review-agent: switch hypershift workflow to app auth with correct fork

[bryan-cox]

Summary

• Switch hypershift review-agent workflow from PAT auth (jira-solve-bot) to app auth (hypershift-community/hypershift)
• The workflow was left inconsistent when PAT support was added — the GitHub App is installed on hypershift-community, not jira-solve-bot

Root cause: REVIEW_AGENT_AUTH_MODE was set to pat with REVIEW_AGENT_FORK_ORG: jira-solve-bot, but the PR branch lived on hypershift-community/hypershift, causing fatal: couldn't find remote ref during checkout.

Failed run: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-hypershift-main-periodic-review-agent/2080388818413817856

Test plan

• Rehearse against CNTRLPLANE-3910: Fix e2e test reliability for mirroring tests and test-changed target hypershift#9086 to verify the fix

🤖 Generated with Claude Code

Summary by CodeRabbit

Updates HyperShift’s review-agent workflow to use app authentication and the hypershift-community/hypershift repository as the review-agent fork, replacing the previous PAT-based configuration and fork organization setting.

[coderabbitai]

Walkthrough

The HyperShift review-agent workflow changes from PAT-based authentication with a fork organization to app-based authentication with an explicit fork repository URL.

Changes

HyperShift Review Agent

Layer / File(s)	Summary
Review-agent authentication configuration ci-operator/step-registry/hypershift/review-agent/hypershift-review-agent-workflow.yaml	Switches authentication from pat to app and replaces the fork organization setting with an explicit fork repository URL.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: enxebre, csrwng

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only updates a workflow YAML env block; no Ginkgo tests or titles were added/changed.
Test Structure And Quality	✅ Passed	PR only changes a workflow YAML; no Ginkgo test code was added or modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only changes a workflow YAML env block; no new Ginkgo tests or MicroShift-incompatible APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a workflow YAML changed; no Ginkgo test files or new It/Describe/Context blocks were added, so SNO-specific test compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a workflow env change was made; no deployment, controller, or scheduling logic was added or modified.
Ote Binary Stdout Contract	✅ Passed	Only a workflow YAML changed; no process-level binary code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo tests were added; the PR only changes a workflow env block, so the IPv4/disconnected-network check is not applicable.
No-Weak-Crypto	✅ Passed	The PR only changes YAML env vars for review-agent fork/auth config; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear in the diff.
Container-Privileges	✅ Passed	The only changed YAML adjusts review-agent env vars; no privileged, hostPID/Network/IPC, allowPrivilegeEscalation, or root/capability settings are present.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only swaps workflow env vars to app mode; no new echo/printf/debug logging of secrets or PII was added.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the workflow change to app-based auth and the corrected fork target.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[enxebre]

this was left inconsistent when enabling pat support in the installer.
Right now hypershift uses app for jira agent and pat for address review, hence the failure.
Instead of the proposed changes can we please just update /hypershift/review-agent/hypershift-review-agent-workflow.yaml to have

JIRA_AGENT_FORK_REPO: "hypershift-community/hypershift"
JIRA_AGENT_AUTH_MODE: "app"

then we can rehearsal against openshift/hypershift#9086 to prove it

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bryan-cox: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-hypershift-main-periodic-review-agent	N/A	periodic	Registry content changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[enxebre]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/hypershift/review-agent/OWNERS [bryan-cox,enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/pj-rehearse skip

I'll check it after this merges.

[openshift-merge-bot]

@bryan-cox: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.