Add tls scanner 5.0/5.1 release jobs

[richardsonnick]

Summary by CodeRabbit

• New Features
  • Added release-specific TLS Scanner Presubmit pattern configuration for versions 5.0 and 5.1.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 0216cbab-edd4-4e20-acfc-0099f36aa84f

📥 Commits

Reviewing files that changed from the base of the PR and between 3839c92 and 78bd9ff.

📒 Files selected for processing (1)

• config/openshift-customizations.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

Walkthrough

The OpenShift customization configuration adds TLS Scanner Presubmit patterns for the 5.0 and 5.1 release streams.

Changes

TLS Scanner configuration

Layer / File(s)	Summary
Add release-specific TLS Scanner patterns config/openshift-customizations.yaml	Adds release entries for 5.0 and 5.1 that match their periodic TLS Scanner Prow job names.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 78bd9

This PR adds release-job configuration in one file. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: dustman9000, redhat-chai-bot, radekcap

🚥 Pre-merge checks | ✅ 21

✅ Passed checks (21 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	The PR changes only config/openshift-customizations.yaml by adding two regexp entries; it introduces no Go code, ignored errors, panics, dereferences, or error-wrapping changes.
Sql Injection Prevention	✅ Passed	The commit changes only YAML regex selectors and removes generated copies; no SQL query construction or user-input interpolation is introduced.
Excessive Css In React Should Use Styles	✅ Passed	The commit changes only two YAML files and adds release regex entries; no React components, inline style objects, or stylesheets are changed.
Test Coverage For New Features	✅ Passed	The diff changes only config/openshift-customizations.yaml. Repository documentation identifies it as a configuration overlay, which matches the explicit configuration-only exception.
Single Responsibility And Clear Naming	✅ Passed	The PR only adds two release-scoped regexp entries; it introduces no packages, structs, methods, generic names, or mixed-responsibility code.
Feature Documentation	✅ Passed	The PR changes only two release regexps in config/openshift-customizations.yaml; no docs/features page covers TLS Scanner, and documentation updates are explicitly not required.
Stable And Deterministic Test Names	✅ Passed	The complete PR diff changes only six YAML lines in config/openshift-customizations.yaml; it adds release regexp selectors and no Ginkgo test titles or dynamic values.
Test Structure And Quality	✅ Passed	The PR changes only six YAML regexp lines in config/openshift-customizations.yaml; the PR diff contains no Ginkgo tests or cluster operations to assess.
Microshift Test Compatibility	✅ Passed	The PR adds only two YAML regexp entries; the target-to-PR diff contains no Ginkgo tests, test paths, or MicroShift-incompatible API references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only config/openshift-customizations.yaml by adding TLS Scanner release regexps; it adds no Ginkgo tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff only adds release regex entries in config/openshift-customizations.yaml; it adds no deployment manifests, operator code, controllers, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only config/openshift-customizations.yaml by adding release regex entries; it introduces no process-level code or stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR only adds YAML regexp selectors for TLS Scanner release jobs; it adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR adds only TLS Scanner release-selection regexp entries; the diff contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison code.
Container-Privileges	✅ Passed	The diff only adds TLS Scanner release regexp entries and removes generated copies; it introduces no container or Kubernetes privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only two release job-name regex entries; config docs and types define them as matchers, with no logging calls or sensitive data introduced.
Title check	✅ Passed	The title clearly describes the addition of TLS Scanner release-specific configuration for versions 5.0 and 5.1.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: richardsonnick
Once this PR has been reviewed and has the lgtm label, please assign deepsm007 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

Scheduling required tests:
/test e2e

[openshift-ci]

@richardsonnick: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[redhat-chai-bot]

Hi — some folks from TRT reviewed this PR and have feedback on the approach.

Release association should use the job-release label, not Sippy regex overrides

The recommended way to associate periodic jobs with a release is documented here:
https://docs.ci.openshift.org/how-tos/naming-your-ci-jobs/#configuration-for-periodic-jobs

The key mechanism is the job-release label on the prowjob. Sippy (and Component Readiness, Feature Gate Analyzer, etc.) all use this label to determine which release a job belongs to. Adding hardcoded regex patterns to openshift-customizations.yaml bypasses that standard mechanism and should not be necessary.

The root problem: these jobs are missing the job-release label

I checked the generated prowjob YAML at ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-periodics.yaml and the job-release label is not present. For comparison, a properly configured periodic like cluster-control-plane-machine-set-operator has job-release: "4.19" in its labels.

Why the label is missing

The tls-scanner ci-operator config uses integration releases:

releases:
  latest:
    integration:
      name: "5.0"
      namespace: ocp

While jobs that correctly get the label use candidate (or prerelease) releases with an explicit version field:

releases:
  latest:
    candidate:
      product: ocp
      stream: nightly
      version: "4.19"

prowgen derives the job-release label from candidate/prerelease release types (which have an explicit version field), but does not appear to extract a version from the integration type.

Recommended fix

The fix should be in openshift/release, not in Sippy:

1. If possible, switch the tls-scanner ci-operator configs from integration to candidate releases — this would make prowgen automatically generate the job-release label.
2. If integration releases are specifically required for the tls-scanner workflow, a request should be filed against ci-tools to have prowgen derive job-release from integration.name.

The per-release __periodics.yaml variant files are already set up correctly (via openshift/release#83621) — what's missing is just the label generation.

Additional concern: testsuite structure

Beyond the release association, TRT also flagged a potential concern with the junit XML output from these jobs. It would be worth verifying that the testsuite name and test case naming conventions are compatible with how Sippy ingests and reports on test results.

---

This comment was posted on behalf of the TRT team from a Slack discussion.

---

AI-generated. Review for accuracy.