Skip to content

CNTRLPLANE-2588: Add periodic job to triage dependabot PRs - #73790

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
bryan-cox:CNTRLPLANE-2588
Mar 9, 2026
Merged

CNTRLPLANE-2588: Add periodic job to triage dependabot PRs#73790
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
bryan-cox:CNTRLPLANE-2588

Conversation

@bryan-cox

@bryan-cox bryan-cox commented Jan 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Add a periodic Prow job that automatically triages dependabot PRs in the HyperShift repository by consolidating them into a single weekly PR.

Changes

  • Add hypershift-dependabot-triage workflow to the step-registry with pre (setup), test (process), and post (report) phases
  • Add setup step (hypershift-dependabot-triage-setup) that verifies Claude Code CLI availability
  • Add process step (hypershift-dependabot-triage-process) that generates GitHub App tokens, clones from the hypershift-community/hypershift fork, queries open dependabot PRs, filters out k8s.io/sigs.k8s.io bumps, and invokes Claude to consolidate remaining PRs
  • Add report step (hypershift-dependabot-triage-report) that generates an HTML report with token usage, cost breakdown, and detailed output
  • Add periodic job configuration to openshift-hypershift-main.yaml (cron: Fridays at 12:00 UTC)
  • Add design document at docs/plans/2026-01-21-dependabot-triage-prow-job-design.md
  • Generate Prow job files via make update

How It Works

  1. Schedule: Runs weekly on Fridays at 12:00 UTC (7:00 AM ET)
  2. Authentication: Generates GitHub App installation tokens for both the fork (hypershift-community/hypershift) and upstream (openshift/hypershift) using credentials from the hypershift-team-claude-prow secret
  3. PR Discovery: Queries all open dependabot PRs via gh pr list, then filters out PRs that bump k8s.io or sigs.k8s.io dependencies (managed manually as part of coordinated Kubernetes rebases)
  4. Processing: Invokes Claude Code (via Vertex AI) with a structured prompt that processes each PR individually:
    • Cherry-picks commits onto a consolidation branch
    • Runs make verify and make test after each PR (with precise gitlint-only failure detection using make:.*\*\*\* target matching)
    • Resets and skips any PR that fails validation
  5. Commit Reorganization (deterministic bash, not LLM):
    After Claude finishes, bash logic flattens all cherry-pick commits via git reset and reorganizes into logical groups:
    1. Root go.mod/go.sum
    2. Root vendor/
    3. api/go.mod/api/go.sum
    4. api/vendor/
    5. hack/tools/go.mod/hack/tools/go.sum
    6. hack/tools/vendor/
    7. Regenerated CRD assets (cmd/install/assets/)
    8. Remaining generated files
      Empty groups are skipped automatically.
  6. Final Validation: Bash runs two-pass make verify and make test on the consolidated branch before creating the PR
  7. Output: Creates a single consolidated draft PR from hypershift-community:fix/weekly-dependabot-consolidation to openshift/hypershift with a dynamically generated commit list

Implementation Details

  • Uses claude-ai-helpers base image for all steps
  • Authenticates to Claude via Vertex AI (GCP project itpc-gcp-hybrid-pe-eng-claude, region us-east5)
  • Process step has a 2-hour timeout and 100 max Claude turns
  • Git credential helper prevents token leakage in logs
  • GitHub App tokens are refreshed before push/PR creation (originals expire during long processing)
  • Best-effort: processes as many PRs as possible, reports failures in the consolidated PR body
  • All commits include a body line to satisfy HyperShift's gitlint requirements

New Files

ci-operator/step-registry/hypershift/dependabot-triage/
├── OWNERS
├── hypershift-dependabot-triage-workflow.yaml
├── hypershift-dependabot-triage-workflow.metadata.json
├── process/
│   ├── OWNERS
│   ├── hypershift-dependabot-triage-process-commands.sh
│   ├── hypershift-dependabot-triage-process-ref.yaml
│   └── hypershift-dependabot-triage-process-ref.metadata.json
├── report/
│   ├── OWNERS
│   ├── hypershift-dependabot-triage-report-commands.sh
│   ├── hypershift-dependabot-triage-report-ref.yaml
│   └── hypershift-dependabot-triage-report-ref.metadata.json
└── setup/
    ├── OWNERS
    ├── hypershift-dependabot-triage-setup-commands.sh
    ├── hypershift-dependabot-triage-setup-ref.yaml
    └── hypershift-dependabot-triage-setup-ref.metadata.json
docs/plans/2026-01-21-dependabot-triage-prow-job-design.md

