OSAC-1739: Update osac-workspace and AI tooling for mono-repo

[tchughesiv]

OSAC-1739: Update osac-workspace and AI tooling for mono-repo

Jira: https://redhat.atlassian.net/browse/OSAC-1739

Summary

fulfillment-service, osac-operator, and osac-aap have been merged into
the new osac-project/osac mono-repo (per OSAC-1732's
per-component cutover plan). This PR updates osac-workspace — bootstrap.sh,
root docs, .claude/rules/, .skillsaw.yaml, kind-dev/, the create-pr and
peripheral skills, and tools/pr-notify/ — so cloning, routing, cross-component
workflow guidance, and PR automation correctly reflect the merged layout
instead of the old 3-separate-repo one. osac-installer and
bare-metal-fulfillment-operator are untouched — both remain standalone,
not yet merged (update incrementally as each cuts over, per the epic).

Changes

• bootstrap.sh / .gitignore — clone osac-project/osac once into
  osac/ instead of 3 separate repos; auto-quarantine (never delete) any
  pre-existing standalone clones of the 3 merged components to
  .legacy-repos/<name>/, preserving all local git state.
• Root docs (AGENTS.md, README.md) — component table, build/test
  commands, cross-component-change guidance, and architecture diagram
  updated for the mono-repo subdirectory layout. Also fixed a stale
  OpenShift deployment command referencing a manifests/ directory removed
  when the project switched to Helm.
• .claude/rules/*.md — routing tables and path references in
  cross-repo-workflow.md, protobuf-conventions.md, and cli-ux.md
  updated to the osac/-prefixed paths.
• .skillsaw.yaml — collapsed 3 per-component lint excludes into one
  osac/** entry; added .legacy-repos/**.
• kind-dev/ — path references updated; AAP scm_url now points at
  osac-project/osac with playbook paths prefixed osac-aap/ (AWX has no
  native subdirectory-scoped checkout).
• skills/create-pr/SKILL.md — Step 1 now detects which merged-component
  subdirectories a diff touches (a single PR can span more than one) instead
  of assuming "current repo = current component."
• tools/pr-notify/ — collapsed 3 monitored repos into
  osac-project/osac.
• Peripheral skills — design-review/SKILL.md and
  github-actions-workflows/{reference.md,scripts/self-check.sh} path/default
  updates. Fixed a latent bug in self-check.sh surfaced by the default-repo
  change (a failed gh api call's error body was being misread as success).

Testing

• Unit tests: tools/pr-notify's existing suite (59 tests) re-verified
  passing; no test code needed changes (repo-list handling is fully generic).
• Integration tests: N/A — this workspace has no build step or
  application code (shell/Markdown/YAML tooling only).
• Coverage: N/A for this repo type. Verification was functional/scripted:
  make skillsaw (0 errors/warnings), shellcheck on every modified script
  (no new issues vs. main), and a live end-to-end run — bootstrap.sh
  was actually executed against this real machine's pre-existing standalone
  clones (confirmed clean: no uncommitted/unpushed work) and against a fresh
  environment, successfully cloning osac/ and quarantining the old clones
  to .legacy-repos/ with git history fully intact and idempotently. Every
  literal path referenced in the updated docs/skills was verified to resolve
  against the real local osac/ clone. The create-pr skill's new
  multi-component detection logic was dry-run against a real multi-component
  commit inside the cloned osac repo and correctly identified both touched
  components.
• Full details: .artifacts/implement/OSAC-1739/05-validation-report.md.

Acceptance Criteria

• AC-1: bootstrap.sh clones the merged osac repo instead of 3 separate repos
• AC-2: Stale old-standalone-repo clones quarantined (moved, never deleted)
• AC-3: Root docs (AGENTS.md, README.md, CLAUDE.md) reflect new layout
• AC-4: .claude/rules/*.md component routing and paths updated
• AC-5: .skillsaw.yaml excludes match new layout
• AC-6: kind-dev/ paths and AAP scm_url resolve correctly
• AC-7: create-pr skill correctly detects/validates mono-repo PRs
• AC-8: pr-notify monitors the correct repo(s)
• AC-9: Peripheral skill references updated
• AC-10: Non-goals untouched (skills/osac-release/, .ai-bot/, osac-installer/, bare-metal-fulfillment-operator/, image-tag refs)

Summary by CodeRabbit

• New Features

  • Bootstrap now supports the consolidated OSAC workspace and safely quarantines existing standalone clones without deleting local state.
  • Development setup and validation workflows support changes across multiple components in the monorepo.

