OAPE-698: Integration of codecov on the must-gather-operator#350
OAPE-698: Integration of codecov on the must-gather-operator#350praveencodes wants to merge 2 commits into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@praveencodes: This pull request references OAPE-698 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughChangesE2E coverage lifecycle
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant E2E as E2E workflow
participant Script as e2e-coverage.sh
participant Pod as Operator pod
participant Codecov
E2E->>Script: setup with COVERAGE_IMAGE
Script->>Pod: configure image, GOCOVERDIR, and coverage volume
Script->>Pod: wait for rollout
E2E->>Script: collect with ARTIFACT_DIR
Script->>Pod: send SIGTERM and copy coverage data
Script->>Script: generate coverage-e2e.out
Script->>Codecov: upload when CODECOV_TOKEN is set
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: praveencodes The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile.coverage`:
- Around line 23-24: The coverage dir is owned by UID 65532 but the container
switches to USER 65534 so GOCOVERDIR writes will be blocked; update the RUN line
that creates /tmp/e2e-cover to either chown it to 65534:65534 (so the runtime
user owns it) or keep chown 65532 but change the subsequent USER to 65532;
specifically modify the mkdir/chown/chmod/USER sequence in Dockerfile.coverage
so the ownership (chown) and the USER directive refer to the same UID (or make
the directory group-writable and set the USER’s group accordingly).
In `@hack/e2e-coverage.sh`:
- Around line 109-113: The current code that downloads and verifies the Codecov
binary using variables codecov_bin and codecov_version can cause the script to
exit under set -euo pipefail; make the download/verification non-fatal by
handling errors instead of letting them propagate: perform the curl and
sha256sum steps inside a conditional or use error-catching (e.g., test the
commands' exit status) and on failure emit a warning (mentioning
codecov_bin/codecov_version) and skip chmod/verification so the script continues
to the optional upload step; ensure subsequent code still checks for the
presence/executability of codecov_bin before attempting upload.
In `@Makefile`:
- Line 42: The Makefile rule invoking the container build uses
images/ci/Dockerfile.coverage which no longer exists; update the docker build
command (the target that runs "$(CONTAINER_TOOL) build -f
images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) .") to point to the new
Dockerfile.coverage location introduced in this PR (or to a Makefile variable
that references the correct path) so the docker-build-coverage target uses the
correct Dockerfile path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8c054540-8cc3-414f-9ec7-0d444071c1e9
📒 Files selected for processing (3)
Dockerfile.coverageMakefilehack/e2e-coverage.sh
| RUN mkdir -p /tmp/e2e-cover && chown 65532:65532 /tmp/e2e-cover && chmod 700 /tmp/e2e-cover | ||
| USER 65534:65534 |
There was a problem hiding this comment.
Fix coverage directory ownership mismatch (coverage writes will fail).
Line 23 grants /tmp/e2e-cover only to UID 65532, but Line 24 runs the process as UID 65534. With mode 700, the operator cannot write GOCOVERDIR output.
Suggested fix
-RUN mkdir -p /tmp/e2e-cover && chown 65532:65532 /tmp/e2e-cover && chmod 700 /tmp/e2e-cover
-USER 65534:65534
+RUN mkdir -p /tmp/e2e-cover && chown 65534:65534 /tmp/e2e-cover && chmod 700 /tmp/e2e-cover
+USER 65534:65534🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile.coverage` around lines 23 - 24, The coverage dir is owned by UID
65532 but the container switches to USER 65534 so GOCOVERDIR writes will be
blocked; update the RUN line that creates /tmp/e2e-cover to either chown it to
65534:65534 (so the runtime user owns it) or keep chown 65532 but change the
subsequent USER to 65532; specifically modify the mkdir/chown/chmod/USER
sequence in Dockerfile.coverage so the ownership (chown) and the USER directive
refer to the same UID (or make the directory group-writable and set the USER’s
group accordingly).
| curl -sS -o "${codecov_bin}" "https://uploader.codecov.io/${codecov_version}/linux/codecov" | ||
| curl -sS -o "${codecov_bin}.SHA256SUM" "https://uploader.codecov.io/${codecov_version}/linux/codecov.SHA256SUM" | ||
|
|
||
| cd "$(dirname "${codecov_bin}")" && sha256sum -c "$(basename "${codecov_bin}").SHA256SUM" && cd - >/dev/null | ||
| chmod +x "${codecov_bin}" |
There was a problem hiding this comment.
Make Codecov download/verification non-fatal to match optional upload behavior.
With set -euo pipefail, a failure on Lines 109–113 exits the script, but upload is treated as optional later (Line 138). This can fail jobs after coverage was already collected.
