1-35, docs/requirements.txt lines 1-451, and
hypershift-ci-python/requirements.txt lines 1-237. Update the relevant build or
release workflow so all three dependency sets are covered, and justify or
validate the licenses of newly introduced dependencies.
Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hypershift-ci-python/README.md`:
- Around line 52-53: Update the README’s pip-compile fallback command to include
the --generate-hashes option, ensuring regenerated requirements remain
hash-pinned while preserving the existing uv pip compile guidance.

In `@hypershift-ci-python/requirements.txt`:
- Around line 146-152: Update the pinned packages in requirements.txt to
httplib2 0.32.0, protobuf 5.29.6, and pyasn1 0.6.4. Regenerate each package’s
sha256 hashes and rerun the hash-checked dependency install to validate the
lockfile.

---

Nitpick comments:
In `@contrib/oidc/requirements.txt`:
- Around line 1-35: Verify the consuming pipeline applies SBOM generation,
provenance attestations, Sigstore/cosign signing, and license compatibility
checks to every dependency closure: contrib/oidc/requirements.txt lines 1-35,
docs/requirements.txt lines 1-451, and hypershift-ci-python/requirements.txt
lines 1-237. Update the relevant build or release workflow so all three
dependency sets are covered, and justify or validate the licenses of newly
introduced dependencies.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 612e181d-5a2c-4464-af00-29f690706090

📥 Commits

Reviewing files that changed from the base of the PR and between fe62283 and 4cf1161.

📒 Files selected for processing (6)

contrib/oidc/README.md
contrib/oidc/requirements.txt
docs/README.md
docs/requirements.txt
hypershift-ci-python/README.md
hypershift-ci-python/requirements.txt

codecov · 2026-07-28T06:52:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 44.62%. Comparing base (fe62283) to head (ced2fca).
⚠️ Report is 21 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9135      +/-   ##
==========================================
+ Coverage   44.56%   44.62%   +0.05%     
==========================================
  Files         774      775       +1     
  Lines       97003    97105     +102     
==========================================
+ Hits        43228    43329     +101     
+ Misses      50783    50781       -2     
- Partials     2992     2995       +3

see 8 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	`38.39% <ø> (+<0.01%)`	⬆️
cpo-hostedcontrolplane	`47.23% <ø> (+0.01%)`	⬆️
cpo-other	`45.29% <ø> (+0.04%)`	⬆️
hypershift-operator	`54.55% <ø> (+0.08%)`	⬆️
other	`33.30% <ø> (+0.23%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Bump httplib2 (0.22.0 -> 0.32.0) and pyasn1 (0.6.3 -> 0.6.4) in hypershift-ci-python/requirements.txt. While regenerating, `uv pip compile --generate-hashes` was found to reuse a package's previous hash under its new version's pin when the compile output path is the same file as its input -- confirmed against the real published PyPI artifacts, since neither --refresh nor --no-cache prevented it. Fix the requirements.txt hashes for the two bumped packages, and correct all three README instructions to compile to a temporary path and move it into place afterward, instead of compiling directly onto the existing file. Part of CNTRLPLANE-3944.

mgencur · 2026-07-28T07:05:16Z

Pushed an additional commit: bumped httplib2 (0.22.0 → 0.32.0) and pyasn1 (0.6.3 → 0.6.4) in hypershift-ci-python/requirements.txt.

While doing this, found that uv pip compile --generate-hashes can silently keep a package's old hash attached to its new version pin when the output path is the same file as the input — confirmed against the real published PyPI artifacts (this isn't a caching issue; --refresh/--no-cache don't prevent it). Fixed the hashes for both bumped packages and corrected the "how to update a dependency" instructions in all three READMEs to compile to a temporary path and move it into place, rather than compiling directly onto the existing file.

mgencur · 2026-07-28T07:10:24Z

The Docs build depends on #9133 . This PR will need a rebase after the merge.
Update: The changes from that PR are included in the current PR.

