CNTRLPLANE-4088: replace broad COPY with targeted COPY --parents

[celebdor]

Summary

• Replaces COPY . . in Containerfile.cli with targeted COPY --parents to only include directories
  needed by the product-cli build
• Excludes docs/, examples/, test/, hack/, shared-ingress/, contrib/, and other unrelated directories
• Documents which dependencies are direct vs indirect (via cmd/cluster/core/dump.go, tracked in CNTRLPLANE-4092)

Test plan

• Built image locally with podman build -f Containerfile.cli --no-cache .
• Verified all 8 cross-compiled tar.gz archives present in final image
• Verified hcp version runs successfully from the linux-amd64 binary
• Konflux PR pipeline builds successfully

Ref: CNTRLPLANE-4088

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved the CLI build process by limiting the files and dependency directories included during the build.
  • Added commit information to pull request and push pipeline builds.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a8a8d7a0-43ea-43d1-b755-5e18476453e7

📥 Commits

Reviewing files that changed from the base of the PR and between e1f4a91 and b54e53b.

📒 Files selected for processing (2)

• .tekton/hypershift-cli-mce-50-pull-request.yaml
• .tekton/hypershift-cli-mce-50-push.yaml

Included review availability: Your plan includes up to 12 reviews per rolling hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The CLI builder replaces COPY . . with explicit copies of Go metadata, build inputs, direct dependency directories, and selected indirect dependencies. The pull request and push pipelines pass their revisions as the COMMIT_HASH build argument.

Merge Risk: ⚪ Minimal · up to b54e5

The change narrows container image contents to the directories required for the CLI build, with local image and binary validation reported; no actionable merge-blocking risk remains beyond normal checks.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change from broad COPY to targeted COPY --parents instructions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only Containerfile and Tekton YAML content. The added lines contain no Ginkgo test declarations or dynamic test titles.
Test Structure And Quality	✅ Passed	The pull request changes only Containerfile.cli and two Tekton YAML files; the diff contains no Ginkgo tests or test assertions to assess.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff only changes Containerfile COPY inputs and PipelineRun build arguments; it adds no workload scheduling constraints, topology selectors, affinity, spread rules, replicas, or PDBs.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only Containerfile.cli and Tekton YAML; the full PR diff adds no Ginkgo e2e tests or test networking/external-connectivity behavior.
No-Weak-Crypto	✅ Passed	The PR changes only Containerfile COPY directives and COMMIT_HASH pipeline metadata; added-line scans found no weak crypto, custom crypto, or secret-comparison usage.
Container-Privileges	✅ Passed	The PR only narrows Containerfile COPY paths and adds COMMIT_HASH build args; no privileged, host namespace, SYS_ADMIN, root-user, or allowPrivilegeEscalation setting was introduced.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only narrows build-context copies and passes the non-sensitive commit revision; it adds no logging or output of passwords, tokens, keys, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@celebdor: This pull request references CNTRLPLANE-4088 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

• Replaces COPY . . in Containerfile.cli with targeted COPY --parents to only include directories
  needed by the product-cli build
• Excludes docs/, examples/, test/, hack/, shared-ingress/, contrib/, and other unrelated directories
• Documents which dependencies are direct vs indirect (via cmd/cluster/core/dump.go, tracked in CNTRLPLANE-4092)

Test plan

• Built image locally with podman build -f Containerfile.cli --no-cache .
• Verified all 8 cross-compiled tar.gz archives present in final image
• Verified hcp version runs successfully from the linux-amd64 binary
• Konflux PR pipeline builds successfully

Ref: CNTRLPLANE-4088

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

🔇 Additional comments (4)

Containerfile.cli (4)

7-12: 🎯 Functional Correctness

⚠️ Unverified finding
Sandbox verification was unavailable.

Confirm COPY --parents support in Konflux.

The local build does not prove that the pending Konflux builder uses a compatible Containerfile parser. Confirm support for both COPY --parents instructions before merging.

Minimal builder syntax probe

---

16-18: 🗄️ Data Integrity & Integration

Confirm whether linux/ppc64 is intentionally excluded.

Makefile Lines 251-264 build linux/ppc64, but these lines do not create hcp-linux-ppc64.tar.gz. Line 26 then removes the unarchived binary. Add ppc64 here if it is a supported release target; otherwise document or remove that target from product-cli-release.

