chore(ci): manual nightly job trigger (Bash script and AI command) - #4355
Merged
openshift-merge-bot[bot] merged 7 commits intoMar 9, 2026
Merged
Conversation
zdrapela
changed the title
rm3l
approved these changes
Mar 4, 2026
rm3l
left a comment
rm3l
left a comment
Member
There was a problem hiding this comment.
/hold
Looks good, but on hold per this in the description:
To be merged after openshift/release#75596 and testing with actual parameter overrides is needed.
Member
Author
|
/agentic_review |
Member
Author
|
/agentic_describe |
Code Review by Qodo
1. Claude allowlist too strict
|
Review Summary by QodoAdd nightly job trigger script and AI commands for OpenShift CI
WalkthroughsDescription• Add bash script for triggering RHDH nightly ProwJobs via OpenShift CI Gangway REST API • Support parameter overrides for custom images, GitHub forks, and branches • Add AI commands for Claude, Cursor, and RuleSync to trigger jobs with natural language • Include job selection, image tag fetching, and shared cluster constraint validation File Changes1. .ibm/pipelines/trigger-nightly-job.sh
|
Member
Author
|
/agentic_describe |
Member
Author
|
/agentic_review |
Review Summary by QodoAdd nightly job trigger script and AI commands for OpenShift CI
WalkthroughsDescription• Add bash script to trigger RHDH nightly ProwJobs via OpenShift CI Gangway REST API • Support parameter overrides for custom images, GitHub forks, and branches • Add AI commands for natural language job selection and execution • Include dry-run mode and job status polling capabilities File Changes1. .ibm/pipelines/trigger-nightly-job.sh
|
|
Persistent review updated to latest commit b6c89b9 |
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
+1
to
+7
| { | ||
| "permissions": { | ||
| "allow": [ | ||
| "Bash(curl -s 'https://prow.ci.openshift.org/configured-jobs/redhat-developer/rhdh')", | ||
| "Bash(curl -s 'https://quay.io/api/v1/repository/rhdh/rhdh-hub-rhel9/tag/?limit=20&onlyActiveTags=true&filter_tag_name=like:1.')" | ||
| ] | ||
| } |
There was a problem hiding this comment.
1. Claude allowlist blocks command 🐞 Bug ⛯ Reliability
.claude/settings.json only allows raw curl calls, but the Claude command requires piped commands (grep/sed/sort/jq/tail) and executing .ibm/pipelines/trigger-nightly-job.sh. In an allowlist-enforced environment, the command will be unable to fetch jobs/tags or trigger the job at all.
Agent Prompt
### Issue description
The Claude command workflow cannot execute as written because `.claude/settings.json` allowlists only two plain `curl` commands, while the command definition requires additional shell utilities (`grep`, `sed`, `sort`, `jq`, `tail`) and executing `.ibm/pipelines/trigger-nightly-job.sh`.
### Issue Context
Claude will be blocked from performing the required steps under an exact-command allowlist model.
### Fix Focus Areas
- .claude/settings.json[1-7]
- .claude/commands/trigger-nightly-job.md[19-23]
- .claude/commands/trigger-nightly-job.md[88-90]
- .claude/commands/trigger-nightly-job.md[117-126]
### Suggested direction
- Add allowlist entries for the **full piped commands** exactly as documented (or refactor docs to match allowlisted commands).
- Decide whether Claude is expected to execute the trigger script; if yes, add an allow entry for `Bash(.ibm/pipelines/trigger-nightly-job.sh ...)` (potentially with constrained patterns), otherwise adjust the command to only print the final command for the user to run manually.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+1
to
+6
| { | ||
| "permissions": { | ||
| "allow": [ | ||
| "Bash(curl -s 'https://prow.ci.openshift.org/configured-jobs/redhat-developer/rhdh')", | ||
| "Bash(curl -s 'https://quay.io/api/v1/repository/rhdh/rhdh-hub-rhel9/tag/?limit=20&onlyActiveTags=true&filter_tag_name=like:1.')" | ||
| ] |
There was a problem hiding this comment.
1. Claude allowlist too strict 🐞 Bug ⛯ Reliability
.claude/settings.json only allows bare curl invocations, but the Claude command requires piped commands using grep/sed/sort/jq/tail, so the assistant is likely blocked from performing Step 1/Tag fetch as written.
Agent Prompt
## Issue description
The Claude command prompt requires executing piped shell pipelines, but Claude permissions only allow curl-only commands. This will likely block the command from functioning.
## Issue Context
- `.claude/settings.json` allowlist entries are curl-only.
- `.claude/commands/trigger-nightly-job.md` instructs `curl | grep | sed | sort` and `curl | jq | sort | tail`.
## Fix Focus Areas
- .claude/settings.json[1-7]
- .claude/commands/trigger-nightly-job.md[17-24]
- .claude/commands/trigger-nightly-job.md[84-91]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+186
to
+189
| if [[ -n "${QUAY_REPO}" && -z "${TAG_NAME}" ]]; then | ||
| log::error "--quay-repo requires --tag to be set." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
2. Tag/repo flags inconsistent 🐞 Bug ✓ Correctness
The script help says --tag requires --quay-repo, but validation only enforces the opposite direction (--quay-repo requires --tag), allowing --tag alone and contradicting the documented usage.
Agent Prompt
## Issue description
`--tag` is documented as requiring `--quay-repo`, but the script only errors when `--quay-repo` is provided without `--tag`. This allows a `--tag`-only invocation that contradicts the script’s help text and the AI prompt.
## Issue Context
This is a UX/correctness issue in `validate_args()`.
## Fix Focus Areas
- .ibm/pipelines/trigger-nightly-job.sh[71-77]
- .ibm/pipelines/trigger-nightly-job.sh[174-190]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
zdrapela
force-pushed
the
ocp-ci-rest-trigger
branch
from
March 9, 2026 15:34
b6c89b9 to
f8548eb
Compare
Contributor
|
The container image build workflow finished with status: |
zdrapela
force-pushed
the
ocp-ci-rest-trigger
branch
from
March 9, 2026 15:48
908ab26 to
ff88b72
Compare
Member
Author
|
/unhold |
Contributor
|
The container image build workflow finished with status: |
|
rm3l
approved these changes
Mar 9, 2026
openshift-merge-bot
Bot
merged commit Mar 9, 2026
d82cc45
into
redhat-developer:main
18 checks passed
|
@zdrapela: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
zdrapela
changed the title
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
To be merged after openshift/release#75596 and testing with actual parameter overrides is needed.
This PR adds a script to allow easy manual triggering of nightly jobs. This is useful, for example, to verify an RC build or to trigger a job against your own fork of the repository.
Also, add an AI command to trigger job(s) using natural language. This helps with selecting the job name and image by fetching from what's available, and ask user follow-up questions about sending a Slack alert and using their own fork of the repository (for testing purposes).
Docs:
Which issue(s) does this PR fix
PR acceptance criteria
Please make sure that the following steps are complete:
How to test changes / Special notes to the reviewer