Regenerate via the temp-file-and-move workflow (compile to a fresh path, then move it into place) to avoid the stale-hash issue found when compiling directly onto the existing file. Hashes verified against the real published PyPI artifacts for protobuf 5.29.6. Part of CNTRLPLANE-3944.

mgencur · 2026-07-28T07:28:40Z

/hold
Need to update the respective Dockerfiles too

Add --require-hashes to the pip install steps in docs/Dockerfile and hypershift-ci-python/Dockerfile so the images actually enforce the sha256 verification the requirements.txt files now provide, rather than just carrying unused hash metadata. Also fix docs/image-version.awk, which derives the mkdocs-material image tag from docs/requirements.txt. It relied on the old mkdocs-material===X.Y.Z (arbitrary-equality) format and a bare substring match on "mkdocs-material", which broke once that line became mkdocs-material==X.Y.Z inside a much larger hashed dependency list containing other matching lines (mkdocs-material-extensions, "# via mkdocs-material" comments). Anchor the match to the start of the line and split on "==" instead. Verified both Dockerfiles build successfully with --require-hashes, and that `mkdocs build --strict` runs correctly against the resulting docs image. Also verified `make image` now correctly derives the tag quay.io/hypershift/mkdocs-material:9.6.8 again. Part of CNTRLPLANE-3944.

mgencur · 2026-07-28T07:39:23Z

/unhold

celebdor

It is missing the "--require-hashes" in the .github/workflows/docs-build-reusable.yaml

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docs-build.yaml:
- Line 11: Update the reusable workflow reference in the docs-build workflow to
use the PR-local .github/workflows/docs-build-reusable.yaml path instead of the
openshift/hypershift repository reference pinned to main, ensuring the workflow
tests the version changed in the current PR.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 91645b0f-1457-4376-b28f-eadf0cc437cd

📥 Commits

Reviewing files that changed from the base of the PR and between 176022f and 18850b0.

📒 Files selected for processing (2)

.github/workflows/docs-build-reusable.yaml
.github/workflows/docs-build.yaml

actions/setup-python removed the pip-install input in v7.0.0 (it installed into the global environment, conflicted with virtualenvs and tools like uv, and wasn't picked up by Dependabot). Since this workflow was already pinned to v7.0.0, its pip-install: '-r docs/requirements.txt' input silently became a no-op, meaning docs dependencies were never actually installed here. Replace it with an explicit "pip install -r docs/requirements.txt" step, matching the fix already proposed in openshift#9133.

Add --require-hashes to the docs dependency install step, matching docs/Dockerfile, so CI actually enforces the sha256 verification that docs/requirements.txt now provides instead of just carrying unused hash metadata. Part of CNTRLPLANE-3944.

mgencur · 2026-07-28T10:03:32Z

/test images

jparrill · 2026-07-29T07:54:34Z

/approve

jparrill · 2026-07-29T07:54:44Z

/label acknowledge-critical-fixes-only

jparrill · 2026-07-29T07:55:14Z

/verify bypass

Looks like this PR would be verified after merge with main via @mgencur.

Env vars are step-scoped; PIP_CACHE_DIR was attached to the wrong step and had no effect on pip's cache location.

dhgautam99 · 2026-07-29T08:22:22Z

/lgtm

openshift-merge-bot · 2026-07-29T08:23:18Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke
/test unit
/test verify

celebdor

/lgtm

openshift-ci · 2026-07-29T09:00:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: celebdor, jparrill, mgencur

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

PoornimaSingour · 2026-07-29T09:25:47Z

/jira backport release-4.22 release-4.21 release-4.20

openshift-ci-robot · 2026-07-29T09:25:50Z

@PoornimaSingour: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22 release-4.21 release-4.20

Details

In response to this:

/jira backport release-4.22 release-4.21 release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2026-07-29T09:26:36Z

@openshift-ci-robot: #9135 failed to apply on top of branch "release-4.22":

Applying: chore(ci): pin hypershift-ci-python requirements with sha256 hashes
Using index info to reconstruct a base tree...
M	hypershift-ci-python/requirements.txt
Falling back to patching base and 3-way merge...
Auto-merging hypershift-ci-python/requirements.txt
CONFLICT (content): Merge conflict in hypershift-ci-python/requirements.txt
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 chore(ci): pin hypershift-ci-python requirements with sha256 hashes

