From cb7e3d8b75aa25f7ea6db1db26f4ba9578a7967d Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:03:02 -0600
Subject: [PATCH 1/7] always test nightlies on candidate RC

---
 ...tackrox-nightlies__ocp-next_candidate.yaml | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml

diff --git a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml
new file mode 100644
index 0000000000000..bbd30d999c1e6
--- /dev/null
+++ b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml
@@ -0,0 +1,73 @@
+base_images:
+  ocp-4:
+    name: automation-flavors
+    namespace: stackrox
+    tag: openshift-4-stable
+build_root:
+  image_stream_tag:
+    name: apollo-ci
+    namespace: stackrox
+    tag: stackrox-ui-test-stable
+resources:
+  '*':
+    requests:
+      cpu: 2000m
+      memory: 4000Mi
+test_binary_build_commands: .openshift-ci/dispatch.sh test-binary-build-commands
+tests:
+- as: qa-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-qa-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: fips-qa-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      FIPS_ENABLED: "true"
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-qa-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: operator-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-operator-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: ui-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-ui-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: nongroovy-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-nongroovy-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: ocp-vm-scanning-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-vm-scanning-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+  timeout: 7h0m0s
+- as: compliance-e2e-tests
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-compliance-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+zz_generated_metadata:
+  branch: nightlies
+  org: stackrox
+  repo: stackrox
+  variant: ocp-next-candidate

From 9af77b5d235f8066474d7692a5297cd062e46510 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:10:08 -0600
Subject: [PATCH 2/7] always test RCs on master PRs also

---
 ...x-stackrox-master__ocp-next-candidate.yaml | 76 ++++++++++++++++---
 1 file changed, 67 insertions(+), 9 deletions(-)

diff --git a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-next-candidate.yaml b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-next-candidate.yaml
index 489ed37322d97..400a3e95b5914 100644
--- a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-next-candidate.yaml
+++ b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-master__ocp-next-candidate.yaml
@@ -15,9 +15,9 @@ resources:
       memory: 4000Mi
 test_binary_build_commands: .openshift-ci/dispatch.sh test-binary-build-commands
 tests:
-- always_run: false
-  as: qa-e2e-tests
+- as: qa-e2e-tests
   optional: true
+  run_if_changed: ^((generated|image|operator|pkg|make|deploy|scripts)/.*|Makefile|status\.sh|[A-Z_]+_VERSION)
   steps:
     env:
       OCP_VERSION: ocp/candidate
@@ -26,22 +26,23 @@ tests:
 - always_run: false
   as: scanner-v4-install-tests
   optional: true
+  run_if_changed: ^(scanner|image|central/localscanner|sensor/kubernetes/localscanner|operator|roxctl|deploy|proto|scripts/ci|tests/e2e)/.*
   steps:
     env:
       OCP_VERSION: ocp/candidate
       TEST_SUITE: ocp-scanner-v4-install-tests
     workflow: stackrox-automation-flavors-ocp-4-e2e
-- always_run: false
-  as: operator-e2e-tests
+- as: operator-e2e-tests
   optional: true
+  run_if_changed: ^((generated|image|operator|pkg|make|deploy|scripts)/.*|Makefile|status\.sh|[A-Z_]+_VERSION)
   steps:
     env:
       OCP_VERSION: ocp/candidate
       TEST_SUITE: ocp-operator-e2e-tests
     workflow: stackrox-automation-flavors-ocp-4-e2e
-- always_run: false
-  as: ui-e2e-tests
+- as: ui-e2e-tests
   optional: true
+  run_if_changed: ^(ui|proto/(storage|api)|central/.+?/service|pkg/features/list.go|tests/e2e/lib.sh)
   steps:
     env:
       OCP_VERSION: ocp/candidate
@@ -56,15 +57,15 @@ tests:
       OCP_VERSION: ocp/candidate
       TEST_SUITE: ocp-qa-e2e-tests
     workflow: stackrox-automation-flavors-ocp-4-e2e
-- always_run: false
-  as: compliance-e2e-tests
+- as: compliance-e2e-tests
   optional: true
+  run_if_changed: ^(compliance|central\/compliance.*)
   steps:
     env:
       OCP_VERSION: ocp/candidate
       TEST_SUITE: ocp-compliance-e2e-tests
     workflow: stackrox-automation-flavors-ocp-4-e2e
-- always_run: false
+- always_run: true
   as: nongroovy-e2e-tests
   optional: true
   steps:
@@ -72,6 +73,63 @@ tests:
       OCP_VERSION: ocp/candidate
       TEST_SUITE: ocp-nongroovy-e2e-tests
     workflow: stackrox-automation-flavors-ocp-4-e2e
+- always_run: false
+  as: vm-scanning-e2e-tests
+  optional: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-vm-scanning-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+  timeout: 7h0m0s
+- as: merge-qa-e2e-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-qa-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: merge-operator-e2e-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-operator-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: merge-scanner-v4-install-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-scanner-v4-install-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: merge-ui-e2e-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-ui-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: merge-nongroovy-e2e-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-nongroovy-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
+- as: merge-compliance-e2e-tests
+  max_concurrency: 6
+  postsubmit: true
+  steps:
+    env:
+      OCP_VERSION: ocp/candidate
+      TEST_SUITE: ocp-compliance-e2e-tests
+    workflow: stackrox-automation-flavors-ocp-4-e2e
 zz_generated_metadata:
   branch: master
   org: stackrox

