Skip to content

CNTRLPLANE-3757: review-agent: use agentic-ci run like jira-agent - #81394

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
enxebre:review-agent-ci-agent
Jul 2, 2026
Merged

CNTRLPLANE-3757: review-agent: use agentic-ci run like jira-agent#81394
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
enxebre:review-agent-ci-agent

Conversation

@enxebre

@enxebre enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member

Summary

  • Switches the review-agent from direct claude -p invocation to agentic-ci run via a run_claude wrapper, matching the jira-agent pattern.
  • Installs the prow-agent@ai-helpers plugin for CI integration.
  • Adds OTEL telemetry collection, BigQuery autodl generation, and session metrics extraction.
  • Adds conversation transcript HTML report (same as jira-agent) with link from the summary report.
  • Autodl table: address_review_agent, agent field: address-review.

Note: Last commit temporarily defaults REVIEW_AGENT_TARGET_PR to PR 8906 for rehearsal — will be reverted before merge.

Test plan

🤖 Generated with Claude Code

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 2, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

@enxebre: This pull request references CNTRLPLANE-3757 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Switches the review-agent from direct claude -p invocation to agentic-ci run via a run_claude wrapper, matching the jira-agent pattern.
  • Installs the prow-agent@ai-helpers plugin for CI integration.
  • Adds OTEL telemetry collection, BigQuery autodl generation, and session metrics extraction.
  • Replaces the DISALLOWED_TOOLS array with a SECURITY_PROMPT approach (consistent with jira-agent).

Test plan

  • Trigger the review-agent periodic via gangway and confirm agentic-ci run executes successfully
  • Verify OTEL JSONL and autodl artifacts are produced in the artifact directory

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

The review-agent process script now runs Claude through an agentic-ci wrapper, extracts session telemetry, writes autodl and transcript artifacts, and the report step links to the transcript.

Changes

HyperShift review agent flow

Layer / File(s) Summary
Setup and Claude wrapper
ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh
Adds the Claude plugin install step, a security prompt, and the agentic-ci-based wrapper that runs Claude and merges OTEL logs.
Session metrics and autodl
ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh
Adds session metrics extraction, session id lookup from stream-json, and autodl artifact generation after the review run.
Transcript HTML and report link
ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh, ci-operator/step-registry/hypershift/review-agent/report/hypershift-review-agent-report-commands.sh
Generates review-agent-transcript.html and adds a link to it in the report HTML.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Script
  participant agentic-ci
  participant Claude
  participant extract_metrics.py
  participant ARTIFACT_DIR

  Script->>agentic-ci: run_claude(review, prompt, tool lists)
  agentic-ci->>Claude: execute review skill
  Claude-->>agentic-ci: stream-json output
  agentic-ci-->>Script: exit status
  Script->>extract_metrics.py: convert OTEL JSONL to metrics
  Script->>ARTIFACT_DIR: write autodl JSON and transcript HTML
Loading

Possibly related PRs

  • openshift/release#81346: Introduces the same agentic-ci Claude wrapper pattern with session metrics extraction, session id derivation, and autodl generation for another HyperShift agent.
  • openshift/release#81362: Adds the same conversation transcript HTML flow for a different HyperShift agent review/report path.

Suggested reviewers: celebdor, csrwng


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
No-Sensitive-Data-In-Logs ❌ Error The PR logs raw assistant text/tool results and copies stream-json to artifacts, which can expose secrets, session IDs, hostnames, or PII. Redact or omit sensitive fields before logging; avoid archiving raw stream-json/transcript content, or filter tool results/errors through a sanitizer.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: review-agent now uses agentic-ci run like jira-agent.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only shell scripts changed; exact search found no Ginkgo test constructors or test titles, so no unstable test names were introduced.
Test Structure And Quality ✅ Passed No Ginkgo test files or Go tests were changed; the PR only touches shell/YAML CI config, so this check is not applicable.
Microshift Test Compatibility ✅ Passed Only shell/report scripts changed; no new Ginkgo tests or MicroShift-unsupported OpenShift APIs were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes review-agent shell/YAML step-registry files, so SNO compatibility is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed Only CI shell scripts changed; no node selectors, affinities, replicas, PDBs, or control-plane/worker topology assumptions were introduced.
Ote Binary Stdout Contract ✅ Passed No OTE binary main/TestMain/suite code changed; the PR only updates ci-operator shell scripts, so the JSON-on-stdout contract isn't implicated.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the PR only changes CI shell/report scripts, so the IPv6/disconnected-network test check is not applicable.
No-Weak-Crypto ✅ Passed No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons were added; the only crypto use is RS256/SHA-256 JWT signing.
Container-Privileges ✅ Passed Only two shell scripts changed; no manifest/K8s privilege settings (privileged, hostPID/Network/IPC, SYS_ADMIN, allowPrivilegeEscalation, root) were added.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from bryan-cox and csrwng July 2, 2026 12:14
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 2, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh (1)

