chore: [ROSAENG-62417] initialize fullsend per-repo installation

.fullsend/config.yaml

@@ -0,0 +1,21 @@
+# fullsend per-repo configuration
+# https://github.com/fullsend-ai/fullsend
+#
+# This file configures fullsend for per-repo installation mode.
+# See ADR 0033 for details.
+version: "1"
+roles:
+    - triage
+    - coder
+    - review
+    - fix
+    - retro
+    - prioritize
+allowed_remote_resources:
+    - https://raw.githubusercontent.com/fullsend-ai/fullsend/
+    - https://raw.githubusercontent.com/fullsend-ai/agents/
+create_issues:
+    allow_targets:
+        repos:
+            - openshift/ocm-agent-operator
+            - fullsend-ai/fullsend

.github/workflows/fullsend.yaml

@@ -0,0 +1,89 @@
+# This file is managed by fullsend. Do not edit it directly.
+# Upstream: https://github.com/fullsend-ai/fullsend/blob/main/internal/scaffold/fullsend-repo/.github/workflows/fullsend.yaml
+---
+# fullsend shim workflow (per-repo installation mode)
+# Routes events to agent workflows via reusable-dispatch.yml.
+# All agent execution happens in this repo's context — no external
+# config repo is needed.
+#
+# Security: pull_request_target runs the BASE branch version of this workflow,
+# preventing PRs from modifying it to exfiltrate credentials.
+# This shim never checks out PR code, so it is not vulnerable to "pwn request"
+# attacks.
+#
+# Routing: this shim forwards the raw event context to reusable-dispatch.yml,
+# which determines the stage and runs the agent inline (ADR 62).
+# Adding a new stage requires only a job in reusable-dispatch.yml — zero changes to this repo.
+#
+# Concurrency: per-role cancel-in-progress groups live in reusable-dispatch.yml
+# stage jobs with -agent- suffix. Roles operate independently (#2452).
+name: fullsend
+
+permissions:
+  actions: write
+  id-token: write
+  contents: write
+  issues: write
+  packages: read
+  pull-requests: write
+
+on:
+  issues:
+    types: [opened, edited, labeled]
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, ready_for_review, closed, labeled, unlabeled]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  dispatch:
+    if: >-
+      github.event_name != 'issue_comment'
+      || github.event.comment.user.type != 'Bot'
+    uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@3cfa255ab4cc8190670585ea42da529119251632 # v0.32.0
+    with:
+      event_action: ${{ github.event.action }}
+      install_mode: per-repo
+      mint_url: ${{ vars.FULLSEND_MINT_URL }}
+      gcp_region: ${{ vars.FULLSEND_GCP_REGION }}
+      runner_image: ubuntu-24.04
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+      OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_TRACES_HEADERS }}
+
+  stop-fix:
+    if: >-
+      github.event_name == 'issue_comment'
+        && github.event.issue.pull_request
+        && github.event.comment.user.type != 'Bot'
+        && github.event.comment.body == '/fs-fix-stop'
+        && (
+          github.event.comment.author_association == 'OWNER'
+          || github.event.comment.author_association == 'MEMBER'
+          || github.event.comment.author_association == 'COLLABORATOR'
+          || github.event.comment.author_association == 'CONTRIBUTOR'
+          || github.event.comment.user.login == github.event.issue.user.login
+        )
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Add fullsend-no-fix label and notify
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          gh label create "fullsend-no-fix" --repo "$REPO" \
+            --description "Skip bot-triggered fix agent runs" --color "FBCA04" \
+            --force 2>/dev/null || true
+          gh pr edit "$PR_NUMBER" --repo "$REPO" \
+            --add-label "fullsend-no-fix"
+          gh pr comment "$PR_NUMBER" --repo "$REPO" \
+            --body "Fix agent disabled for this PR. Remove the \`fullsend-no-fix\` label or use \`/fs-fix\` to re-engage."

.tekton/ocm-agent-operator-agentic-sdlc-check-pull-request.yaml

@@ -43,7 +43,7 @@ spec:
       - name: url
         value: https://github.com/openshift/boilerplate
       - name: revision
-        value: b50b601721cf0d80848e6d75af1d132aab4d78a9
+        value: 196cc914d2d5093c6f2c310a61313f2096844333
       - name: pathInRepo
         value: pipelines/agentic-sdlc-check/pipeline.yaml
 status: {}

boilerplate/_data/last-boilerplate-commit

@@ -1 +1 @@
-b50b601721cf0d80848e6d75af1d132aab4d78a9
+196cc914d2d5093c6f2c310a61313f2096844333

boilerplate/openshift/golang-osd-e2e/README.md

@@ -31,8 +31,49 @@ following:
 |------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `e2e-binary-build`     | Compiles ginkgo tests under test/e2e and creates the ginkgo binary.                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `e2e-image-build-push` | Builds e2e image and pushes to operator's quay repo. Image name is defaulted to <operator-image-name>-test-harness. Quay repository must be created beforehand.                                                                                                                                                                                                                                                                                                                        |
+| `e2e-local`            | Builds the e2e binary and runs it against a cluster via KUBECONFIG or backplane. Supports focused tests via GINKGO_FOCUS.                                                                                                                                                                                                                                                                                                                                                              |
 
