tide: use org-level query for openstack-k8s-operators - #82798
Merged
openshift-merge-bot[bot] merged 4 commits intoAug 3, 2026
Conversation
The Tide sync controller query for openstack-k8s-operators fails 100% of the time with GitHub's "Resource limits for this query exceeded" error. The 35 per-repo Tide configs all share identical labels and missingLabels, so deduplicateTideQueries merges them into a single query with 35 repo: qualifiers (1930 chars). This exceeds the free-tier GitHub search resource limit (~1770 chars with label filters). The 3 lightspeed-* repos onboarded on July 9 added ~167 chars, pushing the query over the threshold. Only openshift, openshift-eng, and openshift-priv are on GitHub Enterprise with higher limits. Replace the 35 per-repo Tide queries with a single org-level query using orgs: [openstack-k8s-operators]. This produces org:"openstack- k8s-operators" (~33 chars) instead of 35 repo: qualifiers. Per-repo merge_method and branch-protection configs are preserved.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (37)
💤 Files with no reviewable changes (37)
WalkthroughThe change centralizes Tide and Prow plugin policies for the ChangesProw policy centralization
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
The org-level Tide query using orgs: [openstack-k8s-operators] requires lgtm, approve, hold, wip, verify-owners, and needs-rebase plugins to be enabled on all repos in the org. Enable these at the org level so checkconfig passes. Per-repo plugin configs take precedence where they exist.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@core-services/prow/02_config/openstack-k8s-operators/_pluginconfig.yaml`:
- Around line 11-15: Remove the repository-level `needs-rebase` plugin entry
from the affected `_pluginconfig.yaml` configurations before enabling the
organization-level plugin, or keep the plugin policy scoped only to this
repository. Ensure no duplicate built-in or external plugin names remain across
organization and repository configurations, then validate the merged
configuration with `checkconfig`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a2c0507c-7974-4650-8357-abd3a3a0043c
📒 Files selected for processing (1)
core-services/prow/02_config/openstack-k8s-operators/_pluginconfig.yaml
Comment on lines
+11
to
+15
| - endpoint: http://needs-rebase | ||
| events: | ||
| - issue_comment | ||
| - pull_request | ||
| name: needs-rebase |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
root='core-services/prow/02_config/openstack-k8s-operators'
while IFS= read -r -d '' file; do
matches="$(rg -n --no-heading \
-e 'name:[[:space:]]+needs-rebase' \
-e '^[[:space:]]*-[[:space:]]+(approve|assign|hold|lgtm|lifecycle|verify-owners|wip)$' \
"$file" || true)"
if [[ -n "$matches" ]]; then
printf 'Potential duplicate declarations in %s:\n%s\n' "$file" "$matches"
fi
done < <(find "$root" -mindepth 2 -type f -name '_pluginconfig.yaml' -print0)Repository: openshift/release
Length of output: 208
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
root='core-services/prow/02_config/openstack-k8s-operators'
printf '%s\n' 'Target configuration:'
cat -n "$root/_pluginconfig.yaml"
printf '\n%s\n' 'Repository-level plugin configurations:'
find "$root" -mindepth 2 -type f -name '_pluginconfig.yaml' -print | sort
printf '\n%s\n' 'Plugin declarations in repository-level configurations:'
python3 - <<'PY'
from pathlib import Path
import re
root = Path("core-services/prow/02_config/openstack-k8s-operators")
for path in sorted(root.glob("*/_pluginconfig.yaml")):
text = path.read_text()
names = re.findall(r"(?m)^\s*-\s*name:\s*([^\s#]+)", text)
bare = re.findall(r"(?m)^\s*-\s*(approve|assign|hold|lgtm|lifecycle|verify-owners|wip)\s*$", text)
if names or bare:
print(path)
for name in names + bare:
print(f" {name}")
PY
printf '\n%s\n' 'Relevant Prow configuration code or references:'
rg -n -i 'duplicate|plugin.*(config|name)|repository.*plugin|external.*plugin|built-in' . \
-g '*.go' -g '*.md' -g '*.yaml' -g '*.yml' | head -200 || trueRepository: openshift/release
Length of output: 30481
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
root='core-services/prow/02_config/openstack-k8s-operators'
printf '%s\n' 'Relevant repository configurations:'
for file in \
"$root/openstack-operator/_pluginconfig.yaml" \
"$root/architecture/_pluginconfig.yaml" \
"$root/ci-framework/_pluginconfig.yaml"; do
printf '\n--- %s ---\n' "$file"
cat -n "$file"
done
printf '\n%s\n' 'All needs-rebase declarations under the target scope:'
rg -n -C 3 'needs-rebase' "$root" -g '_pluginconfig.yaml' || true
printf '\n%s\n' 'Prow config validation source:'
curl -fsSL \
'https://raw.githubusercontent.com/kubernetes-sigs/prow/main/pkg/plugins/config.go' |
rg -n -C 8 -i 'duplicate|external_plugins|PluginConfig|plugin names' || true
printf '\n%s\n' 'Relevant merge/config-loading references in the repository:'
rg -n -C 5 -i 'pluginconfig|external_plugins|plugins.*merge|merge.*plugins|checkconfig' \
core-services/prow tools hack Makefile .github 2>/dev/null | head -300 || trueRepository: openshift/release
Length of output: 50373
🌐 Web query:
kubernetes-sigs prow pkg/plugins/config.go duplicate external plugin names repository org plugin config merge validation
💡 Result:
In the Kubernetes Prow project, the validation of external plugin configurations—specifically regarding duplicate names between organization and repository levels—is handled within the pkg/plugins/config.go file [1]. The validation logic, implemented in the validateExternalPlugins function, ensures that external plugins defined for a specific repository do not conflict with those inherited from the organization level [1]. Key details of this validation process include: 1. Scope Identification: The function iterates through the ExternalPlugins map [1]. For entries defined at the org/repo level, it extracts the organization name (the part before the forward slash) [1]. 2. Config Aggregation: It gathers the list of external plugin names defined for the organization level and compares them against the list defined for the specific repository [1]. 3. Conflict Detection: It utilizes a helper function, findDuplicatedPluginConfig, to identify any intersection between the repository-level plugins and the organization-level plugins [1]. 4. Validation Failure: If any duplicate plugin names are detected, the function returns an error formatted as: "external plugins [list of names] are duplicated for [repo] and [org]" [1]. This mechanism is part of the broader Prow configuration loading process, which generally validates that plugin declarations are correctly structured to prevent runtime conflicts [2][3]. Prow users typically rely on checkconfig or the Load method in the plugins package to ensure their plugins.yaml configuration is valid before applying it [2][4][5].
Citations:
- 1: https://github.com/kubernetes-sigs/prow/blob/f6cc3990c368/pkg/plugins/config.go
- 2: https://github.com/kubernetes-sigs/prow/blob/main/pkg/plugins/plugins.go
- 3: https://github.com/kubernetes-sigs/prow/blob/f6cc3990c368/pkg/plugins/plugins.go
- 4: https://docs.prow.k8s.io/docs/components/plugins/
- 5: prow/cmd/checkconfig should warn on external-plugins misspelling kubernetes/test-infra#11879
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from urllib.request import urlopen
import re
urls = [
"https://raw.githubusercontent.com/kubernetes-sigs/prow/main/pkg/plugins/config.go",
"https://raw.githubusercontent.com/kubernetes-sigs/prow/f6cc3990c368/pkg/plugins/config.go",
]
for url in urls:
print(f"\n--- {url} ---")
text = urlopen(url, timeout=20).read().decode()
for match in re.finditer(r"(?m)^func (validate\w+|findDuplicatedPluginConfig)\b", text):
start = max(0, text.rfind("\n", 0, match.start()) - 200)
end = text.find("\nfunc ", match.end())
if end < 0:
end = len(text)
print(text[start:end][:8000])
PYRepository: openshift/release
Length of output: 2533
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for ref in main f6cc3990c368; do
printf '\n--- %s ---\n' "$ref"
curl -kfsSL "https://raw.githubusercontent.com/kubernetes-sigs/prow/$ref/pkg/plugins/config.go" |
awk '
/^func (validate|findDuplicated)/ {show=1}
show {print}
show && /^}/ {print ""; show=0}
' | head -240
doneRepository: openshift/release
Length of output: 15516
Remove repository-level duplicates before enabling these organization-level plugins.
Prow rejects duplicate built-in and external plugin names between openstack-k8s-operators and its repository configurations. Remove the overlapping entries from each affected _pluginconfig.yaml, or keep this policy repository-scoped. Run checkconfig on the merged configuration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@core-services/prow/02_config/openstack-k8s-operators/_pluginconfig.yaml`
around lines 11 - 15, Remove the repository-level `needs-rebase` plugin entry
from the affected `_pluginconfig.yaml` configurations before enabling the
organization-level plugin, or keep the plugin policy scoped only to this
repository. Ensure no duplicate built-in or external plugin names remain across
organization and repository configurations, then validate the merged
configuration with `checkconfig`.
Remove approve, assign, hold, lgtm, lifecycle, verify-owners, and wip from per-repo plugin configs since they are now enabled at the org level. checkconfig rejects duplicate plugin entries between org and repo scope.
stuggi
reviewed
Aug 3, 2026
Comment on lines
12
to
16
Contributor
There was a problem hiding this comment.
I think we have to remove this now that it is defined on the org leve?
The needs-rebase external plugin is now configured at the org level. Remove the per-repo entries to avoid checkconfig duplication errors.
Contributor
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
Contributor
|
/test ci/prow/yamllint |
Contributor
|
/test yamllint |
Contributor
|
/test boskos-config-generation |
Contributor
|
/test check-trigger-trusted-apps |
Contributor
|
/test owners |
Contributor
|
/test prow-config |
Contributor
|
/test release-controller-config |
Contributor
|
/test openshift-image-mirror-mappings |
Contributor
Contributor
|
@Prucek: Updated the following 2 configmaps:
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openstack-k8s-operatorsfails 100% with GitHub's "Resource limits for this query exceeded" — 35 per-reporepo:qualifiers (1930 chars) exceed the free-tier search limit. Started July 9 when 3lightspeed-*repos were onboarded.orgs: [openstack-k8s-operators], reducing query scope from 1930 chars to ~33 chars.merge_methodandbranch-protectionconfigs are preserved; only redundanttide.queriessections are removed.Generated with the help of Claude Code
Summary by CodeRabbit
openstack-k8s-operatorsTide configuration into one organization-level query.needs-rebaseentries.merge_methodandbranch-protectionsettings.checkconfigduplication errors.