Feat/qci to appci mirror config

[deepsm007]

/hold
This is follow up for openshift/ci-tools#5344 during migration process we need to prevent breakage.

/cc @openshift/test-platform

Summary by CodeRabbit

• Adds QCI-to-AppCI image mirroring configuration to support the CI migration and prevent image availability breakage.
• Updates CI secret bootstrap credentials to use image-pusher authentication for registry pushes and routes the Quay read-only robot through the CI proxy.
• Adds an emergency backfill mapping for the stolostron/builder:go1.26-linux image.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@deepsm007: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 138447c2-ab85-497e-90a9-4fde09002fec

📥 Commits

Reviewing files that changed from the base of the PR and between 2d95403 and 48c4fa2.

📒 Files selected for processing (2)

• core-services/ci-secret-bootstrap/_config.yaml
• core-services/image-mirroring/_config.yaml

---

Walkthrough

Updates CI registry credentials and adds an emergency QCI-to-app.ci image override for the stolostron/builder:go1.26-linux image.

Changes

CI Registry Configuration

Layer / File(s)	Summary
Registry credential mappings core-services/ci-secret-bootstrap/_config.yaml	The build_farm registry credential now uses the image-pusher token, and the Quay proxy read-only credential mapping is configured.
QCI-to-app.ci image override core-services/image-mirroring/_config.yaml	Adds a qciToAppCIImages mapping that redirects stolostron/builder:go1.26-linux through the Quay CI proxy.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: openshift-bot

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main change: adding QCI-to-AppCI mirror configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only YAML config files changed; no Ginkgo specs or test titles were modified in the touched paths.
Test Structure And Quality	✅ Passed	PR only changes YAML config; no Ginkgo test files or test blocks were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only updates YAML config; no Ginkgo tests or MicroShift-unsupported APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only two YAML config files changed; no Go/Ginkgo tests or SNO-relevant test logic were added, so this check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The only changed file is a secret-bootstrap YAML; its diff only adjusts dockerconfigJSON registry credentials and adds no pod specs or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	PR only changes YAML secret config; no process-level code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: This PR only changes YAML config/mirroring secrets; no new Ginkgo tests or runtime code, so IPv4/external-connectivity checks are not applicable.
No-Weak-Crypto	✅ Passed	Diff only changes YAML registry auth mappings; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	The patch only edits dockerconfigjson secret mappings; no privileged, host*, SYS_ADMIN, or allowPrivilegeEscalation fields appear.
No-Sensitive-Data-In-Logs	✅ Passed	Touched YAML config only; no logging statements or debug output were added in the changed regions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[hector-vido]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007, hector-vido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [deepsm007,hector-vido]
• core-services/image-mirroring/OWNERS [deepsm007,hector-vido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@deepsm007: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/image-mirroring-config-validation	48c4fa2	link	true	/test image-mirroring-config-validation

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.