ART-23401: Add release streams for the art23398 assembly

[locriandev]

Add four lightweight Release Controller configs for the OCP 5.0 art23398 assembly, defined in ocp-build-data's openshift-5.0 releases.yml, and wire its source imagestreams through hack/annotate.sh.

The definition has type: stream and basis.assembly: stream, but the assembly's name is art23398, not the literal stream. Consequently, doozer release:gen-payload creates assembly-specific imagestreams. build-sync invokes it with the selected assembly and does not override the imagestream name.

Namespace	Source imagestream
ocp	5.0-art-assembly-art23398
ocp-arm64	5.0-art-assembly-art23398-arm64
ocp-ppc64le	5.0-art-assembly-art23398-ppc64le
ocp-s390x	5.0-art-assembly-art23398-s390x

The streams use unique 5.0.0-0.nightly-art23398[-<arch>] names and matching assembly-specific mirror prefixes, with empty verification, periodic, and publish sections for this playground. The release-konflux-ocp-* filenames keep these public streams out of automatic private-config generation.

Merge once the assembly imagestreams are complete (ART-23400, ART-23402). The existing annotation postsubmit applies the configs after merge.

Validation:

• Shell syntax, JSON formatting, and Git whitespace checks passed.
• Resolved the actual art23398 definition and assembly type from ocp-build-data, then derived all four expected source names with Doozer's assembly_imagestream_base_name_generic() and payload_imagestream_namespace_and_name() helpers. Running hack/annotate.sh with a mocked oc matched those outputs, mirror prefixes, nightly names, and destination streams.
• hack/validate-release-controller-config.sh . passed, including generated-config and job-reference validation.
• Release-controller config and qualifier schema validation passed using a local build at fd4dbc53.
• make format is unavailable in this repository; JSON formatting was checked with jq.

Jira: ART-23401.

Summary by CodeRabbit

Adds Release Controller configurations for the OCP 5.0 konflux-rhcos assembly streams across ocp, ocp-arm64, ocp-ppc64le, and ocp-s390x.

Updates hack/annotate.sh to map build-sync imagestreams to the art23398 assembly and payload configuration. Each stream uses unique names and mirror prefixes.

Validation checks passed for formatting, annotations, Release Controller configuration, job references, and schemas.

[openshift-ci-robot]

@locriandev: This pull request references ART-23401 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Release Controller has no configuration for the OCP 5.0 konflux-rhcos assembly streams. Add four release configs and map 5.0-konflux-rhcos and its architecture-specific variants in ocp, ocp-arm64, ocp-ppc64le, and ocp-s390x through hack/annotate.sh.

The streams use unique 5.0.0-0.nightly-konflux-rhcos[-<arch>] names and mirror prefixes, with empty verification, periodic, and publish sections for this playground. The release-konflux-ocp-* filenames keep these public streams out of automatic private-config generation.

Merge once the assembly imagestreams are complete (ART-23400, ART-23402). The existing annotation postsubmit applies the configs after merge.

Validation:

• Shell syntax, JSON formatting, and Git whitespace checks passed.
• Running hack/annotate.sh with a mocked oc verified all four namespace/imagestream mappings and their configs.
• hack/validate-release-controller-config.sh . passed, including generated-config and job-reference validation.
• Release-controller config and qualifier schema validation passed using a local build at fd4dbc53.

Jira: ART-23401.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 90d48213-b908-48e6-9ba6-0fe0a81044c9

📥 Commits

Reviewing files that changed from the base of the PR and between 9b6b297 and 81a1d16.

📒 Files selected for processing (5)

• core-services/release-controller/_releases/release-konflux-ocp-5.0-art23398-arm64.json
• core-services/release-controller/_releases/release-konflux-ocp-5.0-art23398-ppc64le.json
• core-services/release-controller/_releases/release-konflux-ocp-5.0-art23398-s390x.json
• core-services/release-controller/_releases/release-konflux-ocp-5.0-art23398.json
• hack/annotate.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

Walkthrough

Changes

art23398 release setup

Layer / File(s)	Summary
Add art23398 release configurations core-services/release-controller/_releases/release-konflux-ocp-5.0-art23398*.json	Added release-controller configurations for the base, arm64, ppc64le, and s390x art23398 nightly releases.
Update annotation targets hack/annotate.sh	Changed four Konflux RHCOS annotation commands to use the art23398 assembly and matching configuration files.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 81a1d

The four release configurations and annotation targets align for their supported architectures, so this change is ready to merge.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The PR causes hack/annotate.sh to log the four new release configurations: annotate() prints each existing config with jq . before calling oc annotate, and the PR adds four calls that referenc…	Do not print the full release configuration in hack/annotate.sh. Log only the config path or a sanitized summary, and redact fields such as overrideCLIImage and any credential-related fields before writing diagnostic output.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only four JSON release configurations and six annotation lines in hack/annotate.sh. The exact added lines contain release metadata, comments, and annotate calls. No test f…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only hack/annotate.sh and five release-controller JSON/configuration files. The authoritative diff contains no Ginkgo tests, It blocks, cluster operations, `Eventual…
Microshift Test Compatibility	✅ Passed	The pull request changes only four JSON release-controller configurations and hack/annotate.sh. The authoritative diff adds no Ginkgo tests or test constructs such as It, Describe, Context, or…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request adds four JSON release configurations and seven annotation lines in hack/annotate.sh. The authoritative diff contains no test files and no new Ginkgo constructs such as It, …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The pull request changes only four release-controller JSON configuration files and hack/annotate.sh. The added JSON contains release metadata and empty check/publish/verify/periodic sections. …
Ote Binary Stdout Contract	✅ Passed	PASS. The reviewed range changes only four JSON configuration files and hack/annotate.sh; it adds no Go source, OTE binary, main, suite setup, or test lifecycle code. The new JSON files parse succ…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only four JSON release-controller configurations and hack/annotate.sh. The review-scoped diff adds no Ginkgo tests or test declarations (It, Describe, Context, o…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds four JSON release configurations and four oc annotate calls. The changed content contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage. It adds no cryptographic i…
Container-Privileges	✅ Passed	PASS: The pull request does not introduce a container or Kubernetes manifest with any checked privilege setting. The four added release-controller JSON files contain release metadata and empty check…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: it adds release streams for the art23398 assembly. This matches the release-controller configurations and annotation updates.

Full details: No-Sensitive-Data-In-Logs

Explanation

The PR causes hack/annotate.sh to log the four new release configurations: annotate() prints each existing config with jq . before calling oc annotate, and the PR adds four calls that reference these files. Three new files contain the internal cluster hostname image-registry.openshift-image-registry.svc:5000 in overrideCLIImage, so the postsubmit output can expose an internal hostname. The configs also print secret resource names, but they do not contain secret values, tokens, or passwords.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[REHEARSALNOTIFIER]
@locriandev: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[jupierce]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bradmwilliams, jupierce, locriandev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jupierce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@locriandev: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.