Details

In response to this:

@PoornimaSingour: The following backport issues have been created:

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22 release-4.21 release-4.20

In response to this:

/jira backport release-4.22 release-4.21 release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

PoornimaSingour · 2026-07-29T09:33:12Z

I commented on the wrong PR. Please ignore my previous comment.

mgencur added 4 commits July 28, 2026 08:37

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 28, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 28, 2026

openshift-ci Bot added the do-not-merge/needs-area label Jul 28, 2026

openshift-ci Bot added area/documentation Indicates the PR includes changes for documentation and removed do-not-merge/needs-area labels Jul 28, 2026

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread hypershift-ci-python/README.md Outdated

Comment thread hypershift-ci-python/requirements.txt Outdated

mgencur marked this pull request as ready for review July 28, 2026 07:20

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 28, 2026

openshift-ci Bot requested review from devguyio and ironcladlou July 28, 2026 07:20

This was referenced Jul 28, 2026

NO-JIRA: ci(deps): bump pyasn1 from 0.6.3 to 0.6.4 in /hypershift-ci-python #9103

Closed

NO-JIRA: ci(deps): bump httplib2 from 0.22.0 to 0.32.0 in /hypershift-ci-python #9124

Closed

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 28, 2026

celebdor requested changes Jul 28, 2026

View reviewed changes

openshift-ci Bot assigned celebdor Jul 28, 2026

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread .github/workflows/docs-build.yaml Outdated

mgencur added 2 commits July 28, 2026 11:33

mgencur force-pushed the fix-CNTRLPLANE-3944 branch from 18850b0 to acf25af Compare July 28, 2026 09:34

coderabbitai Bot mentioned this pull request Jul 28, 2026

CNTRLPLANE-3945: Migrate documentation tooling from mkdocs-material to zensical #9139

Merged

4 tasks

openshift-ci Bot added the acknowledge-critical-fixes-only Indicates if the issuer of the label is OK with the policy. label Jul 29, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 29, 2026

dhgautam99 reviewed Jul 29, 2026

View reviewed changes

Comment thread .github/workflows/docs-build-reusable.yaml Outdated

fix(ci): move PIP_CACHE_DIR to the actual pip install step

ced2fca

Env vars are step-scoped; PIP_CACHE_DIR was attached to the wrong step and had no effect on pip's cache location.

openshift-ci Bot assigned dhgautam99 Jul 29, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 29, 2026

celebdor approved these changes Jul 29, 2026

View reviewed changes

celebdor merged commit 845e625 into openshift:main Jul 29, 2026
28 of 42 checks passed

mgencur mentioned this pull request Jul 29, 2026

[TEST ONLY] Trigger #9153

Closed

4 tasks

mgencur mentioned this pull request Jul 29, 2026

OCPBUGS-99941: replace invalid pip-install input with explicit pip install step #9133

Closed

4 tasks

Uh oh!

Conversation

mgencur commented Jul 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

openshift-ci-robot commented Jul 28, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Checklist:

Uh oh!

openshift-ci Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mgencur commented Jul 28, 2026

Uh oh!

mgencur commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mgencur commented Jul 28, 2026

Uh oh!

mgencur commented Jul 28, 2026

Uh oh!

celebdor left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mgencur commented Jul 28, 2026

Uh oh!

jparrill commented Jul 29, 2026

Uh oh!

jparrill commented Jul 29, 2026

Uh oh!

jparrill commented Jul 29, 2026

Uh oh!

Uh oh!

dhgautam99 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

celebdor left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

Uh oh!

PoornimaSingour commented Jul 29, 2026

Uh oh!

openshift-ci-robot commented Jul 29, 2026

Uh oh!

openshift-cherrypick-robot commented Jul 29, 2026

Uh oh!

PoornimaSingour commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

mgencur commented Jul 28, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Jul 28, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

codecov Bot commented Jul 28, 2026 •

edited

Loading

mgencur commented Jul 28, 2026 •

edited

Loading