OSPRH-32280: Add branch protection for shiftstack/shiftstack-qa

[imatza-rh]

Configure Prow branchprotector to protect the main branch of shiftstack/shiftstack-qa:

• protect: true — prevents direct pushes to main
• ansible-lint as required status check — CI must pass before merge

Pattern: Follows backube/pvc-transfer _prowconfig.yaml — same setup (external org, no ci-operator jobs, branch protection via branchprotector).

Context: Part of Prow onboarding for shiftstack-qa. Prow plugin + Tide config already merged (#81862). This adds the branch protection layer.

Jira: OSPRH-32280

Summary by CodeRabbit

• Adds Prow branch protection for shiftstack/shiftstack-qa’s main branch.
• Prevents direct pushes and requires the ansible-lint status check before merging.

[openshift-ci-robot]

@imatza-rh: This pull request references OSPRH-32280 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Configure Prow branchprotector to protect the main branch of shiftstack/shiftstack-qa:

• protect: true — prevents direct pushes to main
• ansible-lint as required status check — CI must pass before merge

Pattern: Follows backube/pvc-transfer _prowconfig.yaml — same setup (external org, no ci-operator jobs, branch protection via branchprotector).

Context: Part of Prow onboarding for shiftstack-qa. Prow plugin + Tide config already merged (#81862). This adds the branch protection layer.

Jira: OSPRH-32280

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Walkthrough

The Prow configuration for shiftstack/shiftstack-qa now protects the main branch and requires the ansible-lint status check.

Changes

Shiftstack QA branch protection

Layer / File(s)	Summary
Configure main branch protection core-services/prow/02_config/shiftstack/shiftstack-qa/_prowconfig.yaml	Adds branch protection for main with ansible-lint as a required status check.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/release#81862: Updates the same repository configuration with Tide label rules.
• openshift/release#81910: Adds related Prow branch-protection rules and required status checks.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes a Prow YAML config file; no Ginkgo tests or titles were added or modified.
Test Structure And Quality	✅ Passed	Only a Prow config YAML changed; no Ginkgo test code or test patterns were modified.
Microshift Test Compatibility	✅ Passed	Only a prowconfig YAML changed; no new Ginkgo e2e tests or MicroShift-incompatible APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a Prow YAML config changed; no new Ginkgo e2e tests were added, so SNO compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Prow branch-protection config changed; no deployment manifests, operators, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	PR only edits Prow YAML branch-protection config; no OTE binary code or stdout-writing process hooks are changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only changes prow branch-protection YAML; no new Ginkgo e2e tests or network-sensitive code were added.
No-Weak-Crypto	✅ Passed	The patch only adds Prow branch-protection YAML for shiftstack-qa; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto/comparison code appears.
Container-Privileges	✅ Passed	The only changed file is a Prow config adding branch protection/Tide; it contains no privileged, hostPID/Network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The only added content is Prow branch-protection YAML; it contains no logs, secrets, tokens, PII, or host/customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the primary change: adding branch protection for shiftstack/shiftstack-qa.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: imatza-rh
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/shiftstack/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@imatza-rh: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

@imatza-rh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[imatza-rh]

Closing - branch protection via branchprotector not needed. Prow plugin + Tide + require_self_approval: true (PR #81991) is sufficient.