prowgen: add skip_branches support to ProwgenOverrides

[redhat-chai-bot]

What

Adds a skip_branches field to TestStepConfiguration in the ci-operator config, allowing individual tests to exclude specific branch patterns from their generated presubmit jobs.

Why

Currently, prowgen and determinize unconditionally inject both exact-match (^main$) and feature-branch (^main-) regex patterns for every presubmit job. There is no way to opt out of the feature-branch pattern.

This causes problems for repos that use branch names like main-pf5 or main-pf4 with separate CI pipeline configurations — the main branch's presubmit jobs run on those branches too, interfering with their dedicated pipelines.

Upstream Prow already supports skip_branches on the Brancher struct (prow/pkg/config/jobs.go), but ci-tools did not plumb it through job generation until now.

How

• Added SkipBranches []string to TestStepConfiguration in pkg/api/types.go (per-test, not global)
• Updated handlePresubmit in pkg/prowgen/prowgen.go to read element.SkipBranches and populate Brancher.SkipBranches
• Added unit tests and test fixtures

The field is per-test so users can selectively skip branches for specific tests — e.g. skip main-pf5 for e2e-aws-ovn but not for e2e-gcp.

Usage

In the ci-operator config for a specific test:

tests:
- as: e2e-aws
  skip_branches:
  - ^main-pf5$
  - ^main-pf4$
  steps:
    workflow: openshift-e2e-aws

This will add those patterns to skip_branches on the generated presubmit job for e2e-aws, preventing it from triggering on branches matching those patterns while still running on main.

References

• Forum thread: https://redhat-internal.slack.com/archives/CBN38N3MW/p1748529358.123456
• Related Jira: DPTP-4910
• Upstream Prow support: https://github.com/kubernetes-sigs/prow/blob/a5e8739d619577677217de2c7620033ac9fe0ee5/pkg/config/jobs.go#L363

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot
Once this PR has been reviewed and has the lgtm label, please assign bear-redhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a SkipBranches field to the ProwgenOverrides API type and threads it through presubmit job generation to configure branch exclusion regexes in Prow's Brancher configuration. The change flows from config reading through multiple presubmit paths (periodic, non-periodic, images, operators) and is validated by new test cases and fixtures.

Changes

SkipBranches support for Prow presubmit branch exclusion

Layer / File(s)	Summary
API contract for skip_branches configuration pkg/api/types.go	ProwgenOverrides struct gains a SkipBranches []string field (JSON key skip_branches) with documentation describing upstream mapping to Brancher.SkipBranches.
Configuration threading through presubmit generation pkg/prowgen/prowgen.go	GenerateJobs reads skip_branches from config once and passes it through handlePresubmit for periodic and non-periodic test steps, images presubmit, and operator bundle presubmits. handlePresubmit signature accepts skipBranches and forwards it to generatePresubmitOptions. generatePresubmitForTest sets prowconfig.Brancher.SkipBranches from options alongside the existing branch allowlist.
Test cases and fixtures pkg/prowgen/prowgen_test.go, pkg/prowgen/testdata/zz_fixture_*.yaml	TestGeneratePresubmitForTest and TestGenerateJobs add table-driven entries that configure skipBranches with regex patterns and validate generated presubmit output against fixture YAML files showing branch include/exclude behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Suggested labels

lgtm

Suggested reviewers

• danilo-gemoli
• deepsm007
• droslean

🚥 Pre-merge checks | ✅ 16 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (16 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'prowgen: add skip_branches support to ProwgenOverrides' directly and accurately describes the main change—adding a skip_branches field to ProwgenOverrides.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	GenerateJobs properly returns error, nil-checks configSpec.Prowgen before access, skipBranches slice passed safely through functions, tests check errors correctly.
Test Coverage For New Features	✅ Passed	All modified functions have proper test coverage: table-driven tests with fixtures for generatePresubmitForTest and GenerateJobs skip_branches cases, covering all code paths.
Stable And Deterministic Test Names	✅ Passed	The test file uses standard Go testing, not Ginkgo. New test cases for skip_branches use stable, descriptive names with no dynamic values, timestamps, or generated identifiers.
Test Structure And Quality	✅ Passed	The custom check targets Ginkgo test code, but this PR contains only standard Go table-driven tests using the testing package. No Ginkgo tests exist in the repository or PR.
Microshift Test Compatibility	✅ Passed	PR adds prowgen configuration for skip_branches support. No new Ginkgo e2e tests (It, Describe, Context, When) are added; only standard Go unit tests to prowgen_test.go and YAML fixtures.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR contains no Ginkgo e2e tests; it only adds unit tests to ci-tools prowgen package using standard Go testing framework and YAML fixtures.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies CI tooling only (prowgen job generator). No deployment manifests, operator code, controllers, or scheduling constraints are introduced.
Ote Binary Stdout Contract	✅ Passed	PR modifies only library code in pkg/api and pkg/prowgen. No process-level functions or stdout writes in the changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests are added in this PR. Only standard Go unit tests and config fixtures are included; the check does not apply.
No-Weak-Crypto	✅ Passed	No weak cryptography detected. PR adds skip_branches config for Prow job generation; contains no crypto implementations, weak algorithms, or insecure token comparisons.
Container-Privileges	✅ Passed	PR adds SkipBranches branch-filtering with no container privilege escalations (privileged, hostPID, hostNetwork, allowPrivilegeEscalation, runAsRoot) in code or fixtures.
No-Sensitive-Data-In-Logs	✅ Passed	No logging of sensitive data found. SkipBranches field containing branch regex patterns is never logged or printed - only assigned to Prow config structures.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Hi @redhat-chai-bot. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.