From 88eebfd45e8e5cd3fdbc0920c9905607127b5a2f Mon Sep 17 00:00:00 2001
From: Stephen Benjamin <stbenjam+ai@redhat.com>
Date: Fri, 26 Jun 2026 10:01:33 -0400
Subject: [PATCH] Add payload-agent presubmit to openshift-eng/ai-helpers

Add an optional, always-run-false presubmit that runs the same
payload analysis workflow as the existing periodic. Triggerable
via `/test payload-agent` on openshift-eng/ai-helpers PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../openshift-eng-ai-helpers-main.yaml        |  7 ++
 ...nshift-eng-ai-helpers-main-presubmits.yaml | 75 +++++++++++++++++++
 2 files changed, 82 insertions(+)

diff --git a/ci-operator/config/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main.yaml b/ci-operator/config/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main.yaml
index 42d5d91556a27..bb8b75cd0df29 100644
--- a/ci-operator/config/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main.yaml
+++ b/ci-operator/config/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main.yaml
@@ -20,6 +20,13 @@ resources:
       cpu: "1"
       memory: 2Gi
 tests:
+- always_run: false
+  as: payload-agent
+  optional: true
+  steps:
+    env:
+      PAYLOAD_TAG: ""
+    workflow: openshift-claude-payload
 - always_run: false
   as: eval-payload-analysis
   optional: true
diff --git a/ci-operator/jobs/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main-presubmits.yaml b/ci-operator/jobs/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main-presubmits.yaml
index 983dfb2721995..aeb6647f01db6 100644
--- a/ci-operator/jobs/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift-eng/ai-helpers/openshift-eng-ai-helpers-main-presubmits.yaml
@@ -432,3 +432,78 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build13
+    context: ci/prow/payload-agent
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - images/Dockerfile
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-eng-ai-helpers-main-payload-agent
+    optional: true
+    rerun_command: /test payload-agent
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=payload-agent
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )payload-agent,?($|\s.*)