[redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled by openshift-cherrypick-robot · Pull Request #1304 · quay/quay-operator

openshift-cherrypick-robot · 2026-07-20T17:19:40Z

This is an automated cherry-pick of #1302

/assign bcaton85

…matic bootstrap is enabled When FEATURE_PROGRAMMATIC_BOOTSTRAP is true the Quay backend requires BOOTSTRAP_TOKEN_OWNER in the config to validate and renew bootstrap tokens. The operator passthrough config model preserves user-supplied keys but never verified their presence, so a missing or empty BOOTSTRAP_TOKEN_OWNER silently produced a config that broke token renewal at runtime (403 insufficient_scope). Add ValidateProgrammaticBootstrapConfig() in pkg/kustomize and call it from the controller reconcile loop before Inflate(). When the key is absent or invalid the operator now sets a RolloutBlocked / ConfigInvalid condition instead of rolling out a broken config. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-07-20T17:19:46Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

master

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 49e1d29b-f8d7-4936-8265-0636d0c7e1da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Note

`.coderabbit.yaml` has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "tools"

⚙️ Configuration instructions

Please see the configuration documentation for more information.
You can also validate your configuration using the online YAML validator.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-20T17:20:52Z

@openshift-cherrypick-robot: [Jira Issue PROJQUAY-12344](https://redhat.atlassian.net/browse/PROJQUAY-12344) has been cloned as [Jira Issue PROJQUAY-12349](https://redhat.atlassian.net/browse/PROJQUAY-12349). Will retitle bug to link to clone.
/retitle [redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled

Details

In response to this:

This is an automated cherry-pick of #1302

/assign bcaton85

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-07-20T17:21:00Z

@openshift-cherrypick-robot: This pull request references [Jira Issue PROJQUAY-12349](https://redhat.atlassian.net/browse/PROJQUAY-12349), which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected dependent [Jira Issue PROJQUAY-12344](https://redhat.atlassian.net/browse/PROJQUAY-12344) to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead
expected dependent [Jira Issue PROJQUAY-12344](https://redhat.atlassian.net/browse/PROJQUAY-12344) to target a version in quay-v3.18.0, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

This is an automated cherry-pick of #1302

/assign bcaton85

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-07-20T17:59:33Z

@openshift-cherrypick-robot: [Jira Issue PROJQUAY-12349](https://redhat.atlassian.net/browse/PROJQUAY-12349): All pull requests linked via external trackers have merged:

quay/quay-operator#1304

[Jira Issue PROJQUAY-12349](https://redhat.atlassian.net/browse/PROJQUAY-12349) has been moved to the MODIFIED state.

Details

In response to this:

This is an automated cherry-pick of #1302

/assign bcaton85

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

fullsend-ai-retro · 2026-07-20T18:01:46Z

🤖 Finished Retro · ✅ Success · Started 6:01 PM UTC · Completed 6:11 PM UTC
Commit: 930aa72 · View workflow run →

fullsend-ai-retro · 2026-07-20T18:11:56Z

PR #1304 is an automated cherry-pick of PR #1302 from master to redhat-3.18, created by openshift-cherrypick-robot. The code is identical to the already-retro'd PR #1302. bcaton85 approved within 1 minute and merged 40 minutes later. No review agent ran (hardcoded carve-out in dispatch.yml, tracked in quay/.fullsend#14). CodeRabbit skipped review on the non-default branch. The prior retro on PR #1302 completed at 17:30 UTC, filed issue #1305 (AGENTS.md format discrepancy), and the triage → code pipeline produced PR #1306 within 20 minutes — a healthy end-to-end cycle.

Existing issue evidence (not filed as proposals):

Retro agent should deduplicate proposals across related PRs (backports, cherry-picks) fullsend-ai/fullsend#3426 (retro should deduplicate across cherry-picks): This retro on PR [redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled #1304 is the third documented instance of redundant cherry-pick retros on quay-operator (previous: PR [redhat-3.18] PROJQUAY-12323: tls: separate TLS 1.3 ciphersuites from TLS 1.2 ciphers #1300 cherry-pick of PROJQUAY-12322: tls: separate TLS 1.3 ciphersuites from TLS 1.2 ciphers #1296, documented in fullsend#5180). The dispatch routes all pull_request_target/closed events to retro unconditionally. Cherry-pick detection (author=openshift-cherrypick-robot, body='automated cherry-pick of #N') would eliminate these.

New finding: The code agent's PR #1306 used PROJQUAY-12344 (a Jira ticket referenced contextually in issue #1305's body) as its PR title prefix. That ticket is about BOOTSTRAP_TOKEN_OWNER validation and is already in MODIFIED state. The Prow bot flagged the PR as jira/invalid-bug and applied needs-ok-to-test, blocking CI. The root cause is the code-implementation skill's step 10c instruction to extract Jira IDs from the issue body, which does not distinguish between the issue's own ticket and contextual references. One proposal filed to fullsend-ai/agents.

Proposals filed

Code-implementation skill extracts contextual Jira references from issue body, producing invalid PR titles (in fullsend-ai/agents)

openshift-ci Bot assigned bcaton85 Jul 20, 2026

openshift-cherrypick-robot mentioned this pull request Jul 20, 2026

PROJQUAY-12344: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled #1302

Merged

4 tasks

bcaton85 approved these changes Jul 20, 2026

View reviewed changes

openshift-ci Bot changed the title ~~[redhat-3.18] PROJQUAY-12344: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled~~ [redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled Jul 20, 2026

openshift-ci-robot added jira/valid-reference jira/invalid-bug labels Jul 20, 2026

bcaton85 merged commit 5b46c3e into quay:redhat-3.18 Jul 20, 2026
7 of 10 checks passed

fullsend-ai-retro Bot mentioned this pull request Jul 20, 2026

Code-implementation skill extracts contextual Jira references from issue body, producing invalid PR titles fullsend-ai/agents#306

Open

Navigation Menu

Uh oh!

[redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled - #1304

[redhat-3.18] PROJQUAY-12349: validate BOOTSTRAP_TOKEN_OWNER when programmatic bootstrap is enabled#1304
bcaton85 merged 1 commit into
quay:redhat-3.18from
openshift-cherrypick-robot:cherry-pick-1302-to-redhat-3.18

openshift-cherrypick-robot commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026

Review skipped

`.coderabbit.yaml` has unrecognized properties

Uh oh!

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

Uh oh!

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

fullsend-ai-retro Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-retro Bot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

openshift-cherrypick-robot commented Jul 20, 2026

Uh oh!

coderabbitai Bot commented Jul 20, 2026

Review skipped

.coderabbit.yaml has unrecognized properties

Uh oh!

openshift-ci-robot commented Jul 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jul 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

openshift-ci-robot commented Jul 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jul 20, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposals filed

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

`.coderabbit.yaml` has unrecognized properties

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading

fullsend-ai-retro Bot commented Jul 20, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Jul 20, 2026 •

edited by openshift-ci Bot

Loading