SPIRE-548: Add Cursor rules for QE behavior and test plan generation

[sayak-redhat]

Summary

• Add .cursor/rules/qe-behavior.mdc with project-specific QE workflow conventions
• Add .cursor/rules/test-plan-generation.mdc with guidance for AI-assisted test plan generation

Test plan

• Verify both .mdc files are well-formed and contain valid rule definitions
• Confirm Cursor IDE picks up the rules when opening the workspace

Made with Cursor

Summary by CodeRabbit

• Documentation
  • Updated internal development guidelines and testing rules documentation.

Note: These changes are internal development documentation updates with no impact on end-user functionality or features.

[openshift-ci-robot]

@sayak-redhat: This pull request references SPIRE-548 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Add .cursor/rules/qe-behavior.mdc with project-specific QE workflow conventions
• Add .cursor/rules/test-plan-generation.mdc with guidance for AI-assisted test plan generation

Test plan

• Verify both .mdc files are well-formed and contain valid rule definitions
• Confirm Cursor IDE picks up the rules when opening the workspace

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0b0e4923-59de-402c-bf4f-008168b677a6

📥 Commits

Reviewing files that changed from the base of the PR and between 28e88b2 and 65eaac2.

📒 Files selected for processing (1)

• .cursor/rules/test-plan-with-e2e-generation.mdc

💤 Files with no reviewable changes (1)

• .cursor/rules/test-plan-with-e2e-generation.mdc

---

Walkthrough

This pull request adds two new Cursor MDC rule documents: qe-behavior.mdc establishing zero-trust QE behavioral guidance for testing precision and traceability, and test-plan-with-e2e-generation.mdc specifying end-to-end test plan generation methodology from ADRs or PRs with tiered coverage and codebase-aware patterns.

Changes

Testing Guidelines and Automation Rules

Layer / File(s)	Summary
QE Behavioral Foundation and Rule Sets \.cursor/rules/qe-behavior.mdc (lines 1–91)	Introduces QE behavioral guidelines document with core rules: Ask Before Assuming (clarify ambiguous inputs), Precision Over Volume (one behavior per test with explicit action+observable outcome), Surgical Scope (test only ADR/PR-covered areas), OLM Deployment Context (fixed namespace/CSV conventions and patching), and Traceability (map requirements to tests with stable IDs).
QE Quality Assurance Framework \.cursor/rules/qe-behavior.mdc (lines 94–122)	Defines self-verification workflow gates blocking output until quality checks pass, specifies STOP/WARN conditions for missing inputs and excessive ambiguity, and establishes success criteria requiring no vague steps, full traceability, and non-redundant tests.
Test Plan Generation — Workflow Framework \.cursor/rules/test-plan-with-e2e-generation.mdc (lines 1–51)	Establishes test plan generation intent for traceable tiered test plans, defines core principles for specificity and existing-test auditing, specifies required inputs (ADR/PR/Jira) and conflict resolution, and introduces mode-selection table for ADR vs PR execution paths.
Test Plan Generation — Mode-Specific Workflows \.cursor/rules/test-plan-with-e2e-generation.mdc (lines 53–171)	Defines ADR-mode workflow decomposing sections into structured summaries and numbered requirements by category; defines PR-mode workflow analyzing PR diffs, inferring testable behaviors with confidence levels, and outputting to output/test-plan-pr-<PR-NUMBER>.md.
Test Plan Generation — Structure, Quality Gates, and Patterns \.cursor/rules/test-plan-with-e2e-generation.mdc (lines 173–520)	Defines tier allocation budgets and NEG destructive-test structure; provides reusable test-plan output template with traceability matrix. Lists explicit quality gates (budget limits, mapping coverage, tier deduplication, step specificity, cleanup). Establishes codebase-aware E2E testing rules: existing-test audit requirements, utility/constants usage, pod security context fields, operator architecture constraints (ClusterSPIFFEID fallback, ordered execution), Ginkgo patterns (Eventually/Consistently, By steps, attestation labeling), and reference methodologies.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Single Node Openshift (Sno) Test Compatibility	⚠️ Warning	Two e2e tests fail on SNO: they explicitly search for a different node with SPIFFE CSI Driver pods, assuming multi-node clusters.	Add [Skipped:SingleReplicaTopology] label or guard with exutil.IsSingleNode() check to skip these tests on SNO.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding two Cursor rule files for QE behavior and test plan generation, directly matching the PR's primary objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR adds only rule documentation, no actual Ginkgo test code. The rule files explicitly advocate for stable, static test names and guide against dynamic values.
Test Structure And Quality	✅ Passed	PR adds only Cursor IDE rule documentation files (.mdc), not Ginkgo test code. The custom check for test structure is inapplicable to documentation files.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests added; PR contains only Cursor IDE rule documentation files (.mdc format) with example code snippets, not test implementations.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds only Cursor IDE documentation files (.mdc), not deployment manifests or operator code. Topology-aware scheduling check is not applicable per its scope condition.
Ote Binary Stdout Contract	✅ Passed	PR adds only Cursor MDC documentation files (.mdc), no executable Go code, so no process-level stdout writes can violate the OTE Binary Stdout Contract.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR adds only documentation/rule files (.mdc), not executable Ginkgo e2e tests. No actual test code implementations with IPv4 assumptions or external connectivity requirements were added.
No-Weak-Crypto	✅ Passed	PR adds only documentation files (.mdc Cursor rules); no executable cryptographic code present. No weak crypto algorithms, custom implementations, or unsafe comparisons detected.
Container-Privileges	✅ Passed	PR adds only documentation files (.mdc) with no container configs. Reference to AllowPrivilegeEscalation is in guidance text requiring it false, which enforces security.
No-Sensitive-Data-In-Logs	✅ Passed	Both .mdc files are Cursor guidance documents that explicitly prohibit logging sensitive data. Section G.4 mandates "NEVER log" private keys, bearer tokens, or Secret values.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sayak-redhat
Once this PR has been reviewed and has the lgtm label, please assign bharath-b-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