 #### E2E Local Testing
 
-Please follow [this README](https://github.com/openshift/ops-sop/blob/master/v4/howto/osde2e/operator-test-harnesses.md#using-ginkgo) to run your e2e tests locally
+Run e2e tests locally against a managed cluster without waiting for the full Prow CI pipeline.
+
+**Prerequisites:**
+- `ocm` CLI logged into the appropriate environment (`ocm login --use-auth-code --url staging`)
+- Access to a managed cluster (via KUBECONFIG or backplane)
+- Go toolchain installed
+
+**Option 1: Using backplane (recommended)**
+
+```bash
+# Run all tests against a cluster by ID
+make e2e-local CLUSTER_ID=2rmlgv5dbdp2285n85o7h3aaa6pafkpq
+
+# Run focused tests
+make e2e-local CLUSTER_ID=2rmlgv5dbdp2285n85o7h3aaa6pafkpq GINKGO_FOCUS="is installed"
+
+# Run tests with a label filter
+make e2e-local CLUSTER_ID=2rmlgv5dbdp2285n85o7h3aaa6pafkpq GINKGO_LABEL_FILTER="!slow"
+```
+
+**Option 2: Using an existing KUBECONFIG**
+
+```bash
+# Set KUBECONFIG to your cluster's kubeconfig
+export KUBECONFIG=/path/to/kubeconfig
+
+# Run all tests
+make e2e-local
+
+# Run a single test
+make e2e-local GINKGO_FOCUS="reconciles required resources"
+```
+
+**Output:**
+- Test results print to stdout with verbose Ginkgo output
+- JUnit XML report saved to `e2e-local-junit.xml`
+
+**Tips:**
+- Use lease clusters for testing (check `#rosa-prow-info` for available clusters)
+- The operator must be deployed on the target cluster (via PKO or OLM)
+- If tests fail with "not found" errors, verify the operator is running: `oc get deployment -n <operator-namespace>`
 

boilerplate/openshift/golang-osd-e2e/standard.mk

@@ -64,6 +64,26 @@ e2e-binary-build:
 	go mod tidy
 	go test ./test/e2e -v -c --tags=osde2e -o e2e.test
 
+# Run e2e tests locally against a cluster accessible via KUBECONFIG.
+# Usage:
+#   make e2e-local                              # run all tests
+#   make e2e-local GINKGO_FOCUS="test name"     # run matching tests
+#   make e2e-local CLUSTER_ID=<id>              # use backplane for cluster access
+#
+# Requires: KUBECONFIG set, or CLUSTER_ID + ocm login for backplane access.
+.PHONY: e2e-local
+e2e-local: e2e-binary-build
+	@if [ -n "$(CLUSTER_ID)" ] && [ -z "$(KUBECONFIG)" ]; then \
+		echo "Logging into cluster $(CLUSTER_ID) via backplane..."; \
+		ocm backplane login $(CLUSTER_ID); \
+	fi
+	@echo "Running e2e tests against $${KUBECONFIG:-backplane cluster}..."
+	DISABLE_JUNIT_REPORT=true ./e2e.test \
+		--ginkgo.v \
+		--ginkgo.junit-report=e2e-local-junit.xml \
+		$(if $(GINKGO_FOCUS),--ginkgo.focus="$(GINKGO_FOCUS)") \
+		$(if $(GINKGO_LABEL_FILTER),--ginkgo.label-filter="$(GINKGO_LABEL_FILTER)")
+
 # push e2e image tagged as latest and as repo commit hash
 .PHONY: e2e-image-build-push
 e2e-image-build-push: container-engine-login

build/Dockerfile

@@ -8,7 +8,7 @@ COPY . .
 RUN make go-build
 
 ####
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1784705586
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1785339117
 
 ENV USER_UID=1001 \
     USER_NAME=ocm-agent-operator

build/Dockerfile.olm-registry

@@ -4,7 +4,7 @@ COPY ${SAAS_OPERATOR_DIR} manifests
 RUN initializer --permissive
 
 # ubi-micro does not work for clusters with fips enabled unless we make OpenSSL available
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1784705586
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1785339117
 
 COPY --from=builder /bin/registry-server /bin/registry-server
 COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe