HYPERFLEET-1510: Restrict PR approvals to tech leads only

[rafabene]

What

Restrict who can approve pull requests in the architecture repository to tech leads only, by narrowing the approvers list in the Prow OWNERS file.

Why

Ensures that changes to the architecture documentation — the single source of truth — are approved only by those who hold the technical vision of the system, reducing the risk of inconsistent or misaligned architectural decisions landing in the repository.

Changes

• Approvers list narrowed from 18 to 4 tech leads: ciaranRoche, mbrudnoy, rafabene, rh-amarin
• Reviewers list unchanged (18 members) — team may still review

Acceptance Criteria

• OWNERS approvers list contains only the designated tech leads
• reviewers list retained for broader review
• Verified with a test PR: /approve from a non-tech-lead does not satisfy the approval gate; /approve from a tech lead does

Jira: https://redhat.atlassian.net/browse/HYPERFLEET-1510

[openshift-ci-robot]

@rafabene: This pull request references HYPERFLEET-1510 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

What

Restrict who can approve pull requests in the architecture repository to tech leads only, by narrowing the approvers list in the Prow OWNERS file.

Why

Ensures that changes to the architecture documentation — the single source of truth — are approved only by those who hold the technical vision of the system, reducing the risk of inconsistent or misaligned architectural decisions landing in the repository.

Changes

• Approvers list narrowed from 18 to 4 tech leads: ciaranRoche, mbrudnoy, rafabene, rh-amarin
• Reviewers list unchanged (18 members) — team may still review

Acceptance Criteria

• OWNERS approvers list contains only the designated tech leads
• reviewers list retained for broader review
• Verified with a test PR: /approve from a non-tech-lead does not satisfy the approval gate; /approve from a tech lead does

Jira: https://redhat.atlassian.net/browse/HYPERFLEET-1510

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign vkareh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c2cc21f1-2df4-4c40-bef3-0f918db54257

📥 Commits

Reviewing files that changed from the base of the PR and between 0c20f64 and 477401d.

📒 Files selected for processing (1)

• OWNERS

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

💤 Files with no reviewable changes (1)

• OWNERS

Included review availability: Your plan includes up to 12 reviews per rolling hour; 11 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated the code review approval configuration to reflect the current approver list.

Walkthrough

The OWNERS file now lists four approvers: ciaranRoche, mbrudnoy, rafabene, and rh-amarin. The reviewers list remains unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 47740

This localized change restricts approvals to four designated tech leads while retaining the broader reviewer group; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: restricting PR approvals to designated tech leads.
Description check	✅ Passed	The description directly explains the approver change, retained reviewers, rationale, and acceptance criteria.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	The diff changes only OWNERS (0 additions, 13 deletions). No added log statement or token, password, credential, or secret field was found.
No Hardcoded Secrets	✅ Passed	The PR changes only OWNERS approver entries; scans found no API keys, credentials, embedded-auth URLs, secret variables, or long base64 strings (CWE-798).
No Weak Cryptography	✅ Passed	The PR diff changes only OWNERS approver entries; it introduces no cryptographic primitive, custom cryptography, or secret comparison code.
No Injection Vectors	✅ Passed	HEAD changes only OWNERS approver entries; no SQL, exec.Command, template.HTML, or yaml.Unmarshal injection sink is introduced (CWE-78, CWE-79, CWE-89, CWE-502).
No Privileged Containers	✅ Passed	The diff changes only the OWNERS approvers list. It adds no Kubernetes/OpenShift manifest, Helm template, or Dockerfile security setting covered by this check.
No Pii Or Sensitive Data In Logs	✅ Passed	The PR changes only OWNERS approver entries; the exact diff adds no logging statements or PII, session IDs, request bodies, or host credentials. No CWE/CVE applies.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}