Add redhat-ai-dev/rhess jobs on aws-devfile profile

[johnmcollier]

Summary by CodeRabbit

This change adds/updates OpenShift CI configuration for the redhat-ai-dev/rhess repo to run on the aws-devfile profile. It introduces a new redhat-ai-dev-rhess-main CI configuration that builds and publishes the rhess image (for OpenShift 4.20), sets default job resource requests/limits, and adds an optional rhess-e2e workflow that provisions an AWS IPI cluster, sets BASE_DOMAIN=devfile-ci.com, installs the OpenShift client for 4.20, runs .ci/openshift_e2e.sh, and uses the built rhess image via RHESS_IMAGE.

It also updates repo governance/integration by adding an OWNERS file (defining approvers/reviewers) and a Prow plugin configuration that defines approve/lgtm policies and enables a trusted-app trigger for openshift-merge-bot.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 3b23685e-55b0-47ba-a295-d397c95274f4

📥 Commits

Reviewing files that changed from the base of the PR and between fcd766a and b66b239.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/redhat-ai-dev/rhess/OWNERS is excluded by !ci-operator/jobs/**
• ci-operator/jobs/redhat-ai-dev/rhess/redhat-ai-dev-rhess-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• core-services/prow/02_config/redhat-ai-dev/rhess/_pluginconfig.yaml

---

Walkthrough

Adds rhess ownership metadata, ci-operator build and test configuration, and Prow plugin settings for the repository.

Changes

rhess repository configuration

Layer / File(s)	Summary
Ownership and CI operator config ci-operator/config/redhat-ai-dev/rhess/OWNERS, ci-operator/config/redhat-ai-dev/rhess/redhat-ai-dev-rhess-main.yaml	Adds OWNERS entries, build image inputs and outputs, OpenShift 4.20 release integrations, default resource settings, the optional rhess-e2e test, and generated branch/org/repo metadata.
Prow plugin config core-services/prow/02_config/redhat-ai-dev/rhess/_pluginconfig.yaml	Adds approve and LGTM behavior, the enabled plugin allowlist, and trusted trigger settings for the repository.

Sequence Diagram(s)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	rhess-e2e curls oc from mirror.openshift.com, a public host, so it is not disconnected-network safe.	Use an internal/mirrored oc source or pre-baked image; if internet access is unavoidable, mark the test [Skipped:Disconnected].

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding rhess CI jobs that run on the aws-devfile profile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes OWNERS and CI/prow YAML config; no Ginkgo test code or titles were added or modified.
Test Structure And Quality	✅ Passed	PR only adds CI/Prow config and OWNERS files; no Ginkgo test code was changed, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only adds OWNERS and CI/plugin YAML; no new Ginkgo e2e tests or MicroShift-unsafe test code were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR only adds CI/prow config; it introduces no new Ginkgo e2e test code or SNO-sensitive assertions in repo.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI/OWNERS/plugin config changes were added; the new YAML has no affinity, nodeSelector, tolerations, topologySpreadConstraints, or replica logic.
Ote Binary Stdout Contract	✅ Passed	Only OWNERS and CI/prow YAML were added; no Go/test binary code or stdout-writing process setup changed, so the OTE stdout contract isn’t implicated.
No-Weak-Crypto	✅ Passed	The PR only adds config/OWNERS/plugin YAML; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	No changed file contains privileged:true, hostPID/Network/IPC, allowPrivilegeEscalation:true, or SYS_ADMIN; the new CI config has no securityContext fields.
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements or secret-bearing literals were added; the changes only add OWNERS, CI config, and plugin config with public repo names/domains.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johnmcollier

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[johnmcollier]

/pj-rehearse

[openshift-merge-bot]

@johnmcollier: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@johnmcollier: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-redhat-ai-dev-rhess-main-images	redhat-ai-dev/rhess	presubmit	Presubmit changed
pull-ci-redhat-ai-dev-rhess-main-rhess-e2e	redhat-ai-dev/rhess	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[johnmcollier]

/pj-rehearse

[openshift-merge-bot]

@johnmcollier: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@johnmcollier: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.