• Bug Fixes

  • Improved live tag validation to handle API failures safely and avoid treating error responses as valid data.

• Documentation

  • Updated paths, build instructions, deployment guidance, architecture references, and monitored repository examples for the consolidated workspace.
  • Deployment guidance now identifies Helm as the supported method.

[openshift-ci-robot]

@tchughesiv: This pull request references OSAC-1739 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

OSAC-1739: Update osac-workspace and AI tooling for mono-repo

Jira: https://redhat.atlassian.net/browse/OSAC-1739

Summary

fulfillment-service, osac-operator, and osac-aap have been merged into
the new osac-project/osac mono-repo (per OSAC-1732's
per-component cutover plan). This PR updates osac-workspace — bootstrap.sh,
root docs, .claude/rules/, .skillsaw.yaml, kind-dev/, the create-pr and
peripheral skills, and tools/pr-notify/ — so cloning, routing, cross-component
workflow guidance, and PR automation correctly reflect the merged layout
instead of the old 3-separate-repo one. osac-installer and
bare-metal-fulfillment-operator are untouched — both remain standalone,
not yet merged (update incrementally as each cuts over, per the epic).

Changes

• bootstrap.sh / .gitignore — clone osac-project/osac once into
  osac/ instead of 3 separate repos; auto-quarantine (never delete) any
  pre-existing standalone clones of the 3 merged components to
  .legacy-repos/<name>/, preserving all local git state.
• Root docs (AGENTS.md, README.md) — component table, build/test
  commands, cross-component-change guidance, and architecture diagram
  updated for the mono-repo subdirectory layout. Also fixed a stale
  OpenShift deployment command referencing a manifests/ directory removed
  when the project switched to Helm.
• .claude/rules/*.md — routing tables and path references in
  cross-repo-workflow.md, protobuf-conventions.md, and cli-ux.md
  updated to the osac/-prefixed paths.
• .skillsaw.yaml — collapsed 3 per-component lint excludes into one
  osac/** entry; added .legacy-repos/**.
• kind-dev/ — path references updated; AAP scm_url now points at
  osac-project/osac with playbook paths prefixed osac-aap/ (AWX has no
  native subdirectory-scoped checkout).
• skills/create-pr/SKILL.md — Step 1 now detects which merged-component
  subdirectories a diff touches (a single PR can span more than one) instead
  of assuming "current repo = current component."
• tools/pr-notify/ — collapsed 3 monitored repos into
  osac-project/osac.
• Peripheral skills — design-review/SKILL.md and
  github-actions-workflows/{reference.md,scripts/self-check.sh} path/default
  updates. Fixed a latent bug in self-check.sh surfaced by the default-repo
  change (a failed gh api call's error body was being misread as success).

Testing

• Unit tests: tools/pr-notify's existing suite (59 tests) re-verified
  passing; no test code needed changes (repo-list handling is fully generic).
• Integration tests: N/A — this workspace has no build step or
  application code (shell/Markdown/YAML tooling only).
• Coverage: N/A for this repo type. Verification was functional/scripted:
  make skillsaw (0 errors/warnings), shellcheck on every modified script
  (no new issues vs. main), and a live end-to-end run — bootstrap.sh
  was actually executed against this real machine's pre-existing standalone
  clones (confirmed clean: no uncommitted/unpushed work) and against a fresh
  environment, successfully cloning osac/ and quarantining the old clones
  to .legacy-repos/ with git history fully intact and idempotently. Every
  literal path referenced in the updated docs/skills was verified to resolve
  against the real local osac/ clone. The create-pr skill's new
  multi-component detection logic was dry-run against a real multi-component
  commit inside the cloned osac repo and correctly identified both touched
  components.
• Full details: .artifacts/implement/OSAC-1739/05-validation-report.md.

