Exclude copilot/* branches from migtools branch protection#82189
Open
kaovilai wants to merge 1 commit into
Open
Exclude copilot/* branches from migtools branch protection#82189kaovilai wants to merge 1 commit into
kaovilai wants to merge 1 commit into
Conversation
Copilot-authored branches were subject to required reviews and enforce_admins like any other branch, blocking rebase/force-push on PRs such as migtools/kubevirt-datamover-controller#77. Add ^copilot/ to the exclude list alongside the existing revert/ dependabot/konflux exclusions across all 12 migtools repos. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Contributor
WalkthroughThe branch protection exclusion lists for twelve ChangesBranch protection exclusions
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
Contributor
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@core-services/prow/02_config/migtools/filebrowser/_prowconfig.yaml`:
- Line 12: Remove the ^copilot/ branch-name exclusions from the _prowconfig.yaml
files in core-services/prow/02_config/migtools/filebrowser, kopia,
kubevirt-datamover-controller, kubevirt-datamover-plugin,
kubevirt-velero-plugin, oadp-cli, oadp-non-admin, oadp-vm-file-restore,
oadp-vmdp, udistribution, velero-plugin-for-vsm, and volume-snapshot-mover (line
12 in each), or replace them with repository permission controls that identify
the authorized Copilot principal rather than branch names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: fa847e7b-3a4a-4193-8b57-6a8da76c3a28
📒 Files selected for processing (12)
core-services/prow/02_config/migtools/filebrowser/_prowconfig.yamlcore-services/prow/02_config/migtools/kopia/_prowconfig.yamlcore-services/prow/02_config/migtools/kubevirt-datamover-controller/_prowconfig.yamlcore-services/prow/02_config/migtools/kubevirt-datamover-plugin/_prowconfig.yamlcore-services/prow/02_config/migtools/kubevirt-velero-plugin/_prowconfig.yamlcore-services/prow/02_config/migtools/oadp-cli/_prowconfig.yamlcore-services/prow/02_config/migtools/oadp-non-admin/_prowconfig.yamlcore-services/prow/02_config/migtools/oadp-vm-file-restore/_prowconfig.yamlcore-services/prow/02_config/migtools/oadp-vmdp/_prowconfig.yamlcore-services/prow/02_config/migtools/udistribution/_prowconfig.yamlcore-services/prow/02_config/migtools/velero-plugin-for-vsm/_prowconfig.yamlcore-services/prow/02_config/migtools/volume-snapshot-mover/_prowconfig.yaml
| - ^dependabot/ | ||
| - ^konflux- | ||
| - ^konflux/ | ||
| - ^copilot/ |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not use a branch-name prefix as Copilot authentication.
These exclusions bypass the configured reviews and enforce_admins for any principal able to create or update a copilot/* branch; the pattern does not distinguish Copilot-authored branches from attacker- or developer-created branches.
core-services/prow/02_config/migtools/filebrowser/_prowconfig.yaml#L12-L12: restrict the namespace at the repository permission layer or remove this exclusion.core-services/prow/02_config/migtools/kopia/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/kubevirt-datamover-controller/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/kubevirt-datamover-plugin/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/kubevirt-velero-plugin/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/oadp-cli/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/oadp-non-admin/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/oadp-vm-file-restore/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/oadp-vmdp/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/udistribution/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/velero-plugin-for-vsm/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.core-services/prow/02_config/migtools/volume-snapshot-mover/_prowconfig.yaml#L12-L12: apply the same identity-based restriction.
📍 Affects 12 files
core-services/prow/02_config/migtools/filebrowser/_prowconfig.yaml#L12-L12(this comment)core-services/prow/02_config/migtools/kopia/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/kubevirt-datamover-controller/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/kubevirt-datamover-plugin/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/kubevirt-velero-plugin/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/oadp-cli/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/oadp-non-admin/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/oadp-vm-file-restore/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/oadp-vmdp/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/udistribution/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/velero-plugin-for-vsm/_prowconfig.yaml#L12-L12core-services/prow/02_config/migtools/volume-snapshot-mover/_prowconfig.yaml#L12-L12
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-services/prow/02_config/migtools/filebrowser/_prowconfig.yaml` at line
12, Remove the ^copilot/ branch-name exclusions from the _prowconfig.yaml files
in core-services/prow/02_config/migtools/filebrowser, kopia,
kubevirt-datamover-controller, kubevirt-datamover-plugin,
kubevirt-velero-plugin, oadp-cli, oadp-non-admin, oadp-vm-file-restore,
oadp-vmdp, udistribution, velero-plugin-for-vsm, and volume-snapshot-mover (line
12 in each), or replace them with repository permission controls that identify
the authorized Copilot principal rather than branch names.
Contributor
|
@kaovilai: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copilot-authored branches were subject to required PR reviews and
enforce_adminslike any other branch, since no exclude pattern matched them. This blocks rebase/force-push on Copilot-opened PRs, e.g. migtools/kubevirt-datamover-controller#77.Adds
^copilot/to the branch-protectionexcludelist alongside the existing^revert-,^dependabot/,^konflux-,^konflux/patterns, across all 12 migtools repos:Note
Responses generated with Claude
Summary by CodeRabbit
migtoolsrepositories to exclude branches matching^copilot/.