From 84e1e896bd8650ab8b6d375f935218234c046238 Mon Sep 17 00:00:00 2001
From: Ciaran Roche <croche@redhat.com>
Date: Tue, 13 Oct 2026 15:19:23 +0100
Subject: [PATCH] openshift-hyperfleet: run verify-owners on architecture PRs
 that touch the ownership source

Adds a verify-owners presubmit for openshift-hyperfleet/architecture that
runs make verify-owners when a PR changes owners.yaml, owners.md, the
working agreement, the generator under hack/owners or the Makefile. The
target checks the generated area table and the criteria copy are in sync
with owners.yaml and that every path's approvers match its area. The
build root gains make and python3-pyyaml for it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 ...penshift-hyperfleet-architecture-main.yaml |  7 +-
 ...perfleet-architecture-main-presubmits.yaml | 64 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/ci-operator/config/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main.yaml b/ci-operator/config/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main.yaml
index ae760fd1a93f..d81af427df80 100644
--- a/ci-operator/config/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main.yaml
+++ b/ci-operator/config/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main.yaml
@@ -3,7 +3,7 @@ build_root:
     dockerfile_literal: |
       FROM registry.access.redhat.com/ubi9/ubi:latest
       RUN dnf module enable -y nodejs:20 && \
-            dnf install -y git npm python3-pip && \
+            dnf install -y git make npm python3-pip python3-pyyaml && \
             npm install -g markdownlint-cli2 markdown-link-check && \
             pip3 install yamllint
 resources:
@@ -24,6 +24,11 @@ tests:
   commands: hack/linkcheck.sh
   container:
     from: src
+- as: verify-owners
+  commands: make verify-owners
+  container:
+    from: src
+  run_if_changed: ^(Makefile|hack/owners/|hyperfleet/docs/(owners\.(yaml|md)|working-agreement\.md))
 zz_generated_metadata:
   branch: main
   org: openshift-hyperfleet
diff --git a/ci-operator/jobs/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main-presubmits.yaml b/ci-operator/jobs/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main-presubmits.yaml
index a89d2456ef02..84a91bb91441 100644
--- a/ci-operator/jobs/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift-hyperfleet/architecture/openshift-hyperfleet-architecture-main-presubmits.yaml
@@ -126,6 +126,70 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )markdownlint,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build01
+    context: ci/prow/verify-owners
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-hyperfleet-architecture-main-verify-owners
+    rerun_command: /test verify-owners
+    run_if_changed: ^(Makefile|hack/owners/|hyperfleet/docs/(owners\.(yaml|md)|working-agreement\.md))
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --target=verify-owners
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )verify-owners,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches: