shiftstack-qa: Require separate approver for PR merges

[imatza-rh]

Change require_self_approval from false to true for shiftstack/shiftstack-qa.

Problem: With require_self_approval: false, PR authors who are in openstack-approvers get auto-approved. A single /lgtm from any reviewer then triggers Tide to merge immediately - before other reviewers have time to look at the code. PR #24 was merged this way with only one review.

Fix: require_self_approval: true means the author's implicit approval doesn't count. A different member of openstack-approvers must explicitly /approve before Tide merges.

Note: This intentionally diverges from the other shiftstack repos (shiftstack-ci, ci, ghira, merge-bot, prune, bugwatcher) which all use require_self_approval: false. shiftstack-qa is an Ansible automation framework where changes have direct CI impact, so we want stricter review controls.

Merge flow after this change:

1. Author opens PR
2. Reviewer (from openstack-reviewers): /lgtm
3. Approver (from openstack-approvers, NOT the author): /approve
4. CI passes → Tide merges

Jira: OSPRH-32280

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Walkthrough

The shiftstack/shiftstack-qa plugin configuration now requires self-approval by setting require_self_approval to true.

Changes

Self-approval configuration

Layer / File(s)	Summary
Enable required self-approval core-services/prow/02_config/shiftstack/shiftstack-qa/_pluginconfig.yaml	Changes require_self_approval from false to true for shiftstack/shiftstack-qa.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/release#81862: Configures the same plugin setting for shiftstack/shiftstack-qa.

Suggested labels: lgtm, approved, jira/valid-reference

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo tests were changed; the PR only updates a YAML plugin config flag, so there are no test titles to evaluate.
Test Structure And Quality	✅ Passed	Only a Prow plugin config YAML changed; no Ginkgo tests were added or modified, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only a Prow plugin config changed; no Ginkgo/e2e tests were added or modified, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only changes a prow plugin YAML; no Ginkgo e2e tests were added or modified, so SNO compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The only change is a prow plugin config boolean; no deployment manifests, controllers, or scheduling/topology logic were added.
Ote Binary Stdout Contract	✅ Passed	Only the pluginconfig YAML changed; no process-level code, suite setup, or stdout-writing paths were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only a prow plugin config changed; no Ginkgo e2e tests or network/IP-sensitive code was added or modified.
No-Weak-Crypto	✅ Passed	PASS: The only touched file is a Prow YAML config changing require_self_approval; it contains no crypto primitives, secret comparisons, or custom crypto.
Container-Privileges	✅ Passed	The only change is a prow approve setting in a plugin config; no container/K8s manifests or privilege flags were added.
No-Sensitive-Data-In-Logs	✅ Passed	Only a config toggle in _pluginconfig.yaml; no logging code or sensitive-data keywords were present.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: requiring a separate approver for shiftstack-qa PR merges.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@imatza-rh: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[openshift-ci]

@imatza-rh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gryf]

require_self_approval - that's not what I'd expect to be changed to make PR author be able to approve…

[gryf]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gryf, imatza-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/prow/02_config/shiftstack/OWNERS [gryf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment