Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .claude/skills/e2e-analyze/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
---
name: e2e-analyze
description: >
Analyze e2e test failures from CI runs. Use when a CI job has failed and you need to
download artifacts, identify the root cause of a specific test failure, and produce a
structured failure analysis with evidence. Requires a CI run URL, test name, and an
existing local directory for storing artifacts.
---

# Analyze E2E Test Failures

Download and analyze CI test artifacts to determine the root cause of an e2e test failure.

## Usage

```
/skill:e2e-analyze <ci-run-url> <test-name> <artifact-directory>
```

**Arguments:**
- `ci-run-url` (required): HTTPS URL of the CI run (e.g., a Prow job URL)
- `test-name` (required): Name of the failing test to analyze
- `artifact-directory` (required): Path to an **existing** local directory where artifacts will be stored

## Procedure

### 1. Validate inputs

- Confirm the artifact directory exists. **Do not create it** — fail if missing.
- Extract `{BUILD_NUMBER}` from the CI URL by matching a 10–20 digit sequence. Fail if none is found.
- Only allow HTTPS URLs (reject HTTP).

### 2. Download the build log

```bash
curl -fsSL --max-time 20 --retry 3 --retry-connrefused \
--proto '=https' --max-filesize 100M \
"${CI_RUN_URL}/build-log.txt"
```

### 3. Analyze the failure

- Parse `build-log.txt` for failures related to the specified test name.
- Use `gcloud storage` to fetch relevant artifacts into the artifact directory, incorporating `{BUILD_NUMBER}` in URLs.
- Gather primary evidence for the failure.
- Search for additional evidence in logs and events.
- **Do not delete downloaded artifacts** after analysis.

## Output Format

```text
Error: {Error message here}
Summary: {Failure analysis here}
Evidence: {Evidence here}
Additional evidence: {Additional evidence here}
```
83 changes: 83 additions & 0 deletions .claude/skills/feature-development/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
---
name: feature-development
description: >
Implement support for a new HCP feature using a multi-agent workflow that progresses
through architecture design, control plane implementation, data plane implementation,
cloud provider integration, and architect review. Use when the user wants to build a
new platform feature end-to-end with specialized agents handling each layer.
---

# Feature Development Workflow

Orchestrate specialized subagents to implement a new HCP feature from design through
to deployment, with each agent building on the output of previous stages.

## Usage

```
/skill:feature-development <feature-description>
```

**Arguments:**
- `feature-description` (required): Description of the new platform feature to implement

## Workflow Stages

Delegate to specialized subagents in sequence. Each agent receives context from previous
agents to ensure coherent implementation.

### 1. HCP Architect Design

Delegate to an architect-focused subagent:

**Prompt:** "Design the API and main abstractions for supporting a new platform feature:
`<feature-description>`. Include API changes, CLI changes, and controller changes."

Save the API design and main abstractions for subsequent agents.

### 2. Control Plane Implementation

Delegate to a control-plane-focused subagent:

**Prompt:** "Implement the control plane changes needed to support the new feature:
`<feature-description>`. Use the design hints from the architect phase:
[include output from step 1]."

Include unit, integration, and e2e tests.

### 3. Data Plane Implementation

Delegate to a data-plane-focused subagent:

**Prompt:** "Implement the data plane changes needed to support the new feature:
`<feature-description>`."

Include unit, integration, and e2e tests.

### 4. Cloud Provider Integration

Delegate to a cloud-provider-focused subagent:

**Prompt:** "Review the control plane and data plane changes and implement any further
changes needed to support the new feature and ensure proper cloud integration:
`<feature-description>`. Add support to create a new HostedCluster in the new platform
via CLI."

Include unit, integration, and e2e tests.

### 5. HCP Architect Review

Delegate to an architect-focused subagent for final review:

**Prompt:** "Review the changes implemented by the other agents for supporting a new
feature: `<feature-description>`. [Include output from steps 2, 3, and 4].
Report feedback and suggest changes."

### 6. Aggregate Results

Combine results from all agents and present a unified implementation plan including:
- API design decisions and rationale
- Control plane changes with test coverage
- Data plane changes with test coverage
- Cloud provider integration with CLI support
- Architect review feedback and suggested improvements
254 changes: 254 additions & 0 deletions .claude/skills/fix-hypershift-repo-robot-pr/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,254 @@
---
name: fix-hypershift-repo-robot-pr
description: >
Fix robot/bot-authored PRs in the HyperShift repo that have failing CI due to missing
generated files. Use when a Dependabot, Konflux, Renovate, or other bot PR fails
verification and needs regenerated files, vendoring, and a clean replacement PR with
conventional commit formatting.
---

# Fix HyperShift Repo Robot PR

Validate a bot-authored PR, cherry-pick its commits, regenerate missing files, organize
changes into logical commits, and create a clean replacement PR.

