OPCT-403: bump OPCT CLI image to v0.6.6

[bshaw7]

Summary

• Update OPCT_CLI_IMAGE from v0.6.5 to v0.6.6 in all 3 OPCT CI workflow files
• v0.6.6 release includes: web UI fixes (OPCT-422), retrieve/leak detection fixes (OPCT-423), OCP 5 kube conformance fix (OPCT-426), archive redaction fix (OPCT-428), CI image verification (OPCT-410), and version matrix docs (OPCT-389)

Files changed

• ci-operator/step-registry/opct/conformance/external-aws/opct-conformance-external-aws-workflow.yaml
• ci-operator/step-registry/opct/test/platform-none-vsphere/opct-test-platform-none-vsphere-workflow.yaml
• ci-operator/step-registry/opct/test/platform-external-vsphere/opct-test-platform-external-vsphere-workflow.yaml

References

• CLI release: https://github.com/redhat-openshift-ecosystem/opct/releases/tag/v0.6.6
• Jira: https://redhat.atlassian.net/browse/OPCT-403

Signed-off-by: Bikash Shaw bshaw@redhat.com

Summary by CodeRabbit

Updates the OPCT CLI image from v0.6.5 to v0.6.6 in three OpenShift CI OPCT workflows for external AWS conformance and external/none vSphere testing. This enables the workflows to consume the latest OPCT release, including web UI, detection, conformance, redaction, image verification, and documentation fixes.

[openshift-ci-robot]

@bshaw7: This pull request references OPCT-403 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Update OPCT_CLI_IMAGE from v0.6.5 to v0.6.6 in all 3 OPCT CI workflow files
• v0.6.6 release includes: web UI fixes (OPCT-422), retrieve/leak detection fixes (OPCT-423), OCP 5 kube conformance fix (OPCT-426), archive redaction fix (OPCT-428), CI image verification (OPCT-410), and version matrix docs (OPCT-389)

Files changed

• ci-operator/step-registry/opct/conformance/external-aws/opct-conformance-external-aws-workflow.yaml
• ci-operator/step-registry/opct/test/platform-none-vsphere/opct-test-platform-none-vsphere-workflow.yaml
• ci-operator/step-registry/opct/test/platform-external-vsphere/opct-test-platform-external-vsphere-workflow.yaml

References

• CLI release: https://github.com/redhat-openshift-ecosystem/opct/releases/tag/v0.6.6
• Jira: https://redhat.atlassian.net/browse/OPCT-403

Signed-off-by: Bikash Shaw bshaw@redhat.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b72c7c64-457d-49e3-86ee-98bf6b0c14a8

📥 Commits

Reviewing files that changed from the base of the PR and between f2ed312 and 6ced6f2.

📒 Files selected for processing (3)

• ci-operator/step-registry/opct/conformance/external-aws/opct-conformance-external-aws-workflow.yaml
• ci-operator/step-registry/opct/test/platform-external-vsphere/opct-test-platform-external-vsphere-workflow.yaml
• ci-operator/step-registry/opct/test/platform-none-vsphere/opct-test-platform-none-vsphere-workflow.yaml

---

Walkthrough

Three OPCT workflow definitions update OPCT_CLI_IMAGE from quay.io/opct/opct:v0.6.5 to quay.io/opct/opct:v0.6.6.

Changes

OPCT CLI image update

Layer / File(s)	Summary
Update OPCT workflow image tags ci-operator/step-registry/opct/...	The external AWS, external vSphere, and none-platform vSphere workflows now use the OPCT CLI image tagged v0.6.6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating the OPCT CLI image to v0.6.6.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only bumps OPCT_CLI_IMAGE in three workflow YAMLs; no Ginkgo test titles or test files were changed.
Test Structure And Quality	✅ Passed	PR only bumps OPCT image tags in three YAML workflow files; no Ginkgo/Go test code changed, so the test-quality checklist is not applicable.
Microshift Test Compatibility	✅ Passed	PR only updates OPCT_CLI_IMAGE in workflow YAML; no Ginkgo test declarations or MicroShift-relevant APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only workflow YAML image tags changed; no new or modified Ginkgo e2e tests, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only OPCT_CLI_IMAGE was bumped in three workflow YAMLs; no scheduling, affinity, nodeSelector, replicas, or topology logic was added.
Ote Binary Stdout Contract	✅ Passed	Only workflow YAML changed; no process-level binaries or stdout writes were touched, so the OTE stdout contract isn’t implicated.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only three OPCT workflow YAMLs changed; no new Ginkgo tests or networking logic were added, so the IPv6/disconnected test check is not applicable.
No-Weak-Crypto	✅ Passed	Diff only bumps OPCT_CLI_IMAGE v0.6.5→v0.6.6 in three YAML workflows; no weak-crypto code or patterns were added.
Container-Privileges	✅ Passed	The three changed YAML workflows only update OPCT_CLI_IMAGE to v0.6.6; no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation fields are present.
No-Sensitive-Data-In-Logs	✅ Passed	The commit only bumps OPCT_CLI_IMAGE in 3 workflow YAMLs; no logging code or sensitive data fields were added or modified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@bshaw7: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-release-main-nightly-4.22-opct-platform-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.21-upgrade-from-stable-4.20-opct-platform-external-aws-upgrade	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.21-platform-external-vsphere-upgrade	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.17-opct-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.18-opct-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-5.0-opct-platform-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.21-platform-none-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-5.0-opct-platform-external-aws	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.22-platform-none-vsphere-upgrade	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.23-opct-platform-external-aws	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.21-opct-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.20-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.17-platform-none-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.21-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.16-opct-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.17-platform-external-vsphere-upgrade	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.20-opct-external-aws-ccm	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-none-vsphere	N/A	periodic	Registry content changed
periodic-ci-openshift-release-main-nightly-4.19-upgrade-from-stable-4.18-opct-platform-external-aws-upgrade	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.17-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.22-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.19-platform-external-vsphere	N/A	periodic	Registry content changed
periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-none-vsphere-upgrade	N/A	periodic	Registry content changed

A total of 35 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[vr4manta]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bshaw7, vr4manta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/opct/OWNERS [bshaw7]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bshaw7]

/pj-rehearse periodic-ci-openshift-release-main-nightly-4.22-opct-platform-external-aws-ccm periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade

[openshift-merge-bot]

@bshaw7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@bshaw7: job(s): , periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade either don't exist or were not found to be affected, and cannot be rehearsed

[bshaw7]

/pj-rehearse periodic-ci-openshift-release-main-nightly-4.22-opct-platform-external-aws-ccm periodic-ci-redhat-openshift-ecosystem-opct-main-4.21-platform-external-vsphere

[openshift-merge-bot]

@bshaw7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[bshaw7]

/pj-rehearse periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade

[openshift-merge-bot]

@bshaw7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@bshaw7: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade	6ced6f2	link	unknown	/pj-rehearse periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bshaw7]

/pj-rehearse periodic-ci-openshift-release-main-nightly-4.21-upgrade-from-stable-4.20-opct-platform-external-aws-upgrade periodic-ci-openshift-release-main-nightly-5.0-opct-platform-external-aws-ccm periodic-ci-openshift-release-main-nightly-5.0-opct-platform-external-aws periodic-ci-openshift-release-main-nightly-4.21-opct-external-aws-ccm periodic-ci-openshift-release-main-nightly-4.20-opct-external-aws-ccm

[openshift-merge-bot]

@bshaw7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[bshaw7]

Rehearsal Results

| Round | Version | Job Type | CI Result | P10 (kube-conformance) | P20 (conformance-validated) | Notes |
|-------|---------|----------|-----------|------------------------|----------------------------|-------|
| R1 | 4.22 | platform-external-aws-ccm | SUCCESS | 387 (387p/0f) | 1,974 (1,963p/11f) | |
| R1 | 4.21 | platform-external-vsphere | SUCCESS | 387 (387p/0f) | 1,974 (1,963p/11f) | |
| R1 | 4.22 | upgrade-from-4.21-aws | FAILURE | — | — | Infra: cluster never installed (API unreachable) |
| R2 | 5.0 | platform-external-aws-ccm | SUCCESS | 412 (412p/0f) | 2,362 (2,338p/24f) | |
| R2 | 5.0 | platform-external-aws | SUCCESS | 412 (412p/0f) | 2,361 (2,337p/24f) | |
| R2 | 4.21 | external-aws-ccm | SUCCESS | 387 (387p/0f) | 1,975 (1,963p/12f) | |
| R2 | 4.20 | external-aws-ccm | SUCCESS | 384 (383p/1f) | 1,812 (1,800p/12f) | |
|-------|---------|----------|-----------|------------------------|----------------------------|-------|

OPCT-426 — setSuiteName fix (conformance test counts) — PASS

PR: redhat-openshift-ecosystem/opct#221

This was the critical fix for the broken 742-test pattern where OCP 5.x suite names were not being resolved during dry-run.

Expected: kube-conformance ~384-436 tests, conformance-validated ~1,812-4,069 tests (varies by OCP version). Must NOT show 0 or 742.

Result: All test counts are healthy across 4.20, 4.21, 4.22, and 5.0. No job shows the broken 0 or 742 pattern.

OPCT-428 — leaktk archive redaction fix (mco-sanitize) — PASS

PRs: redhat-openshift-ecosystem/opct#223, redhat-openshift-ecosystem/provider-certification-plugins#88, redhat-openshift-ecosystem/provider-certification-plugins#91

The mco-sanitize binary was added to plugin-artifacts-collector to redact machineconfig secrets (pull secrets, JWTs in ignition config) before archiving, preventing leaktk-gcs-filter from replacing the archive with a 76-byte placeholder.

Expected: OPCT archive should be a real tarball (~60+ MB), NOT 76 bytes.

[bshaw7]

/pj-rehearse ack

[openshift-merge-bot]

@bshaw7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[bshaw7]

This rehearsal job periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade has never passed — all 8 recorded runs (2026-06-07 through 2026-07-26) are failures. The failure is in the platform-external-cluster-wait-for-api-bootstrap step: cluster installs via CloudFormation but the API server never becomes reachable, timing out after 20 minutes. This is unrelated to this PR which only bumps OPCT_CLI_IMAGE from v0.6.5 to v0.6.6.

/override ci/rehearse/periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade

[openshift-ci]

@bshaw7: bshaw7 unauthorized: /override is restricted to Repo administrators, approvers in top level OWNERS file, and the following github teams:openshift: openshift-release-oversight openshift-staff-engineers openshift-sustaining-engineers.

Details

In response to this:

This rehearsal job periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade has never passed — all 8 recorded runs (2026-06-07 through 2026-07-26) are failures. The failure is in the platform-external-cluster-wait-for-api-bootstrap step: cluster installs via CloudFormation but the API server never becomes reachable, timing out after 20 minutes. This is unrelated to this PR which only bumps OPCT_CLI_IMAGE from v0.6.5 to v0.6.6.

/override ci/rehearse/periodic-ci-openshift-release-main-nightly-4.22-upgrade-from-stable-4.21-opct-platform-external-aws-upgrade

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.