Test Plan

  • Step-registry validation passes
  • Prow config generation succeeds (make update)
  • Rehearse job runs successfully (commit reorganization, gitlint detection, verify/test gating all working)
  • First scheduled execution produces a valid consolidated PR

Related

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 21, 2026
@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

@bryan-cox: This pull request references CNTRLPLANE-2588 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Add a periodic Prow job that automatically triages dependabot PRs in the HyperShift repository by consolidating them into a single weekly PR.

Changes

  • Add hypershift-dependabot-triage workflow to step-registry
  • Add setup step (clone repo, configure credentials)
  • Add process step (query PRs, invoke Claude, consolidate)
  • Add periodic job configuration (Fridays at 12:00 UTC)
  • Generate Prow job files

How It Works

  1. Job runs weekly on Fridays at 12:00 UTC (7:00 AM ET)
  2. Queries GitHub for all open dependabot PRs
  3. Invokes Claude to process each PR and consolidate into single branch
  4. Runs make verify and make test to regenerate files
  5. Creates consolidated PR with organized commits
  6. Closes original dependabot PRs

Commit Organization

The consolidated PR organizes changes for easy review:

  1. go.mod/go.sum changes only
  2. vendor/ updates
  3. api/ module changes
  4. Regenerated assets
  5. Other generated changes

Test Plan

  • Verify step-registry validation passes
  • Verify prow config validation passes
  • Test workflow manually before first scheduled run

Related

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from csrwng and devguyio January 21, 2026 13:37
@openshift-ci openshift-ci Bot added the do-not-merge/invalid-owners-file Indicates that a PR should not merge because it has an invalid OWNERS file in it. label Jan 21, 2026
@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci openshift-ci Bot removed the do-not-merge/invalid-owners-file Indicates that a PR should not merge because it has an invalid OWNERS file in it. label Jan 21, 2026
@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

bryan-cox commented Jan 21, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@bryan-cox

bryan-cox commented Jan 27, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci-robot

openshift-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: job(s): periodic-ci-openshift-hypershift-main-dependabot-triage either don't exist or were not found to be affected, and cannot be rehearsed

@bryan-cox

bryan-cox commented Jan 27, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-dependabot-triage

@openshift-ci-robot

openshift-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 9, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 9, 2026
@bryan-cox
bryan-cox force-pushed the CNTRLPLANE-2588 branch 2 times, most recently from 0061711 to 64d0d3f Compare February 9, 2026 19:39
@openshift-ci

openshift-ci Bot commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@bryan-cox

bryan-cox commented Mar 9, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse ack

@openshift-ci-robot

openshift-ci-robot commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci-robot openshift-ci-robot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Mar 9, 2026
@jparrill

jparrill commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 9, 2026
@hector-vido

hector-vido commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci

openshift-ci Bot commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, hector-vido, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 9, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit 60a8d6a into openshift:main Mar 9, 2026
17 checks passed
@bryan-cox
bryan-cox deleted the CNTRLPLANE-2588 branch March 9, 2026 15:18
bryan-cox added a commit to bryan-cox/hypershift that referenced this pull request Mar 9, 2026
@bryan-cox @claude
docs: add dependabot triage agent to AI CI jobs documentation
a747470 
Document the new periodic-hypershift-dependabot-triage Prow job that
consolidates open dependabot PRs into a single weekly PR. Includes
data flow diagram, configuration details, and excluded dependency
prefixes (k8s.io, sigs.k8s.io).