## Usage

```
/skill:fix-hypershift-repo-robot-pr <pr-number-or-url>
```

**Arguments:**
- `pr-number-or-url` (required): GitHub PR number or full URL
- Examples: `7435`, `https://github.com/openshift/hypershift/pull/7435`

## What This Skill Does

1. Validates the PR is authored by a bot (`is_bot: true`)
2. Fetches the bot's PR commits
3. Creates a new branch `fix/<original-branch-name>` from the base branch
4. Cherry-picks commits and converts to conventional commit format
5. Runs `make verify` to regenerate all necessary files
6. Runs `UPDATE=true make test` to update test fixtures
7. Organizes changes into logical, well-structured commits
8. Runs `make verify` and `make test` for final validation
9. If successful: creates new PR and closes/comments on original
Comment on lines +27 to +35

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Do not run arbitrary bot PR code on a privileged workspace.

is_bot: true accepts any bot identity, then the workflow cherry-picks its changes and executes repository-controlled make verify and make test. Use a trusted-bot allowlist and run validation in an isolated, disposable environment without credentials or unnecessary network access.

As per path instructions, .claude files are high-risk AI configuration and require scrutiny of scripts, filesystem access, and supply-chain attacks.

Also applies to: 99-105

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md around lines 27 - 35,
Update the workflow described in the skill so bot validation accepts only an
explicit trusted-bot allowlist rather than any PR with is_bot: true. Before
cherry-picking or running make verify and make test, perform validation in an
isolated disposable environment with credentials removed and unnecessary network
access disabled; document these safeguards in the workflow steps.

Source: Path instructions

10. If unsuccessful: preserves original PR and reports failure

## Process Flow

### Step 1: Parse Input and Validate PR

Extract the PR number:

```bash
PR_NUMBER=$(echo "<user-argument>" | grep -oE '[0-9]+$')
```

Fetch PR details and validate:

```bash
gh pr view "$PR_NUMBER" --json number,title,author,headRefName,baseRefName,body,state,url,commits
```

**Required validations:**
- PR must exist and be `OPEN`
- `author.is_bot` must be `true`
- Working directory must be clean (no uncommitted changes)

**Error if not a bot:**
```
ERROR: PR #7435 is not authored by a bot.
Author: username (is_bot: false)

This skill is specifically for fixing bot-authored PRs.
```

### Step 2: Create Fix Branch from Base

```bash
ORIGINAL_BRANCH=$(git rev-parse --abbrev-ref HEAD)
git fetch upstream
FIX_BRANCH="fix/${BOT_BRANCH_NAME}"
git checkout -b "$FIX_BRANCH" upstream/${BASE_REF_NAME}
```

### Step 3: Cherry-pick and Convert Commits

For each commit in the bot's PR:
1. Cherry-pick the commit
2. Amend the commit message to conventional commit format

**Commit message conversion rules:**

| Bot | Original Format | Converted Format |
|-----|-----------------|------------------|
| Dependabot | `NO-JIRA: Bump the misc-dependencies group...` | `chore(deps): bump misc-dependencies group...` |
| Dependabot | `build(deps): bump X from A to B` | Keep as-is (already conventional) |
| Konflux | `Red Hat Konflux update hypershift-operator...` | `chore(konflux): update hypershift-operator...` |

```bash
for COMMIT in $(gh pr view $PR_NUMBER --json commits -q '.commits[].oid'); do
git cherry-pick "$COMMIT"
ORIGINAL_MSG=$(git log -1 --format='%B')
# Convert message per rules above
git commit --amend -m "$CONVERTED_MSG"
done
```

### Step 4: Run make verify, Update Test Fixtures, and Organize Changes

```bash
make verify 2>&1 || true
UPDATE=true make test 2>&1 || true
git status --porcelain
```

**Organize changes into separate commits:**

1. **go.mod/go.sum changes** (root module):
```bash
git add go.mod go.sum
git commit -m "chore(deps): update go.mod dependencies

Signed-off-by: ...
Commit-Message-Assisted-by: Claude (via Claude Code)"
```

