CNTRLPLANE-2588: Add periodic job to triage dependabot PRs - #73790

Summary

Add a periodic Prow job that automatically triages dependabot PRs in the HyperShift repository by consolidating them into a single weekly PR.

Changes

• Add hypershift-dependabot-triage workflow to the step-registry with pre (setup), test (process), and post (report) phases
• Add setup step (hypershift-dependabot-triage-setup) that verifies Claude Code CLI availability
• Add process step (hypershift-dependabot-triage-process) that generates GitHub App tokens, clones from the hypershift-community/hypershift fork, queries open dependabot PRs, filters out k8s.io/sigs.k8s.io bumps, and invokes Claude to consolidate remaining PRs
• Add report step (hypershift-dependabot-triage-report) that generates an HTML report with token usage, cost breakdown, and detailed output
• Add periodic job configuration to openshift-hypershift-main.yaml (cron: Fridays at 12:00 UTC)
• Add design document at docs/plans/2026-01-21-dependabot-triage-prow-job-design.md
• Generate Prow job files via make update

How It Works

1. Schedule: Runs weekly on Fridays at 12:00 UTC (7:00 AM ET)
2. Authentication: Generates GitHub App installation tokens for both the fork (hypershift-community/hypershift) and upstream (openshift/hypershift) using credentials from the hypershift-team-claude-prow secret
3. PR Discovery: Queries all open dependabot PRs via gh pr list, then filters out PRs that bump k8s.io or sigs.k8s.io dependencies (managed manually as part of coordinated Kubernetes rebases)
4. Processing: Invokes Claude Code (via Vertex AI) with a structured prompt that processes each PR individually:
   • Cherry-picks commits onto a consolidation branch
   • Runs make verify and make test after each PR (with precise gitlint-only failure detection using make:.*\*\*\* target matching)
   • Resets and skips any PR that fails validation
5. Commit Reorganization (deterministic bash, not LLM):
   After Claude finishes, bash logic flattens all cherry-pick commits via git reset and reorganizes into logical groups:
   1. Root go.mod/go.sum
   2. Root vendor/
   3. api/go.mod/api/go.sum
   4. api/vendor/
   5. hack/tools/go.mod/hack/tools/go.sum
   6. hack/tools/vendor/
   7. Regenerated CRD assets (cmd/install/assets/)
   8. Remaining generated files
      Empty groups are skipped automatically.
6. Final Validation: Bash runs two-pass make verify and make test on the consolidated branch before creating the PR
7. Output: Creates a single consolidated draft PR from hypershift-community:fix/weekly-dependabot-consolidation to openshift/hypershift with a dynamically generated commit list

Implementation Details

• Uses claude-ai-helpers base image for all steps
• Authenticates to Claude via Vertex AI (GCP project itpc-gcp-hybrid-pe-eng-claude, region us-east5)
• Process step has a 2-hour timeout and 100 max Claude turns
• Git credential helper prevents token leakage in logs
• GitHub App tokens are refreshed before push/PR creation (originals expire during long processing)
• Best-effort: processes as many PRs as possible, reports failures in the consolidated PR body
• All commits include a body line to satisfy HyperShift's gitlint requirements

New Files

ci-operator/step-registry/hypershift/dependabot-triage/
├── OWNERS
├── hypershift-dependabot-triage-workflow.yaml
├── hypershift-dependabot-triage-workflow.metadata.json
├── process/
│   ├── OWNERS
│   ├── hypershift-dependabot-triage-process-commands.sh
│   ├── hypershift-dependabot-triage-process-ref.yaml
│   └── hypershift-dependabot-triage-process-ref.metadata.json
├── report/
│   ├── OWNERS
│   ├── hypershift-dependabot-triage-report-commands.sh
│   ├── hypershift-dependabot-triage-report-ref.yaml
│   └── hypershift-dependabot-triage-report-ref.metadata.json
└── setup/
    ├── OWNERS
    ├── hypershift-dependabot-triage-setup-commands.sh
    ├── hypershift-dependabot-triage-setup-ref.yaml
    └── hypershift-dependabot-triage-setup-ref.metadata.json
docs/plans/2026-01-21-dependabot-triage-prow-job-design.md

Test Plan

• Step-registry validation passes
• Prow config generation succeeds (make update)
• Rehearse job runs successfully (commit reorganization, gitlint detection, verify/test gating all working)
• First scheduled execution produces a valid consolidated PR

Related

• Jira: CNTRLPLANE-2588
• Based on patterns from the jira-agent periodic job