Acceptance Criteria

• AC-1: bootstrap.sh clones the merged osac repo instead of 3 separate repos
• AC-2: Stale old-standalone-repo clones quarantined (moved, never deleted)
• AC-3: Root docs (AGENTS.md, README.md, CLAUDE.md) reflect new layout
• AC-4: .claude/rules/*.md component routing and paths updated
• AC-5: .skillsaw.yaml excludes match new layout
• AC-6: kind-dev/ paths and AAP scm_url resolve correctly
• AC-7: create-pr skill correctly detects/validates mono-repo PRs
• AC-8: pr-notify monitors the correct repo(s)
• AC-9: Peripheral skill references updated
• AC-10: Non-goals untouched (skills/osac-release/, .ai-bot/, osac-installer/, bare-metal-fulfillment-operator/, image-tag refs)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tchughesiv

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tchughesiv]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The workspace now treats osac as the monorepository for fulfillment-service, osac-operator, and osac-aap. Bootstrap quarantines legacy clones. Development setup, validation skills, self-checks, monitoring, and documentation use the new paths and repository defaults.

Changes

OSAC monorepo migration

Layer / File(s)	Summary
Workspace guidance and layout .claude/rules/*, .design/*, .gitignore, .skillsaw.yaml, AGENTS.md, README.md	Documentation, ignore rules, architecture guidance, API paths, and deployment instructions now describe the osac/ monorepository.
Bootstrap repository migration bootstrap.sh	Bootstrap clones osac and moves verified standalone component clones to .legacy-repos without deleting them.
Kind development setup kind-dev/*	Kind setup paths, AWX configuration, playbooks, charts, fake CRDs, and CLI commands now use the monorepository layout.
Validation and review workflows skills/create-pr/SKILL.md, skills/design-review/SKILL.md	The skills detect all touched OSAC components, run matching validation blocks, and distinguish monorepo changes from external repository coordination.
Repository self-check and notification defaults skills/github-actions-workflows/*, tools/pr-notify/*	Self-checks and PR notifications now default to osac-project/osac. Tag resolution validates GitHub API command success before parsing responses.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• osac-project/osac-workspace#81: Updates the same workspace layout and bootstrap behavior.
• osac-project/osac-workspace#121: Updates shared API documentation path guidance.
• osac-project/osac-workspace#160: Updates shared OSAC monorepo guidance.

Suggested reviewers: larsks, trewest, batzionb

🚥 Pre-merge checks | ✅ 9 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 44.44% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Ai-Attribution	⚠️ Warning	AI use is documented, but commit 0510ac2 lacks an Assisted-by/Generated-by trailer; the other 11 PR commits use Assisted-by and none use Co-Authored-By.	Add Assisted-by: Claude Code <noreply@anthropic.com> or a valid Generated-by trailer to commit 0510ac2, then recheck the PR commit range.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the workspace and AI tooling updates for the mono-repository migration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PR additions contain no API keys, private keys, credential URLs, vendor-token formats, or long base64 blobs; credential headers use generated variables, and local-dev password literals predate the PR.
No-Weak-Crypto	✅ Passed	The complete PR diff adds no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons; the only crypto use is existing RSA-2048 certificate generation.
No-Injection-Vectors	✅ Passed	The complete feature diff adds no SQL concatenation, eval/exec, pickle.loads, yaml.load, os.system, shell=True, or dangerouslySetInnerHTML; structural and added-line scans found no matches.
Container-Privileges	✅ Passed	The PR diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root directives. Rootful Podman references are documented host requirements, not container set...
No-Sensitive-Data-In-Logs	✅ Passed	Changed logs contain fixed repo/path messages and GitHub tag diagnostics; AWX responses and bearer-token requests are not printed, and no passwords, tokens, PII, or customer data are logged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/rules/cross-repo-workflow.md:
- Around line 25-30: Update the git worktree setup commands in the documented
workflow to create feature-branch from HEAD when adding the worktree by using
the branch-creation option with git worktree add; leave the subsequent directory
change and cleanup commands unchanged.

In @.gitignore:
- Line 60: Retain the root-scoped ignore rules for fulfillment-service/,
osac-operator/, and osac-aap/ in .gitignore at lines 60-60 until legacy
quarantine completes. Also retain the matching Skillsaw exclusions in
.skillsaw.yaml at lines 388-391 during the same migration window; update both
sites and do not remove these protections.