2. **vendor/ changes** (root module):
```bash
git add vendor/
git commit -m "chore(deps): update vendored dependencies

Signed-off-by: ...
Commit-Message-Assisted-by: Claude (via Claude Code)"
```

3. **api/ module changes** (go.mod, go.sum, vendor/):
```bash
git add api/go.mod api/go.sum api/vendor/
git commit -m "chore(api): update api module dependencies

Signed-off-by: ...
Commit-Message-Assisted-by: Claude (via Claude Code)"
```

4. **Regenerated assets** (CRDs, manifests):
```bash
git add cmd/install/assets/
git commit -m "chore: regenerate CRD manifests

Signed-off-by: ...
Commit-Message-Assisted-by: Claude (via Claude Code)"
```

5. **Other code changes** (if any):
```bash
git add -A
git commit -m "chore: additional changes from make verify

Signed-off-by: ...
Commit-Message-Assisted-by: Claude (via Claude Code)"
```

Check for untracked generated files:
```bash
git status --porcelain | grep '^??'
```

### Step 5: Run Full Validation

```bash
make verify
make test
```

### Step 6: Handle Results

**If validation fails — ABORT and preserve original:**

```
============================================
VALIDATION FAILED - ABORTING
============================================

The original PR #7435 has been PRESERVED.
Please investigate the failures manually.

- make verify: FAILED/PASSED
- make test: FAILED/PASSED

Returning to original branch...
```

- Clean up fix branch locally
- Return to original branch
- DO NOT close original PR

**If validation succeeds — Create new PR and close/comment original:**

```bash
git push -u origin "$FIX_BRANCH"

# PR title must be prefixed with NO-JIRA: for bot dependency updates
gh pr create \
--title "NO-JIRA: $CONVENTIONAL_TITLE" \
--base "$BASE_REF_NAME" \
--body "## Summary
This PR supersedes #${PR_NUMBER} (authored by ${AUTHOR_LOGIN}).
..."

# Try to close original, fall back to comment
gh pr close "$PR_NUMBER" --comment "..." || \
gh pr comment "$PR_NUMBER" --body "This PR has been superseded by #${NEW_PR_NUMBER}. ..."
```

## Commit Organization Strategy

| Commit | Files | Message Format |
|--------|-------|----------------|
| 1 | `go.mod`, `go.sum` | `chore(deps): update go.mod dependencies` |
| 2 | `vendor/` | `chore(deps): update vendored dependencies` |
| 3 | `api/go.mod`, `api/go.sum`, `api/vendor/` | `chore(api): update api module dependencies` |
| 4 | `cmd/install/assets/**/*.yaml` | `chore: regenerate CRD manifests` |
| 5 | Other changes | `chore: additional changes from make verify` |

## Error Handling

| Scenario | Action |
|----------|--------|
| PR not found | `ERROR: PR #99999 not found or you don't have access.` |
| PR not open | `ERROR: PR #7435 is not open (current state: MERGED).` |
| Not a bot | `ERROR: PR #7435 is not authored by a bot.` |
| Dirty working dir | `ERROR: Working directory has uncommitted changes.` |
| make verify failed | Preserve original PR, report failure |
| make test failed | Preserve original PR, report failure |
| git push failed | `ERROR: Failed to push branch. Check permissions.` |
| PR creation failed | `ERROR: Failed to create new PR. Fix branch pushed, create PR manually.` |
| No close permission | Falls back to commenting on original PR |

## Safety Features

- **Bot verification**: Only processes PRs with `is_bot: true`
- **Atomic operations**: Original PR only closed AFTER new PR is created
- **Failure preservation**: Original PR is NEVER closed if validation fails
- **Clean state required**: Refuses to run with uncommitted changes
- **Branch restoration**: Always returns to original branch after completion
- **Local cleanup**: Deletes fix branch locally on failure
- **Permission fallback**: Comments on original PR if no permission to close

## Supported Bots

| Bot | Author Login | Typical PRs |
|-----|-------------|-------------|
| Dependabot | `app/dependabot` | Go dependency updates |
| Konflux | `app/red-hat-konflux` | Image and pipeline updates |
| Renovate | `app/renovate` | Dependency updates |
| Any | `is_bot: true` | Various automated updates |

## Requirements

- `gh` CLI installed and authenticated with push/PR access
- `git` configured with `user.name` and `user.email`
- `make` and Go toolchain available
- Clean working directory (no uncommitted changes)
Loading