ROX-32922: Modify trigger logic and tweak annotations

[mtodor]

Description

Fix and improve Konflux PipelinesAsCode annotations and CEL trigger expressions
in both acs-mcp-server-push.yaml and acs-mcp-server-pull-request.yaml.

Annotations fixed (push):

• Added missing pull_request_number annotation
• Added on-label: "[]" (workaround for konflux-build label trigger, ROX-30580)
• Removed cancel-in-progress: "false" (it is the default, no need to set it explicitly)
• Set max-keep-runs to 10

Annotations fixed (pull-request):

• Added on-label: "[]" (same workaround)
• Set max-keep-runs to 10

CEL trigger improvements (both files):

• Expanded push trigger to cover release-* branches, tags, and bot/label PRs
• Removed source_branch bot-name matching — bot PRs are handled via the konflux-build label instead
• Added comments explaining each trigger condition, including why body.action != "ready_for_review" is needed (prevents double-triggering when a draft PR is marked ready for review)

Validation

• Verify adding konflux-build label triggers the pipeline
• Verify converting draft PR to ready-for-review does NOT double-trigger

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

NOTE: I'm using beads and tasks are defined there. That's where j2ci comes from.

Prompt: "Set max-keep-runs to 10. and implement j2ci"
Response: Implemented all remaining j2ci changes in both PipelineRun files: added pull_request_number and on-label annotations to push, removed cancel-in-progress: "false", set max-keep-runs to 10, and expanded CEL triggers in both files to cover release-* branches, tags, and konflux-build label-triggered PRs.

Prompt: "Why do we have event == "pull_request" for push.yaml?"
Response: Explained it's intentional — allows the full push pipeline to run for bot PRs targeting release branches, copied from the stackrox pattern.

Prompt: "And what is body.action != "ready_for_review"?"
Response: Explained it prevents the pipeline from firing twice when a draft PR is converted to ready for review.

Prompt: "I see. Keep body.action != "ready_for_review". But document why is it used. And remove: source_branch.matches("(konflux|renovate|appstudio|rhtap)") for both pipelines. Still keep run on konflux-build. Add beads for that and implement."
Response: Removed source_branch bot-name matching from both CEL triggers, kept the konflux-build label trigger, and added YAML comments explaining the body.action guard.

Prompt: "I have modifed formatting a bit and added more comments. Review my changes"
Response: Reviewed both files after user refined formatting and moved comments outside the CEL string — confirmed the structure and expressions were correct. Pointed a small unclarity in one comment.

Prompt: "Adjusted. Check again"
Response: Reviewed the final state of both files and confirmed everything was correct with no further issues.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.88%. Comparing base (9ab1f55) to head (82791b0).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #94   +/-   ##
=======================================
  Coverage   73.88%   73.88%           
=======================================
  Files          30       30           
  Lines        1302     1302           
=======================================
  Hits          962      962           
  Misses        300      300           
  Partials       40       40           

Flag	Coverage Δ
integration	73.88% <ø> (ø)
unit	73.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

E2E Test Results

Commit: 82791b0
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✗ cve-nonexistent (assertions: 2/3)
      one or more verification steps failed
      - MaxToolCalls: Too many tool calls: expected <= 5, got 8
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ~ cve-cluster-does-not-exist (assertions: 2/3)
      - ToolsUsed: Required tool not called: server=stackrox-mcp, tool=, pattern=list_clusters
  ✓ cve-clusters-general (assertions: 3/3)
  ~ cve-cluster-list (assertions: 2/3)
      - MaxToolCalls: Too many tool calls: expected <= 5, got 6
  ~ cve-log4shell (assertions: 2/3)
      - ToolsUsed: Required tool not called: server=stackrox-mcp, tool=, pattern=get_deployments_for_cve
  ✓ cve-multiple (assertions: 3/3)
  ~ rhsa-not-supported (assertions: 1/2)
      - MaxToolCalls: Too many tool calls: expected <= 4, got 6

Tasks:      10/11 passed (90.91%)
Assertions: 27/32 passed (84.38%)
Tokens:     ~73681 (estimate - excludes system prompt & cache)
MCP schemas: ~12738 (included in token total)
Agent used tokens:
  Input:  16487 tokens
  Output: 27882 tokens
Judge used tokens:
  Input:  57288 tokens
  Output: 51639 tokens