Derive Konflux tenant and SA from existing pipelines (ROSA-730)

[tnierman]

Summary

The agentic SDLC check pipeline template previously constructed the Konflux tenant namespace and service account from the operator name (<operator>-tenant, build-pipeline-<operator>). This fails for repos onboarded to Konflux with non-standard naming.

This PR reads both values from existing .tekton/*-pull-request.yaml files instead, which are the source of truth (created by Konflux during onboarding, never regenerated by boilerplate). Falls back to the convention if no existing pipelines are found.

Affected repos

Repo	Actual tenant	Convention would produce
configure-alertmanager-operator	camo-hcm-tenant	configure-alertmanager-operator-tenant
configure-goalert-operator	fedramp-srep-tenant	configure-goalert-operator-tenant

CAMO also has a non-standard SA: build-pipeline-configure-alertmanager-operator-master vs build-pipeline-configure-alertmanager-operator.

How it works

# Read from existing Konflux pipelines, skip the agentic check itself
TENANT_NAMESPACE=$(grep -h 'namespace:' .tekton/*-pull-request.yaml | grep -v agentic | head -1 | awk '{print $2}')
TENANT_NAMESPACE=${TENANT_NAMESPACE:-${OPERATOR_NAME}-tenant}

SERVICE_ACCOUNT=$(grep -h 'serviceAccountName:' .tekton/*-pull-request.yaml | grep -v agentic | head -1 | awk '{print $2}')
SERVICE_ACCOUNT=${SERVICE_ACCOUNT:-build-pipeline-${OPERATOR_NAME}}

Related

• ROSAENG-61679: CAMO tenant naming mismatch
• PR Fix agentic SDLC check: resolve @ includes, switch to informing mode #790: @ include resolution and onError: continue (merged)
• PR Set the target branch by repo default branch #798: Default branch detection (merged)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• boilerplate/openshift/golang-osd-operator/agentic-sdlc-check-pull-request.yaml.tmpl is excluded by !boilerplate/**
• boilerplate/openshift/golang-osd-operator/update is excluded by !boilerplate/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 76909ed4-6e88-40be-8b8b-2fe4d8c33122

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[joshbranham]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joshbranham, tnierman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [joshbranham]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment