WIP: Add Codecov coverage Prow jobs for rosa-boundary

[tiwillia]

Adds presubmit (coverage) and postsubmit (publish-coverage) Prow jobs to upload Go unit test coverage to the self-hosted Codecov instance for openshift-online/rosa-boundary.

Jobs added:

• coverage — runs make codecov on every PR (presubmit)
• publish-coverage — runs make codecov on merge to main (postsubmit)

Both mount the rosa-boundary-codecov secret at /var/run/codecov-secret providing CODECOV_TOKEN and CODECOV_ENTERPRISE_URL.

Depends on: openshift-online/rosa-boundary#112 (adds make test-coverage, make codecov, and scripts/codecov.sh to the rosa-boundary repo). This PR should not be merged until that PR lands.

/hold

Summary by CodeRabbit

Adds presubmit and postsubmit coverage jobs for openshift-online/rosa-boundary. Both run make codecov from the src container and mount the rosa-boundary-codecov secret for uploading Go test coverage; postsubmit publishing runs after merges to main.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tiwillia

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift-online/rosa-boundary/OWNERS [tiwillia]
• ci-operator/jobs/openshift-online/rosa-boundary/OWNERS [tiwillia]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: db9345d8-9d84-478e-8f25-b511d056561a

📥 Commits

Reviewing files that changed from the base of the PR and between 98b5d56 and 0660fff.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/openshift-online/rosa-boundary/openshift-online-rosa-boundary-main-postsubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift-online/rosa-boundary/openshift-online-rosa-boundary-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift-online/rosa-boundary/openshift-online-rosa-boundary-main.yaml

---

Walkthrough

The ROSA Boundary CI configuration adds a coverage job and a postsubmit coverage-publishing job. Both run make codecov in the src container with the rosa-boundary-codecov secret mounted.

Changes

ROSA Boundary coverage

Layer / File(s)	Summary
Add coverage jobs ci-operator/config/openshift-online/rosa-boundary/openshift-online-rosa-boundary-main.yaml	Adds coverage and postsubmit publish-coverage jobs that run make codecov with the Codecov secret mounted.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding Codecov coverage Prow jobs for rosa-boundary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The PR only adds static CI job names in YAML; it does not introduce or modify any Ginkgo test titles or dynamic names.
Test Structure And Quality	✅ Passed	The PR only adds ci-operator YAML jobs; no Ginkgo test files or test code were changed, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only adds coverage Prow jobs and generated job YAML; no Ginkgo e2e tests or new API usage were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds ci-operator/prow YAML jobs; no Ginkgo/e2e tests or SNO-sensitive code was added, so the check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI job config changed; no deployment manifests/controllers or topology-sensitive scheduling fields were added.
Ote Binary Stdout Contract	✅ Passed	PR only adds ci-operator YAML jobs; no process-level code or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only adds Prow coverage jobs in YAML; no Ginkgo e2e tests or network logic were introduced.
No-Weak-Crypto	✅ Passed	The only changed YAML adds CI jobs and secret mounts; it contains no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom secret comparisons.
Container-Privileges	✅ Passed	New coverage jobs only run make codecov with a secret mount; no privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The PR only adds Prow job YAML for make codecov and secret mounts; there are no new echo/print/debug statements or sensitive-data logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@tiwillia: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-online-rosa-boundary-main-coverage	openshift-online/rosa-boundary	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.