OKD-422: Enable Claude payload analysis for OKD SCOS 5.0 CI stream

[pskrbasu]

Summary

• Add claude-payload-agent verification to release-okd-scos-5.0-ci.json for the 5.0.0-0.okd-scos stream
• Uses the existing periodic-ci-openshift-release-main-claude-payload-agent-okd-scos-no-slack prow job (no new jobs needed)

Context

Extends #80392 which enabled Claude payload analysis for OKD SCOS 4.22 nightly/CI and 5.0 nightly streams. This adds the 5.0 CI stream.

Stable/next streams (4-scos-stable, 5-scos-next) are intentionally excluded — those streams only contain already-accepted payloads, so there's nothing to triage.

Supersedes #82785.

Test plan

• Verify JSON is valid
• Verify API URL resolves: https://amd64.origin.releases.ci.openshift.org/api/v1/releasestream/5.0.0-0.okd-scos/tags
• No script changes, no new prow jobs — zero risk to existing OCP streams

Summary by CodeRabbit

• Adds optional asynchronous claude-payload-agent verification to the OKD SCOS 5.0 release CI configuration.
• Enables multi-job payload analysis for the affected release stream.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f9ba8c8e-8bc9-46e6-b172-5b4686363945

📥 Commits

Reviewing files that changed from the base of the PR and between 1ddcc1d and 079791f.

📒 Files selected for processing (1)

• core-services/release-controller/_releases/release-okd-scos-5.0-ci.json

🚧 Files skipped from review as they are similar to previous changes (1)

• core-services/release-controller/_releases/release-okd-scos-5.0-ci.json

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The OKD SCOS 5.0 release configuration adds an optional asynchronous claude-payload-agent verification job. The job supports multi-job analysis through a specified Prow job.

Changes

OKD SCOS payload verification

Layer / File(s)	Summary
Optional verification configuration core-services/release-controller/_releases/release-okd-scos-5.0-ci.json	The release configuration enables asynchronous claude-payload-agent verification and multi-job analysis through the specified Prow job.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 07979

This localized change adds Claude payload verification to the OKD SCOS 5.0 CI stream without changing scripts or existing jobs; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: dgoodwin, jupierce

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff changes only one JSON release configuration and adds a static Prow job name; it introduces no Ginkgo test title or dynamic test-name value.
Test Structure And Quality	✅ Passed	The pull request changes only one JSON release configuration file; it adds no Ginkgo tests or cluster operations, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	The commit changes only one release-controller JSON file by adding a Prow verification job; it adds no Ginkgo e2e tests or test API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The commit changes only one release JSON configuration file and adds no Ginkgo e2e tests, so SNO test compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only one release JSON entry, adding an optional Prow job reference; it adds no deployment manifest, operator code, or topology-sensitive scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The PR changes only one JSON release configuration and adds no OTE binary, suite setup, or process-level stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch changes one JSON release configuration and adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The PR diff adds only release-controller JSON for an optional Prow job; it introduces no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The commit changes only a release-controller JSON entry; it adds no privilege fields, and the referenced existing Prow job block has no custom-check privilege keys.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds a verification-job reference; it adds no logging or sensitive values. The referenced no-Slack job pre-existed and logs status metadata, not credentials.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes enabling Claude payload analysis for the OKD SCOS 5.0 CI stream, although the changes also cover stable and next streams.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@pskrbasu: This pull request references OKD-422 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

• Add claude-payload-agent verification to release controller configs for three OKD SCOS streams:
• 5.0.0-0.okd-scos (CI) — uses existing ...-okd-scos-no-slack prow job
• 4-scos-stable — uses new ...-okd-scos-stable-no-slack prow job
• 5-scos-next — uses new ...-okd-scos-next-no-slack prow job
• Add RELEASE_STREAM env var to step ref and shell script for stable/next streams where the stream name cannot be derived from the payload tag
• Create two new prow jobs that hardcode RELEASE_STREAM for stable/next
• Pass --release-stream to payload_snapshot.py when RELEASE_STREAM is set

Why new prow jobs for stable/next

The release controller only injects PAYLOAD_TAG into verification jobs — not the stream name. Nightly/CI tags contain a timestamp suffix that can be stripped to get the stream name (e.g. 5.0.0-0.okd-scos-2026-08-18-065629 → 5.0.0-0.okd-scos). Stable/next tags use semver-style formats (4.22.0-okd-scos.7, 5.0.0-okd-scos.ec.7) that cannot be mapped back to the aggregate stream name (4-scos-stable, 5-scos-next). Dedicated prow jobs hardcode RELEASE_STREAM in the UNRESOLVED_CONFIG.

Dependencies

Depends on openshift-eng/ai-helpers#710 — that PR adds --release-stream support to payload_snapshot.py and must be merged and released first.

Supersedes #82785 which used the generic prow job for stable/next (would have failed at runtime without the RELEASE_STREAM override).

Extends #80392 which enabled Claude payload analysis for OKD SCOS 4.22 nightly/CI and 5.0 nightly.

Test plan

• Verify API URLs resolve for all three streams (tested live: 5.0.0-0.okd-scos, 4-scos-stable, 5-scos-next)
• Verify no regression for existing OCP streams (RELEASE_STREAM defaults to empty, existing code path unchanged)
• Verify no regression for existing OKD SCOS nightly/CI streams (4.22, 5.0)
• Verify JSON validity of all modified release controller configs
• Verify prow job names are in alphabetical order

Summary by CodeRabbit

• Enables claude-payload-agent verification for the OKD SCOS 5.0.0-0.okd-scos, 4-scos-stable, and 5-scos-next release streams.
• Adds RELEASE_STREAM support and passes the resolved stream to payload_snapshot.py.
• Adds dedicated no-Slack Prow jobs for the stable and next streams.
• Updates release-controller configurations to run the verification jobs asynchronously with multi-job analysis.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@pskrbasu: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: pskrbasu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/release-controller/_releases/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@pskrbasu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.