Add fips qualifier and apply to fips-scan job in 5.0 release config

[redhat-chai-bot]

Add a new fips qualifier to release-qualifiers.yaml and apply it to the existing fips-scan verify entry in the 5.0 nightly release-controller config.\n\n## Changes\n\n- release-qualifiers.yaml — new fips qualifier (enabled: true, badgeName: \"fips\", summary/description: \"FIPS Payload Validation\", payloadBadgeStatus: \"Yes\")\n- release-ocp-5.0.json — added \"qualifiers\": { \"fips\": {} } to the existing fips-scan verify entry\n- priv/release-ocp-5.0.json — regenerated via make release-controllers

---

AI-generated. Review for accuracy.

@neisw requested via Chai Bot

Summary by CodeRabbit

• Adds an enabled fips release qualifier with FIPS validation metadata.
• Applies the qualifier to the optional fips-scan verification job in the OpenShift 5.0 nightly release-controller configuration.
• Regenerates the derived release-controller JSON configuration.

[coderabbitai]

Warning

Review limit reached

@redhat-chai-bot, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e4812f3-4786-452f-88d5-963bbfa48618

📥 Commits

Reviewing files that changed from the base of the PR and between e42be2e and 130dd82.

📒 Files selected for processing (2)

• core-services/release-controller/_releases/priv/release-ocp-4.23.json
• core-services/release-controller/_releases/release-ocp-4.23.json

Walkthrough

The release controller now defines an enabled fips qualifier and attaches it to both OCP 5.0 fips-scan verification configurations.

Changes

FIPS qualifier configuration

Layer / File(s)	Summary
Declare FIPS qualifier core-services/release-controller/release-qualifiers.yaml	Defines the enabled fips qualifier with badge metadata and always-visible payload status.
Wire FIPS scan configurations core-services/release-controller/_releases/release-ocp-5.0.json, core-services/release-controller/_releases/priv/release-ocp-5.0.json	Adds the fips qualifier to both OCP 5.0 fips-scan verification entries.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• openshift/release#82763: Adds a different release qualifier in the same configuration areas.
• openshift/release#82836: Modifies the OCP 5.0 fips-scan verification job.

Suggested reviewers: bradmwilliams

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes adding the FIPS qualifier and applying it to the fips-scan job in the 5.0 release configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only JSON and YAML configuration; it adds no Ginkgo tests or test titles, so stable test-name rules do not apply.
Test Structure And Quality	✅ Passed	Not applicable: the diff contains only JSON/YAML configuration changes, with no Ginkgo test code or test constructs to review.
Microshift Test Compatibility	✅ Passed	The pull request changes only release-controller JSON and YAML configuration; it adds no Ginkgo e2e tests or test declarations requiring MicroShift compatibility review.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only JSON and YAML release-controller configuration; it adds no Ginkgo e2e tests or other test source requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The referenced files only add release-qualifier metadata and fips-scan mappings; they introduce no deployment, operator, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The patch changes only JSON and YAML configuration. It adds no OTE binary, suite setup, initializer, or stdout write.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff adds only JSON/YAML qualifier configuration; it adds no Ginkgo test declarations, IPv4 literals, URL construction, or external connectivity code.
No-Weak-Crypto	✅ Passed	The patch adds only JSON/YAML qualifier metadata and fips references; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, crypto implementation, or secret comparison is introduced.
Container-Privileges	✅ Passed	The changed release JSON and YAML files contain no prohibited privilege settings, and the added fips entries only add qualifier metadata.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only qualifier configuration and FIPS metadata; no logging statements or sensitive-data fields appear in the added lines.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@redhat-chai-bot: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[smg247]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: redhat-chai-bot, smg247

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/release-controller/OWNERS [smg247]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@redhat-chai-bot: Updated the release-controller-release-qualifiers configmap in namespace ci at cluster app.ci using the following files:

• key release-qualifiers.yaml using file core-services/release-controller/release-qualifiers.yaml

Details

In response to this:

Add a new fips qualifier to release-qualifiers.yaml and apply it to the existing fips-scan verify entry in the 5.0 nightly release-controller config.\n\n## Changes\n\n- release-qualifiers.yaml — new fips qualifier (enabled: true, badgeName: \"fips\", summary/description: \"FIPS Payload Validation\", payloadBadgeStatus: \"Yes\")\n- release-ocp-5.0.json — added \"qualifiers\": { \"fips\": {} } to the existing fips-scan verify entry\n- priv/release-ocp-5.0.json — regenerated via make release-controllers

---

AI-generated. Review for accuracy.

@neisw requested via Chai Bot

Summary by CodeRabbit

• Adds an enabled fips release qualifier with FIPS validation metadata.
• Applies the qualifier to the optional fips-scan verification job in the OpenShift 5.0 nightly release-controller configuration.
• Regenerates the derived release-controller JSON configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.