shiftstack/liveliness: fix yq syntax for mikefarah yq in scripts image

[IlanZuckerman]

#83891 used kislyuk yq flags (--yaml-output) but this step runs in shiftstack-scripts-image, which ships mikefarah yq via dnf. This cause the yq to fail with: Error: unknown flag: --yaml-output

Here is an example of the failure in the most recent CI runs: https://storage.googleapis.com/test-platform-results/logs/periodic-ci-shiftstack-ci-main-liveliness-mecha-central/2092718191812808704/build-log.txt

Here is the proof that this PR fixes the issue:

Before the fix (when using the --yaml-output):

[root@54022fbd2290 /]# yq --version
yq (https://github.com/mikefarah/yq/) version v4.53.3

[root@54022fbd2290 /]# cat > /tmp/clouds.yaml <<'EOF'
clouds:
  openstack:
    verify: true
EOF
[root@54022fbd2290 /]# 
[root@54022fbd2290 /]# yq --yaml-output --in-place '.clouds["openstack"].verify = false' /tmp/clouds.yaml
Error: unknown flag: --yaml-output
.
.
.

After the fix (when using the -i):

[root@54022fbd2290 /]# cat > /tmp/clouds.yaml <<'EOF'
clouds:
  openstack:
    verify: true
EOF
[root@54022fbd2290 /]# yq -i '.clouds["openstack"].verify = false' /tmp/clouds.yaml
[root@54022fbd2290 /]# echo $?
0
[root@54022fbd2290 /]# yq '.clouds.openstack.verify' /tmp/clouds.yaml
false

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d6cfbdf-dfa7-488b-8357-4e11d7f4906a

📥 Commits

Reviewing files that changed from the base of the PR and between 3073dd4 and b56ca87.

📒 Files selected for processing (1)

• ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The ShiftStack liveliness command now uses yq -i to update the selected cloud configuration in place. The command still sets TLS verification to false.

Changes

ShiftStack liveliness command

Layer / File(s)	Summary
Update cloud configuration command ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh	The yq command uses -i instead of --yaml-output --in-place while preserving the TLS verification update.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to b56ca

This one-line script change corrects the yq command syntax for the image’s installed implementation; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: dlaw4608

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only one shell command in shiftstack-liveliness-commands.sh: it replaces yq --yaml-output --in-place with yq -i. The diff contains no Ginkgo tests or test-title co…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh. The one-line change updates a yq command from --yaml-output --in-place to `…
Microshift Test Compatibility	✅ Passed	The pull request changes only one shell command in shiftstack-liveliness-commands.sh: it changes the yq flags. The diff adds no Ginkgo e2e tests, OpenShift API references, namespaces, or MicroShif…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh. It replaces yq --yaml-output --in-place with yq -i. The commit adds no Gink…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh. It replaces yq --yaml-output --in-place with yq -i. The diff adds no deployment manifest, controller, …
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh, replacing yq --yaml-output --in-place with yq -i. The affected workflow runs this shell step from `shi…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh, replacing yq --yaml-output --in-place with yq -i. The parent-to-HEAD diff adds no Ginkgo tests and con…
No-Weak-Crypto	✅ Passed	The pull request changes only the yq flags on the existing clouds.yaml update. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret-comparison logic. The exist…
Container-Privileges	✅ Passed	PASS: The pull request changes only the yq command in shiftstack-liveliness-commands.sh, replacing --yaml-output --in-place with -i. The exact diff adds no privileged, host namespace, `SYS_A…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request changes only the yq flags in the liveliness script. The command updates ${SHARED_DIR}/clouds.yaml in place and does not log its contents or credentials. The script has no sh…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the affected component and the main change: correcting yq syntax for the mikefarah yq implementation used by the scripts image.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request changes only one shell command in shiftstack-liveliness-commands.sh: it replaces yq --yaml-output --in-place with yq -i. The diff contains no Ginkgo tests or test-title constructs, so it introduces no unstable test names.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh. The one-line change updates a yq command from --yaml-output --in-place to -i. It introduces no Ginkgo test code, It blocks, setup, cleanup, waits, or assertions. Therefore, this test-structure check is not applicable.

Full details: Microshift Test Compatibility

Explanation

The pull request changes only one shell command in shiftstack-liveliness-commands.sh: it changes the yq flags. The diff adds no Ginkgo e2e tests, OpenShift API references, namespaces, or MicroShift feature assumptions. The MicroShift Test Compatibility check is therefore not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only ci-operator/step-registry/shiftstack/liveliness/shiftstack-liveliness-commands.sh. It replaces yq --yaml-output --in-place with yq -i. The commit adds no Ginkgo e2e tests and introduces no multi-node or HA assumptions. Therefore, the SNO test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh. It replaces yq --yaml-output --in-place with yq -i. The diff adds no deployment manifest, controller, operator code, replica setting, affinity, topology spread constraint, node selector, toleration, or PDB. The topology-aware scheduling check is not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh, replacing yq --yaml-output --in-place with yq -i. The affected workflow runs this shell step from shiftstack-scripts-image; it does not add or modify an OTE Go binary, suite setup, or process-level Go stdout write. The OTE Binary Stdout Contract therefore does not apply.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only one shell command in shiftstack-liveliness-commands.sh, replacing yq --yaml-output --in-place with yq -i. The parent-to-HEAD diff adds no Ginkgo tests and contains no It(), Describe(), Context(), or When() constructs. The custom check therefore does not apply.

Full details: No-Weak-Crypto

Explanation

The pull request changes only the yq flags on the existing clouds.yaml update. The diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret-comparison logic. The existing verify = false setting is unchanged and is not one of the listed failure conditions.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only the yq command in shiftstack-liveliness-commands.sh, replacing --yaml-output --in-place with -i. The exact diff adds no privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or security-context settings. The associated step manifests also contain no listed privilege declarations.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The pull request changes only the yq flags in the liveliness script. The command updates ${SHARED_DIR}/clouds.yaml in place and does not log its contents or credentials. The script has no shell tracing, and its existing messages contain no passwords, tokens, API keys, PII, session IDs, hostnames, or customer data. The step configuration confirms that OS_CLOUD is a cloud name, not a secret.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: IlanZuckerman
Once this PR has been reviewed and has the lgtm label, please assign stephenfin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/shiftstack/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@IlanZuckerman: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-shiftstack-ci-main-liveliness-mecha-central	N/A	periodic	Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[IlanZuckerman]

/pj-rehearse periodic-ci-shiftstack-ci-main-liveliness-mecha-central

[openshift-merge-bot]

@IlanZuckerman: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[IlanZuckerman]

/pj-rehearse ack

[IlanZuckerman]

/pj-rehearse ack

[openshift-merge-bot]

@IlanZuckerman: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@IlanZuckerman: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[IlanZuckerman]

Closing as not needed. See #84164