feat: extract CI lifecycle and Prow job management skills from openshift/release

[zdrapela]

Summary

• Extract 10 skills from openshift/release .claude/skills/ into this repository
• Rename with concern-first naming (lifecycle-*, prow-*) and deduplicate shared scripts
• Add dual-mode support (local checkout or GitHub API via gh CLI) so skills work from any directory

New skills

Lifecycle (portable, pure API): lifecycle-ocp, lifecycle-aks, lifecycle-eks, lifecycle-gke

Prow job management (openshift/release): prow-ocp-jobs, prow-ocp-pools, prow-ocp-coverage, prow-aks-jobs, prow-eks-jobs, prow-gke-jobs

Shared infrastructure: _shared/resolve-repo.sh, _shared/fetch-yaml.sh, _shared/list-k8s-test-configs.sh

Key changes from originals

• 3x list-k8s-test-configs.sh duplication eliminated (was identical in AKS/EKS/GKE)
• 2x print-configured-versions.sh duplication eliminated (consolidated into fetch-yaml.sh)
• ocp-lifecycle.jq cross-skill reference is now a clean sibling path
• All read-only scripts auto-detect local openshift/release checkout or fall back to gh CLI
• rhdh-decommission-release intentionally left in openshift/release (destructive, local-only)

[zdrapela]

Thank you @gustavolira for the reveiw! I incorporated you suggestions. I'm not using Python that often and I appreciate them.

I then thought about the skill structure and it looks like a better idea to move them into two bigger skills with dedicated workflows.

[durandom]

Review Summary

Well-structured PR — the consolidated 2-skill architecture with router + workflow pattern is clean, the dependency graph is acyclic, and the subprocess boundary between prow and lifecycle data is the right call. Two bugs to fix before merge.

---

🐛 Bug: check_aks_lifecycle.py — JSON output corruption

When both --test-pattern and --json are passed, print_configured_versions() writes human-readable text to stdout before the JSON blob, corrupting the output. The EKS script correctly guards this:

# check_eks_lifecycle.py (correct)
if args.test_pattern and not args.json_output:
    print_configured_versions(...)

The AKS script is missing the not args.json_output guard. This matters because analyze_coverage.py could call this script with --json.

Fix: Add and not args.json_output to the if args.test_pattern: condition in check_aks_lifecycle.py.

---

🔒 Security: redhat.py:fetch_api — Insufficient URL encoding

product_name.replace(' ', '+') is not proper URL encoding. Characters like &, =, #, ? pass through unescaped into the query string. Currently mitigated by PRODUCT_ALIASES, but resolve_product_name falls through to the raw user string for unknown aliases — so check_lifecycle.py --product "foo&bar=baz" would inject into the URL.

Fix: Replace with urllib.parse.quote_plus(product_name).

---

💡 Suggestion: Replace symlink with copied modules (Windows compatibility)

The symlink prow/scripts/rhdh_lifecycle → ../../lifecycle/scripts/rhdh_lifecycle breaks silently on Windows with core.symlinks = false (the symlink is checked out as a plain text file containing the path, and Python imports fail without error).

Only 2 facade files in prow actually touch the symlink (rhdh_prow/repo.py and rhdh_prow/yaml.py), re-exporting ~180 lines of infrastructure code. The lifecycle data functions are already accessed via subprocess --json in analyze_coverage.py.

Proposed alternative: copy repo.py (63 lines) and yaml.py (116 lines) directly into rhdh_prow/ as standalone modules. Delete the symlink. Each skill becomes truly self-contained, no cross-platform hazard, no sys.path manipulation needed.

---

Minor (non-blocking, good for follow-up)

• ocp.py: api_data.get("data", [{}])[0] will IndexError if data is an empty list []. Guard like redhat.py does.
• generate_test_entry.py: --reference format is not validated (only --version is). Malformed input crashes at split(".").
• list_aks_jobs.py / list_eks_jobs.py / list_gke_jobs.py: sys.argv mutation is fragile — use main(["--pattern", ...] + sys.argv[1:]) instead.
• check-redhat.md: Missing Output and Action sections. check-ocp.md and check-rhdh.md also lack Action sections.
• Unresolved from prior review: duplicated fetch_json boilerplate (3 copies), copy-pasted EOL cross-verification block (AKS↔EKS), inline version sort lambdas vs. existing ver_sort_key.

[zdrapela]

Hi @durandom, I addressed your review and also the remaining from @gustavolira.

About 💡 Suggestion: Replace symlink with copied modules (Windows compatibility), I'm only worried about those files would go out of sync, like fixes or improvements in one wouldn't be updated in the second one. Would a line in AGENTS.md to keep them in sync do the trick?

[durandom]

All previous feedback thoroughly addressed — nice work on the consolidation.

4 non-blocking items for follow-up:

1. analyze_coverage.py fallback _fetch_api still uses .replace(' ', '+') — inconsistent with the quote_plus fix in redhat.py
2. analyze_coverage.py fallback parsers use [{}][0] which will IndexError on empty data: [] — same guard as ocp.py/redhat.py should be applied
3. generate_cluster_pool.py is missing --reference format validation (was fixed in generate_test_entry.py but not here)
4. ruamel.yaml via PEP 723 inline metadata technically diverges from the stdlib-only rule — might warrant an ADR update or documented exception