[rhoai-2.25] fix(ci): require RHOAI Quay bot secrets in params-env

[jiridanek]

Description

Make Quay.io RHOAI bot login required in params-env validation.

• Drop the broken optional if: env.RHOAI_QUAY_BOT_USERNAME != '' guard (step-level env is not visible to if, and unset ≠ '' so the step always ran).
• If RHOAI_QUAY_BOT_USERNAME / PASSWORD are missing, fail with a loud ::error:: that fork PRs are unsupported (GitHub withholds repository secrets) and same-repo branches are required — aligned with CONTRIBUTING.md and Build Notebooks fork messaging.

Independent of #2556.

How Has This Been Tested?

• Logic review against GHA env/if semantics and existing fork guidance.
• Full end-to-end login depends on repo secrets on a same-repo push/PR.

Self checklist (all need to be checked):

• N/A for workflow-only change (make test does not exercise this GHA)
• RHDS-only CI workflow fix on rhoai-2.25 (not an ODH sync path change)

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

Test plan

• Same-repo push/PR with secrets configured: Quay login succeeds (or fails clearly on bad credentials, not the empty-secret path)
• Confirm missing-secret path emits the ::error title=Missing RHOAI Quay bot secrets:: annotation

Summary by CodeRabbit

• Bug Fixes
  • Improved workflow validation for Quay.io pull authentication by checking that both the bot username and password are set at runtime.
  • Added clearer, actionable error messaging when required credentials are missing, including guidance for forked workflows.
  • Ensures the authentication step fails fast instead of proceeding with incomplete settings.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andyatmiami for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 66ff4f51-addb-4e50-ae99-0b86805ed4be

📥 Commits

Reviewing files that changed from the base of the PR and between 10a47dc and 2ba1c20.

📒 Files selected for processing (1)

• .github/workflows/params-env.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/params-env.yaml

---

📝 Walkthrough

Walkthrough

The Quay authentication workflow step now validates both required secrets at runtime, reports missing credentials, and exits unsuccessfully before attempting authentication.

Changes

Quay authentication validation

Layer / File(s)	Summary
Runtime secret validation .github/workflows/params-env.yaml	The Quay authentication step now requires both RHOAI_QUAY_BOT_USERNAME and RHOAI_QUAY_BOT_PASSWORD, reports missing secrets, and exits with failure.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related issues

• red-hat-data-services/notebooks#2423 — Addresses the same Quay credential guard and runtime validation behavior.

Possibly related PRs

• red-hat-data-services/notebooks#2417 — Modifies the same workflow’s Quay authentication logic and credential conditions.

Suggested reviewers: daniellutz, dibryant

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main CI change to require RHOAI Quay bot secrets in params-env.
Description check	✅ Passed	The description matches the template and includes a clear summary, testing notes, checklist, merge criteria, and test plan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/params-env-require-quay-bot-rhoai-2.25

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/params-env.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/params-env.yaml:
- Around line 44-47: Reorder the workflow so the RHOAI_QUAY_BOT_USERNAME and
RHOAI_QUAY_BOT_PASSWORD validation runs before the “Unlock encrypted secrets
with git-crypt” step or any other secret-dependent setup. Preserve the existing
::error:: message and exit behavior, ensuring fork PRs receive the Quay-specific
failure before GIT_CRYPT_KEY is accessed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 20d9740f-e892-4b50-be41-ae7970807498

📥 Commits

Reviewing files that changed from the base of the PR and between 6b49d9f and 10a47dc.

📒 Files selected for processing (1)

• .github/workflows/params-env.yaml

[jiridanek]

Created DevOps support request to update our secret after recent rotation.