Ref: openshift/release#73790
Ref: CNTRLPLANE-2588

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@bryan-cox bryan-cox mentioned this pull request Mar 9, 2026
Merged
2 tasks
bryan-cox added a commit to bryan-cox/hypershift that referenced this pull request Mar 9, 2026
@bryan-cox @claude
docs: add dependabot triage agent to AI CI jobs documentation
632e000 
Document the new periodic-hypershift-dependabot-triage Prow job in the
existing AI-assisted CI jobs doc. Includes data flow diagram,
configuration details, and excluded dependency prefixes (k8s.io,
sigs.k8s.io).

Ref: openshift/release#73790
Ref: CNTRLPLANE-2588

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bryan-cox added a commit to bryan-cox/hypershift that referenced this pull request Mar 9, 2026
@bryan-cox @claude
docs: add dependabot triage agent to AI CI jobs documentation
eda6c1c 
Document the new periodic-hypershift-dependabot-triage Prow job in the
existing AI-assisted CI jobs doc. Includes data flow diagram,
configuration details, and excluded dependency prefixes (k8s.io,
sigs.k8s.io).

Ref: openshift/release#73790
Ref: CNTRLPLANE-2588

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
xiaozhisean pushed a commit to xiaozhisean/openshift-release that referenced this pull request Mar 10, 2026
@bryan-cox @claude @xiaozhisean
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
d4a6db8 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
kasturinarra pushed a commit to kasturinarra/release that referenced this pull request Mar 11, 2026
@bryan-cox @claude Kasturi Narra
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
a1a5394 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
ibm-adarsh pushed a commit to ibm-adarsh/release that referenced this pull request Mar 12, 2026
@bryan-cox @claude @ibm-adarsh
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
27006a9 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
amp-rh pushed a commit to amp-rh/openshift-release that referenced this pull request Mar 12, 2026
@bryan-cox @claude @amp-rh
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
7d5a258 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
tareqalayan pushed a commit to tareqalayan/release that referenced this pull request Mar 13, 2026
@bryan-cox @claude @tareqalayan
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
3aa720a 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
qiliRedHat pushed a commit to qiliRedHat/release that referenced this pull request Mar 13, 2026
@bryan-cox @claude @qiliRedHat
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
05d130f 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
MayXuQQ pushed a commit to MayXuQQ/release that referenced this pull request Mar 17, 2026
@bryan-cox @claude @MayXuQQ
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
95ba28d 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
kasturinarra pushed a commit to kasturinarra/release that referenced this pull request Mar 17, 2026
@bryan-cox @claude Kasturi Narra
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
a899960 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
sairameshv pushed a commit to sairameshv/release that referenced this pull request Mar 23, 2026
@bryan-cox @claude @sairameshv
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
6762baa 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
zhouying7780 pushed a commit to zhouying7780/release that referenced this pull request Mar 25, 2026
@bryan-cox @claude @zhouying7780
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
8cf8383 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
rrasouli pushed a commit to rrasouli/release that referenced this pull request Mar 25, 2026
@bryan-cox @claude @rrasouli
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
dd64dc3 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
anpingli pushed a commit to anpingli/release that referenced this pull request Mar 30, 2026
@bryan-cox @claude @anpingli
feat: add dependabot-triage periodic job for HyperShift (openshift#73790
461e0a4 
)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
mehabhalodiya pushed a commit to mehabhalodiya/hypershift that referenced this pull request Apr 13, 2026
@bryan-cox @claude @mehabhalodiya
docs: add dependabot triage agent to AI CI jobs documentation
c9e59a9 
Document the new periodic-hypershift-dependabot-triage Prow job in the
existing AI-assisted CI jobs doc. Includes data flow diagram,
configuration details, and excluded dependency prefixes (k8s.io,
sigs.k8s.io).

Ref: openshift/release#73790
Ref: CNTRLPLANE-2588

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@csrwng csrwng Awaiting requested review from csrwng
@devguyio devguyio Awaiting requested review from devguyio
2 more reviewers
@enxebre enxebre enxebre left review comments
@jparrill jparrill jparrill left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@jparrill jparrill

@hector-vido hector-vido

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@bryan-cox @openshift-ci-robot @jparrill @hector-vido @enxebre @openshift-merge-robot