From 045312231f65b140c336faf58b6a092988fe7a0c Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:42:15 -0600
Subject: [PATCH 3/7] make update

---
 .../stackrox-stackrox-master-postsubmits.yaml | 420 +++++++++++++++
 .../stackrox-stackrox-master-presubmits.yaml  |  83 ++-
 ...ackrox-stackrox-nightlies-postsubmits.yaml | 491 ++++++++++++++++++
 3 files changed, 993 insertions(+), 1 deletion(-)

diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
index 1f185007a0668..48765cea52859 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
@@ -1461,3 +1461,423 @@ postsubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-compliance-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-compliance-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-nongroovy-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-nongroovy-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-operator-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-operator-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-qa-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-qa-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-scanner-v4-install-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-scanner-v4-install-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^master$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 6
+    name: branch-ci-stackrox-stackrox-master-ocp-next-candidate-merge-ui-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=merge-ui-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
index 007d29048ac38..7af2ff7de8feb 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
@@ -4949,6 +4949,7 @@ presubmits:
     name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-compliance-e2e-tests
     optional: true
     rerun_command: /test ocp-next-candidate-compliance-e2e-tests
+    run_if_changed: ^(compliance|central\/compliance.*)
     spec:
       containers:
       - args:
@@ -5085,7 +5086,7 @@ presubmits:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )ocp-next-candidate-fips-qa-e2e-tests,?($|\s.*)
   - agent: kubernetes
-    always_run: false
+    always_run: true
     branches:
     - ^master$
     - ^master-
@@ -5177,6 +5178,7 @@ presubmits:
     name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-operator-e2e-tests
     optional: true
     rerun_command: /test ocp-next-candidate-operator-e2e-tests
+    run_if_changed: ^((generated|image|operator|pkg|make|deploy|scripts)/.*|Makefile|status\.sh|[A-Z_]+_VERSION)
     spec:
       containers:
       - args:
@@ -5253,6 +5255,7 @@ presubmits:
     name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-qa-e2e-tests
     optional: true
     rerun_command: /test ocp-next-candidate-qa-e2e-tests
+    run_if_changed: ^((generated|image|operator|pkg|make|deploy|scripts)/.*|Makefile|status\.sh|[A-Z_]+_VERSION)
     spec:
       containers:
       - args:
@@ -5329,6 +5332,7 @@ presubmits:
     name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-scanner-v4-install-tests
     optional: true
     rerun_command: /test ocp-next-candidate-scanner-v4-install-tests
+    run_if_changed: ^(scanner|image|central/localscanner|sensor/kubernetes/localscanner|operator|roxctl|deploy|proto|scripts/ci|tests/e2e)/.*
     spec:
       containers:
       - args:
@@ -5405,6 +5409,7 @@ presubmits:
     name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-ui-e2e-tests
     optional: true
     rerun_command: /test ocp-next-candidate-ui-e2e-tests
+    run_if_changed: ^(ui|proto/(storage|api)|central/.+?/service|pkg/features/list.go|tests/e2e/lib.sh)
     spec:
       containers:
       - args:
@@ -5464,6 +5469,82 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )ocp-next-candidate-ui-e2e-tests,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^master$
+    - ^master-
+    context: ci/prow/ocp-next-candidate-vm-scanning-e2e-tests
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+      timeout: 7h0m0s
+    labels:
+      ci-operator.openshift.io/variant: ocp-next-candidate
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-stackrox-stackrox-master-ocp-next-candidate-vm-scanning-e2e-tests
+    optional: true
+    rerun_command: /test ocp-next-candidate-vm-scanning-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=vm-scanning-e2e-tests
+        - --variant=ocp-next-candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )ocp-next-candidate-vm-scanning-e2e-tests,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:
diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
index f2369955918a4..f5d2d2af5283b 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
@@ -2730,6 +2730,497 @@ postsubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-compliance-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=compliance-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-fips-qa-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=fips-qa-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-nongroovy-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=nongroovy-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+      timeout: 7h0m0s
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-ocp-vm-scanning-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=ocp-vm-scanning-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-operator-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=operator-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-qa-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=qa-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^nightlies$
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci.openshift.io/generator: prowgen
+    max_concurrency: 1
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-ui-e2e-tests
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --target=ui-e2e-tests
+        - --variant=ocp-next_candidate
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
   - agent: kubernetes
     always_run: true
     branches:

From 493afd80f2d67b18a86fe56a94df6c28cea117a8 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:02:01 -0600
Subject: [PATCH 4/7] make update

---
 .../stackrox/stackrox-stackrox-master-postsubmits.yaml     | 6 ++++++
 .../stackrox/stackrox-stackrox-master-presubmits.yaml      | 1 +
 .../stackrox/stackrox-stackrox-nightlies-postsubmits.yaml  | 7 +++++++
 3 files changed, 14 insertions(+)

diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
index 48765cea52859..8a7e765d575d7 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-postsubmits.yaml
@@ -1465,6 +1465,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -1535,6 +1536,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -1605,6 +1607,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -1675,6 +1678,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -1745,6 +1749,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -1815,6 +1820,7 @@ postsubmits:
     always_run: true
     branches:
     - ^master$
+    cluster: build06
     decorate: true
     decoration_config:
       skip_cloning: true
diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
index 7af2ff7de8feb..ceb8e84d8e9b1 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-master-presubmits.yaml
@@ -5474,6 +5474,7 @@ presubmits:
     branches:
     - ^master$
     - ^master-
+    cluster: build01
     context: ci/prow/ocp-next-candidate-vm-scanning-e2e-tests
     decorate: true
     decoration_config:
diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
index f5d2d2af5283b..62c2e1213ba76 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
@@ -2734,6 +2734,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2804,6 +2805,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2874,6 +2876,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2944,6 +2947,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3015,6 +3019,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3085,6 +3090,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3155,6 +3161,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true

From 2317dc0c748c90e3d3bebf8428b84a5038f902a5 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:03:42 -0600
Subject: [PATCH 5/7] fix name

---
 ....yaml => stackrox-stackrox-nightlies__ocp-next-candidate.yaml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename ci-operator/config/stackrox/stackrox/{stackrox-stackrox-nightlies__ocp-next_candidate.yaml => stackrox-stackrox-nightlies__ocp-next-candidate.yaml} (100%)

diff --git a/ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml b/ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next-candidate.yaml
similarity index 100%
rename from ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next_candidate.yaml
rename to ci-operator/config/stackrox/stackrox/stackrox-stackrox-nightlies__ocp-next-candidate.yaml

From b545c3b391d463a0269102dccbae5bff0d32b607 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 25 Aug 2026 19:57:09 -0600
Subject: [PATCH 6/7] make update

---
 ...ackrox-stackrox-nightlies-postsubmits.yaml | 49 ++++++++-----------
 1 file changed, 21 insertions(+), 28 deletions(-)

diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
index 62c2e1213ba76..690a21f86a448 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
@@ -2734,15 +2734,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-compliance-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-compliance-e2e-tests
     spec:
       containers:
       - args:
@@ -2751,7 +2750,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=compliance-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -2805,15 +2804,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-fips-qa-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-fips-qa-e2e-tests
     spec:
       containers:
       - args:
@@ -2822,7 +2820,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=fips-qa-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -2876,15 +2874,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-nongroovy-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-nongroovy-e2e-tests
     spec:
       containers:
       - args:
@@ -2893,7 +2890,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=nongroovy-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -2947,16 +2944,15 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
       timeout: 7h0m0s
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-ocp-vm-scanning-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-ocp-vm-scanning-e2e-tests
     spec:
       containers:
       - args:
@@ -2965,7 +2961,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=ocp-vm-scanning-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -3019,15 +3015,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-operator-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-operator-e2e-tests
     spec:
       containers:
       - args:
@@ -3036,7 +3031,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=operator-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -3090,15 +3085,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-qa-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-qa-e2e-tests
     spec:
       containers:
       - args:
@@ -3107,7 +3101,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=qa-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:
@@ -3161,15 +3155,14 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
-    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
     labels:
-      ci-operator.openshift.io/variant: ocp-next_candidate
+      ci-operator.openshift.io/variant: ocp-next-candidate
       ci.openshift.io/generator: prowgen
     max_concurrency: 1
-    name: branch-ci-stackrox-stackrox-nightlies-ocp-next_candidate-ui-e2e-tests
+    name: branch-ci-stackrox-stackrox-nightlies-ocp-next-candidate-ui-e2e-tests
     spec:
       containers:
       - args:
@@ -3178,7 +3171,7 @@ postsubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --target=ui-e2e-tests
-        - --variant=ocp-next_candidate
+        - --variant=ocp-next-candidate
         command:
         - ci-operator
         env:

From ce6162b9205b69c2ac18ab255fc82aeb9643e729 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:20:11 -0600
Subject: [PATCH 7/7] make update

---
 .../stackrox/stackrox-stackrox-nightlies-postsubmits.yaml  | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
index 690a21f86a448..329c406525ebd 100644
--- a/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
+++ b/ci-operator/jobs/stackrox/stackrox/stackrox-stackrox-nightlies-postsubmits.yaml
@@ -2734,6 +2734,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2804,6 +2805,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2874,6 +2876,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -2944,6 +2947,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3015,6 +3019,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3085,6 +3090,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true
@@ -3155,6 +3161,7 @@ postsubmits:
     always_run: true
     branches:
     - ^nightlies$
+    cluster: build13
     decorate: true
     decoration_config:
       skip_cloning: true