In `@kind-dev/setup.sh`:
- Line 1072: Update the existing osac-aap project fallback in setup.sh to patch
its scm_url to https://github.com/osac-project/osac.git, trigger a project sync,
and validate every API response. Reconcile same-named job templates to use the
monorepo playbook paths, or delete and recreate them when updating is not
supported, ensuring failures stop execution rather than leaving stale AWX
resources.

In `@skills/create-pr/SKILL.md`:
- Line 3: Update the validation steps in SKILL.md for the fulfillment-service
and osac-aap component blocks to match each component’s AGENTS.md matrix: add
`uv run dev.py lint` for fulfillment-service, add `make test` for osac-aap, and
invoke ansible-lint through `uv run ansible-lint` instead of directly. Ensure
every affected component runs its complete required validation before the PR
workflow proceeds.
- Around line 134-144: Update the file-matching rules in the classification step
to explicitly cover osac-aap production plugins under osac-aap/plugins/**/*.py
and root-level AAP tests under osac-aap/test_*.py, preserving the osac-aap/
prefix in every pattern. Ensure Step 3 uses these mappings so changed Python
files are classified without false unmatched-file warnings.
- Around line 49-53: Update the TOUCHED_COMPONENTS pipeline to preserve failures
from git diff while still treating no matching component directories as an empty
result. Remove the trailing || true and use a filtering approach that returns
success when there are no matches, without masking upstream failures.

In `@skills/github-actions-workflows/scripts/self-check.sh`:
- Around line 139-142: Update the tag-reference lookups in the self-check flow
around ref_json and GUARDED_SHA so gh api diagnostics are preserved instead of
redirected to /dev/null. Capture each command’s combined output and include the
diagnostic text in the corresponding skip or failure message, while retaining
the existing behavior for successful lookups and expected non-tag cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9b9215dd-c26c-4066-8343-9513c1b7aeb8

📥 Commits

Reviewing files that changed from the base of the PR and between 07cf78f and 0510ac2.

📒 Files selected for processing (18)

• .claude/rules/cli-ux.md
• .claude/rules/cross-repo-workflow.md
• .claude/rules/protobuf-conventions.md
• .design/context/osac-dimensions.md
• .design/templates/section-guidance.md
• .gitignore
• .skillsaw.yaml
• AGENTS.md
• README.md
• bootstrap.sh
• kind-dev/README.md
• kind-dev/setup.sh
• skills/create-pr/SKILL.md
• skills/design-review/SKILL.md
• skills/github-actions-workflows/reference.md
• skills/github-actions-workflows/scripts/self-check.sh
• tools/pr-notify/README.md
• tools/pr-notify/config.example.toml

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

skills/create-pr/SKILL.md (1)

214-217: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add the missing AI commit trailer.

0510ac2 OSAC-1739: address cross-cutting review findings has Signed-off-by: but no Red Hat-accepting AI trailer. Add Generated-by: or Assisted-by: with the Red Hat identity for this commit. No Co-Authored-By: AI trailer was found.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/create-pr/SKILL.md` around lines 214 - 217, Update the commit guidance
for the shared osac mono-repo PR flow around the cross-cutting review commit to
require a Red Hat-accepted AI trailer, using either Generated-by: or
Assisted-by: with the appropriate Red Hat identity alongside Signed-off-by:.

Sources: Coding guidelines, Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@skills/create-pr/SKILL.md`:
- Around line 214-217: Update the commit guidance for the shared osac mono-repo
PR flow around the cross-cutting review commit to require a Red Hat-accepted AI
trailer, using either Generated-by: or Assisted-by: with the appropriate Red Hat
identity alongside Signed-off-by:.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce28ea20-3c8f-4a65-804a-66c680973f6a

📥 Commits

Reviewing files that changed from the base of the PR and between 0510ac2 and 61085a6.

📒 Files selected for processing (6)

• .claude/rules/cross-repo-workflow.md
• .gitignore
• .skillsaw.yaml
• kind-dev/setup.sh
• skills/create-pr/SKILL.md
• skills/github-actions-workflows/scripts/self-check.sh