161-174: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Guard the agentic-ci pipeline before PIPESTATUS is clobbered.
With set -euo pipefail, a non-zero agentic-ci run or empty grep match can exit run_claude before cleanup runs. Snapshot PIPESTATUS immediately after the pipeline and before any local assignment; the proposed local rc=... / local grep_rc=... sequence won’t work because the first local overwrites PIPESTATUS.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh`
around lines 161 - 174, The pipeline in run_claude is reading PIPESTATUS too
late, so the exit codes can be lost or cleanup can be skipped under set -euo
pipefail. Capture both the agentic-ci run and grep statuses immediately after
the pipeline and before any local assignment, using the existing run_claude
pipeline and PIPESTATUS as the reference points, then decide success/failure
from those saved values without introducing a local statement that overwrites
PIPESTATUS.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh`:
- Around line 400-421: The transcript rendering in render_blocks() is writing
raw tool_result content into the HTML artifact, which can expose sensitive
command output. Update the tool-result handling path in the transcript-building
logic to redact or strip sensitive values before they reach html.escape(), or
skip emitting raw tool_result bodies altogether. Keep the existing
assistant/tool_use rendering, but ensure any content appended as tool_result
from m.get("tool_use_result") is sanitized first.

---

Outside diff comments:
In
`@ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh`:
- Around line 161-174: The pipeline in run_claude is reading PIPESTATUS too
late, so the exit codes can be lost or cleanup can be skipped under set -euo
pipefail. Capture both the agentic-ci run and grep statuses immediately after
the pipeline and before any local assignment, using the existing run_claude
pipeline and PIPESTATUS as the reference points, then decide success/failure
from those saved values without introducing a local statement that overwrites
PIPESTATUS.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 34d2cd33-702b-4d92-933b-9d380a89f53b

📥 Commits

Reviewing files that changed from the base of the PR and between 818ec45 and 42f253d.

📒 Files selected for processing (1)
  • ci-operator/step-registry/hypershift/review-agent/process/hypershift-review-agent-process-commands.sh

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse help

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse pull-ci-openshift-hypershift-main-address-review-comments

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: job(s): help either don't exist or were not found to be affected, and cannot be rehearsed

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: job(s): pull-ci-openshift-hypershift-main-address-review-comments either don't exist or were not found to be affected, and cannot be rehearsed

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-periodic-review-agent

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-periodic-review-agent

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse periodic-ci-openshift-hypershift-main-periodic-review-agent

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Switch the review-agent from direct claude invocation to agentic-ci run,
matching the jira-agent pattern:
- Install prow-agent plugin for CI integration
- Use agentic-ci run wrapper for native OTEL telemetry collection
- Add BigQuery autodl generation (table: address_review_agent)
- Add session metrics extraction from OTEL data
- Add conversation transcript HTML report
- Link transcript from summary report
- Keep DISALLOWED_TOOLS for credential protection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@enxebre
enxebre force-pushed the review-agent-ci-agent branch from 75abc9f to 101d490 Compare July 2, 2026 14:47
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added rehearsals-ack Signifies that rehearsal jobs have been acknowledged and removed rehearsals-ack Signifies that rehearsal jobs have been acknowledged labels Jul 2, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@enxebre: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-hypershift-main-periodic-review-agent N/A periodic Registry content changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@muraee

muraee commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 2, 2026
@openshift-ci

openshift-ci Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

@enxebre: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@enxebre

enxebre commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@enxebre: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 2, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit dfedbc9 into openshift:main Jul 2, 2026
10 checks passed
smulje pushed a commit to smulje/release that referenced this pull request Jul 9, 2026
…rt (openshift#81394)

Switch the review-agent from direct claude invocation to agentic-ci run,
matching the jira-agent pattern:
- Install prow-agent plugin for CI integration
- Use agentic-ci run wrapper for native OTEL telemetry collection
- Add BigQuery autodl generation (table: address_review_agent)
- Add session metrics extraction from OTEL data
- Add conversation transcript HTML report
- Link transcript from summary report
- Keep DISALLOWED_TOOLS for credential protection

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
SachinNinganure pushed a commit to SachinNinganure/release that referenced this pull request Jul 20, 2026
…rt (openshift#81394)

Switch the review-agent from direct claude invocation to agentic-ci run,
matching the jira-agent pattern:
- Install prow-agent plugin for CI integration
- Use agentic-ci run wrapper for native OTEL telemetry collection
- Add BigQuery autodl generation (table: address_review_agent)
- Add session metrics extraction from OTEL data
- Add conversation transcript HTML report
- Link transcript from summary report
- Keep DISALLOWED_TOOLS for credential protection

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
amogh-redhat pushed a commit to amogh-redhat/release that referenced this pull request Aug 5, 2026
…rt (openshift#81394)

Switch the review-agent from direct claude invocation to agentic-ci run,
matching the jira-agent pattern:
- Install prow-agent plugin for CI integration
- Use agentic-ci run wrapper for native OTEL telemetry collection
- Add BigQuery autodl generation (table: address_review_agent)
- Add session metrics extraction from OTEL data
- Add conversation transcript HTML report
- Link transcript from summary report
- Keep DISALLOWED_TOOLS for credential protection

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
TimurMP pushed a commit to TimurMP/release that referenced this pull request Sep 5, 2026
…rt (openshift#81394)

Switch the review-agent from direct claude invocation to agentic-ci run,
matching the jira-agent pattern:
- Install prow-agent plugin for CI integration
- Use agentic-ci run wrapper for native OTEL telemetry collection
- Add BigQuery autodl generation (table: address_review_agent)
- Add session metrics extraction from OTEL data
- Add conversation transcript HTML report
- Link transcript from summary report
- Keep DISALLOWED_TOOLS for credential protection

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants