[manifests] Update the OCPCI and forge task definition

[kpouget]

Summary by CodeRabbit

• Chores
  • Updated container image pull policy to ensure fresh images are retrieved on each execution.
  • Enhanced access permissions for improved pipeline execution monitoring and visibility.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tosokin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bd32f000-a20c-4593-aeb9-beb424fa2d88

📥 Commits

Reviewing files that changed from the base of the PR and between 66cd744 and 2caadf4.

📒 Files selected for processing (2)

• config/forge/workflows/tasks.yaml
• manifests/ocpci-sa/role.yaml

---

📝 Walkthrough

Walkthrough

This PR modifies two Kubernetes manifest files to update infrastructure configuration. The Tekton forge-step task now explicitly sets imagePullPolicy to Always for the forge container step. Additionally, the RBAC ocpci-fournos-job-manager role gains read-only permissions to access Tekton pipelineruns resources.

Changes

Cohort / File(s)	Summary
Tekton Task Configuration config/forge/workflows/tasks.yaml	Sets imagePullPolicy: Always on the forge container step to ensure fresh image pulls on each execution.
RBAC Permissions manifests/ocpci-sa/role.yaml	Adds read-only access rules (get, list verbs) for Tekton pipelineruns resource in the tekton.dev API group.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~7 minutes

Possibly related PRs

• Add the manifests and scripts to create a Kubeconfig for OCPCI #20: Modifies the same manifests/ocpci-sa/role.yaml file to add additional RBAC permissions for Fournos jobs.

Suggested labels

approved

Suggested reviewers

• avasilevskii

Poem

🐰 A pull request hops into the fold,
Always pull fresh images, we're told!
RBAC now grants the sight,
To list pipelines, everything's right! ✨
Configuration blooms, deployment takes flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main changes: updating both the OCPCI role definition (adding pipelineruns read access) and the forge task definition (setting imagePullPolicy to Always).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[avasilevskii]

/lgtm