---

28-32: 🔒 Security & Privacy

Verify the effective runtime user.

The final stage does not set USER. Inspect the effective user inherited from registry.redhat.io/ubi9/nginx-124:latest. If it is empty, 0, or root, add an explicit non-root user and test nginx startup under that user.

As per path instructions, matching Containerfiles must use a non-root USER and must never run as root.

Source: Path instructions

---

28-32: 🩺 Stability & Availability

Verify the effective health check.

Containerfile.cli does not declare HEALTHCHECK. Inspect the inherited image configuration. If no probe exists, add one for the local nginx service.

As per path instructions, matching Containerfiles must define HEALTHCHECK.

Source: Path instructions

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 548188b5-be61-4970-92c5-11fd58ccadfe

📥 Commits

Reviewing files that changed from the base of the PR and between ea98bde and 90ab8f7.

📒 Files selected for processing (1)

• Containerfile.cli

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.74%. Comparing base (09671e5) to head (b54e53b).
⚠️ Report is 20 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9317      +/-   ##
==========================================
+ Coverage   45.73%   45.74%   +0.01%     
==========================================
  Files         781      781              
  Lines       97837    97858      +21     
==========================================
+ Hits        44744    44765      +21     
  Misses      50024    50024              
  Partials     3069     3069              

see 2 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	38.83% <ø> (ø)
cpo-hostedcontrolplane	47.98% <ø> (ø)
cpo-other	46.02% <ø> (+0.08%)	⬆️
hypershift-operator	57.00% <ø> (ø)
other	34.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cblecker]

/uncc

[jparrill]

Dropped a comment. Thanks!

[celebdor]

/jira refresh

[openshift-ci-robot]

@celebdor: This pull request references CNTRLPLANE-4088 which is a valid jira issue.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: celebdor
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS [celebdor]

  Need more approvers for rest parts.

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@celebdor: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[celebdor]

/verified by celebdor

Pulled the PR image and confirmed the build artifacts and commit hash are correct:

$ podman run --rm --entrypoint sh <image> -c 'ls /opt/app-root/src/'
hcp-darwin-amd64.tar.gz
hcp-darwin-arm64.tar.gz
hcp-linux-amd64.tar.gz
hcp-linux-arm64.tar.gz
hcp-linux-ppc64le.tar.gz
hcp-linux-s390x.tar.gz
hcp-windows-amd64.tar.gz
hcp-windows-arm64.tar.gz

$ podman run --rm --entrypoint sh <image> -c 'cd /opt/app-root/src && tar xzf hcp-linux-amd64.tar.gz && ./hcp version'
Client Version: openshift/hypershift: b54e53bea86a6d4aa0e2cda338e633627421c986

The COMMIT_HASH build arg flows from the Tekton pipeline ({{revision}}) through the Containerfile ARG into make product-cli-release via ldflags (-X ...supportedversion.commitHash=$(COMMIT_HASH)), and the binary reports the correct commit. All 8 platform archives (linux amd64/arm64/ppc64le/s390x, darwin amd64/arm64, windows amd64/arm64) are present in the image.

[openshift-ci-robot]

@celebdor: This PR has been marked as verified by celebdor.

Details

In response to this:

/verified by celebdor

Pulled the PR image and confirmed the build artifacts and commit hash are correct:

$ podman run --rm --entrypoint sh <image> -c 'ls /opt/app-root/src/'
hcp-darwin-amd64.tar.gz
hcp-darwin-arm64.tar.gz
hcp-linux-amd64.tar.gz
hcp-linux-arm64.tar.gz
hcp-linux-ppc64le.tar.gz
hcp-linux-s390x.tar.gz
hcp-windows-amd64.tar.gz
hcp-windows-arm64.tar.gz

$ podman run --rm --entrypoint sh <image> -c 'cd /opt/app-root/src && tar xzf hcp-linux-amd64.tar.gz && ./hcp version'
Client Version: openshift/hypershift: b54e53bea86a6d4aa0e2cda338e633627421c986

The COMMIT_HASH build arg flows from the Tekton pipeline ({{revision}}) through the Containerfile ARG into make product-cli-release via ldflags (-X ...supportedversion.commitHash=$(COMMIT_HASH)), and the binary reports the correct commit. All 8 platform archives (linux amd64/arm64/ppc64le/s390x, darwin amd64/arm64, windows amd64/arm64) are present in the image.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.