ROX-32922: Modify trigger logic and tweak annotations

[mtodor]

Description

Fix and improve Konflux PipelinesAsCode annotations and CEL trigger expressions
in both acs-mcp-server-push.yaml and acs-mcp-server-pull-request.yaml.

Annotations fixed (push):

• Added missing pull_request_number annotation
• Added on-label: "[]" (workaround for konflux-build label trigger, ROX-30580)
• Removed cancel-in-progress: "false" (it is the default, no need to set it explicitly)
• Set max-keep-runs to 10

Annotations fixed (pull-request):

• Added on-label: "[]" (same workaround)
• Set max-keep-runs to 10

CEL trigger improvements (both files):

• Expanded push trigger to cover release-* branches, tags, and bot/label PRs
• Removed source_branch bot-name matching — bot PRs are handled via the konflux-build label instead
• Added comments explaining each trigger condition, including why body.action != "ready_for_review" is needed (prevents double-triggering when a draft PR is marked ready for review)

Validation

• Verify adding konflux-build label triggers the pipeline
• Verify converting draft PR to ready-for-review does NOT double-trigger

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

NOTE: I'm using beads and tasks are defined there. That's where j2ci comes from.

Prompt: "Set max-keep-runs to 10. and implement j2ci"
Response: Implemented all remaining j2ci changes in both PipelineRun files: added pull_request_number and on-label annotations to push, removed cancel-in-progress: "false", set max-keep-runs to 10, and expanded CEL triggers in both files to cover release-* branches, tags, and konflux-build label-triggered PRs.

Prompt: "Why do we have event == "pull_request" for push.yaml?"
Response: Explained it's intentional — allows the full push pipeline to run for bot PRs targeting release branches, copied from the stackrox pattern.

Prompt: "And what is body.action != "ready_for_review"?"
Response: Explained it prevents the pipeline from firing twice when a draft PR is converted to ready for review.

Prompt: "I see. Keep body.action != "ready_for_review". But document why is it used. And remove: source_branch.matches("(konflux|renovate|appstudio|rhtap)") for both pipelines. Still keep run on konflux-build. Add beads for that and implement."
Response: Removed source_branch bot-name matching from both CEL triggers, kept the konflux-build label trigger, and added YAML comments explaining the body.action guard.

Prompt: "I have modifed formatting a bit and added more comments. Review my changes"
Response: Reviewed both files after user refined formatting and moved comments outside the CEL string — confirmed the structure and expressions were correct. Pointed a small unclarity in one comment.

Prompt: "Adjusted. Check again"
Response: Reviewed the final state of both files and confirmed everything was correct with no further issues.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.88%. Comparing base (c68513c) to head (a6f8913).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                         Coverage Diff                          @@
##           mtodor/ROX-32922-push-to-rhacs-repo      #94   +/-   ##
====================================================================
  Coverage                                73.88%   73.88%           
====================================================================
  Files                                       30       30           
  Lines                                     1302     1302           
====================================================================
  Hits                                       962      962           
  Misses                                     300      300           
  Partials                                    40       40           

Flag	Coverage Δ
integration	73.88% <ø> (ø)
unit	73.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

E2E Test Results

Commit: a6f8913
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ~ cve-cluster-does-not-exist (assertions: 2/3)
      - ToolsUsed: Required tool not called: server=stackrox-mcp, tool=, pattern=list_clusters
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)

Tasks:      11/11 passed (100.00%)
Assertions: 31/32 passed (96.88%)
Tokens:     ~53117 (estimate - excludes system prompt & cache)
MCP schemas: ~12738 (included in token total)
Agent used tokens:
  Input:  8426 tokens
  Output: 21139 tokens
Judge used tokens:
  Input:  76845 tokens
  Output: 53549 tokens

[janisz]

Can we have it more readable

event == "pull_request" && 
body.action != "ready_for_review" && (
  target_branch == "main" || 
  target_branch.startsWith("release-") || 
  (
    has(body.pull_request.labels) && 
    body.pull_request.labels.exists(l, l.name == "konflux-build")
  )
)

[janisz]

ok, it's the line wrapping on diff that make it harder to read