.cursor/rules/qe-behavior.mdc (1)

57-59: ⚡ Quick win

Prefer Subscription discovery over a hard-coded name.

Hard-coding openshift-zero-trust-workload-identity-manager can make this rule fragile across environments. Consider using <subscription-name> plus a discovery step (oc get subscription -n zero-trust-workload-identity-manager) before patching.

Based on learnings: For OLM-managed ZTWIM operator, patch the Subscription for environment variables and follow operator-specific conventions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.cursor/rules/qe-behavior.mdc around lines 57 - 59, The rule currently
patches a hard-coded Subscription name
"openshift-zero-trust-workload-identity-manager"; instead, first discover the
target Subscription in namespace "zero-trust-workload-identity-manager" (e.g.,
use an "oc get subscription -n zero-trust-workload-identity-manager" discovery
step to select the correct Subscription resource) and then apply the patch to
the discovered Subscription rather than the hard-coded string; ensure you still
patch the Subscription resource (per OLM ZTWIM conventions) to inject the env
var into the operator's config.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.cursor/rules/qe-behavior.mdc:
- Around line 57-59: The rule currently patches a hard-coded Subscription name
"openshift-zero-trust-workload-identity-manager"; instead, first discover the
target Subscription in namespace "zero-trust-workload-identity-manager" (e.g.,
use an "oc get subscription -n zero-trust-workload-identity-manager" discovery
step to select the correct Subscription resource) and then apply the patch to
the discovered Subscription rather than the hard-coded string; ensure you still
patch the Subscription resource (per OLM ZTWIM conventions) to inject the env
var into the operator's config.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 329b7817-4570-4f42-8af3-ac6bc1d532fd

📥 Commits

Reviewing files that changed from the base of the PR and between 9630b80 and 1ddcfa5.

📒 Files selected for processing (2)

• .cursor/rules/qe-behavior.mdc
• .cursor/rules/test-plan-generation.mdc

🚧 Files skipped from review as they are similar to previous changes (1)

• .cursor/rules/test-plan-generation.mdc

[coderabbitai]

🧹 Nitpick comments (1)

.cursor/rules/test-plan-generation.mdc (1)

165-169: ⚡ Quick win

Clarify directory creation for PR mode output.

Line 169 specifies saving to output/test-plan-pr-<PR-NUMBER>.md, but it doesn't explicitly state whether the output/ directory should be created if it doesn't exist. Add a note to clarify this behavior.

📝 Proposed clarification

 **Output file:** Save as `output/test-plan-pr-<PR-NUMBER>.md`.
+Create the `output/` directory if it does not exist.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.cursor/rules/test-plan-generation.mdc around lines 165 - 169, Clarify that
when saving the Test Plan in the "C.5 Draft test cases and finalize" step to the
path `output/test-plan-pr-<PR-NUMBER>.md`, the process should ensure the
`output/` directory exists and create it if missing (e.g., using a recursive
mkdir behavior); update the instruction text to state “create the `output/`
directory if it does not exist” and, where code performs the save, ensure the
save routine for `output/test-plan-pr-<PR-NUMBER>.md` creates the directory
before writing.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.cursor/rules/test-plan-generation.mdc:
- Around line 165-169: Clarify that when saving the Test Plan in the "C.5 Draft
test cases and finalize" step to the path `output/test-plan-pr-<PR-NUMBER>.md`,
the process should ensure the `output/` directory exists and create it if
missing (e.g., using a recursive mkdir behavior); update the instruction text to
state “create the `output/` directory if it does not exist” and, where code
performs the save, ensure the save routine for
`output/test-plan-pr-<PR-NUMBER>.md` creates the directory before writing.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c113eafa-ff5c-474f-8510-2668bec1b663

📥 Commits

Reviewing files that changed from the base of the PR and between 2e9460e and 28e88b2.

📒 Files selected for processing (1)

• .cursor/rules/test-plan-generation.mdc

[openshift-ci]

@sayak-redhat: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.