Suggested fix
- curl -sS -o "${codecov_bin}" "https://uploader.codecov.io/${codecov_version}/linux/codecov"
- curl -sS -o "${codecov_bin}.SHA256SUM" "https://uploader.codecov.io/${codecov_version}/linux/codecov.SHA256SUM"
-
- cd "$(dirname "${codecov_bin}")" && sha256sum -c "$(basename "${codecov_bin}").SHA256SUM" && cd - >/dev/null
- chmod +x "${codecov_bin}"
+ if ! curl -sS -o "${codecov_bin}" "https://uploader.codecov.io/${codecov_version}/linux/codecov" \
+ || ! curl -sS -o "${codecov_bin}.SHA256SUM" "https://uploader.codecov.io/${codecov_version}/linux/codecov.SHA256SUM" \
+ || ! (cd "$(dirname "${codecov_bin}")" && sha256sum -c "$(basename "${codecov_bin}").SHA256SUM" >/dev/null); then
+ echo "Warning: failed to download/verify Codecov uploader (non-fatal)"
+ else
+ chmod +x "${codecov_bin}"
+ "${codecov_bin}" "${codecov_args[@]}" || echo "Warning: Codecov upload failed (non-fatal)"
+ fi
@@
- "${codecov_bin}" "${codecov_args[@]}" || echo "Warning: Codecov upload failed (non-fatal)"
rm -f "${codecov_bin}" "${codecov_bin}.SHA256SUM"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/e2e-coverage.sh` around lines 109 - 113, The current code that downloads
and verifies the Codecov binary using variables codecov_bin and codecov_version
can cause the script to exit under set -euo pipefail; make the
download/verification non-fatal by handling errors instead of letting them
propagate: perform the curl and sha256sum steps inside a conditional or use
error-catching (e.g., test the commands' exit status) and on failure emit a
warning (mentioning codecov_bin/codecov_version) and skip chmod/verification so
the script continues to the optional upload step; ensure subsequent code still
checks for the presence/executability of codecov_bin before attempting upload.
|
|
||
| .PHONY: docker-build-coverage | ||
| docker-build-coverage: ## Build coverage Docker image from images/ci/Dockerfile.coverage. | ||
| $(CONTAINER_TOOL) build -f images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) . |
There was a problem hiding this comment.
Align Dockerfile path with the file introduced in this PR.
Line 42 points to images/ci/Dockerfile.coverage, while this PR introduces Dockerfile.coverage. If that path is not present, docker-build-coverage breaks.
Suggested fix
- $(CONTAINER_TOOL) build -f images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) .
+ $(CONTAINER_TOOL) build -f Dockerfile.coverage -t $(COVERAGE_IMG) .📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| $(CONTAINER_TOOL) build -f images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) . | |
| $(CONTAINER_TOOL) build -f Dockerfile.coverage -t $(COVERAGE_IMG) . |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` at line 42, The Makefile rule invoking the container build uses
images/ci/Dockerfile.coverage which no longer exists; update the docker build
command (the target that runs "$(CONTAINER_TOOL) build -f
images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) .") to point to the new
Dockerfile.coverage location introduced in this PR (or to a Makefile variable
that references the correct path) so the docker-build-coverage target uses the
correct Dockerfile path.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #350 +/- ##
=======================================
Coverage 82.57% 82.57%
=======================================
Files 9 9
Lines 918 918
=======================================
Hits 758 758
Misses 148 148
Partials 12 12 🚀 New features to boost your workflow:
|
|
@praveencodes worth taking a look at CodeRabbit comments. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/e2e-coverage.sh`:
- Line 148: Update the negation in the conditional surrounding `if !(` so `!` is
separated from the opening parenthesis by whitespace, keeping the existing
condition unchanged.
In `@images/ci/Dockerfile.coverage`:
- Line 10: Replace the broad COPY . . instruction in Dockerfile.coverage with an
explicit allowlist of required source files and directories, matching the
existing production Dockerfile’s COPY sources where applicable; exclude
credentials, secrets, and unrelated build-context files.
- Around line 15-28: Add a Docker HEALTHCHECK after the existing container
configuration, using must-gather-operator’s supported health signal and ensuring
it works with the configured non-root user. Keep the existing ENTRYPOINT and
GOCOVERDIR settings unchanged.
- Line 4: Update the final ubi9/ubi-minimal base-image reference in
images/ci/Dockerfile.coverage to use the required floating tag instead of a
pinned digest, while leaving the managed OpenShift builder image reference
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2a28b8a4-4aea-4e24-b63b-959226527e13
📒 Files selected for processing (3)
Makefilehack/e2e-coverage.shimages/ci/Dockerfile.coverage
| "https://uploader.codecov.io/${codecov_version}/${codecov_asset}.SHA256SUM" | ||
|
|
||
| # macOS ships shasum; Linux ships sha256sum. | ||
| if !( |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add a space after ! in the negation. if !( is flagged by ShellCheck (SC1035); the ! negation operator must be a standalone token, otherwise it collides with extglob !(...) pattern syntax and can be misparsed.
🐛 Proposed fix
- if !(
+ if ! (📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if !( | |
| if ! ( |
🧰 Tools
🪛 Shellcheck (0.11.0)
[error] 148-148: You are missing a required space after the !.
(SC1035)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/e2e-coverage.sh` at line 148, Update the negation in the conditional
surrounding `if !(` so `!` is separated from the opening parenthesis by
whitespace, keeping the existing condition unchanged.
Source: Linters/SAST tools
| # Build the must-gather-operator binary with coverage instrumentation. | ||
| # This mirrors build/Dockerfile / Dockerfile.openshift but adds Go coverage flags | ||
| # so the binary records which lines are executed during E2E tests. | ||
| FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- images/ci/Dockerfile.coverage ---\n'
nl -ba images/ci/Dockerfile.coverage | sed -n '1,220p'
printf '\n--- references to e2e-cover / coverage dir contract ---\n'
rg -n "e2e-cover|e2e-coverage|/tmp/e2e-cover|coverage" hack images/ci -g '!**/*.png' || true
printf '\n--- any policy docs mentioning image reference or digest/tag rules ---\n'
rg -n "floating tag|pin by digest|Red Hat images|non-RH images|HEALTHCHECK|non-root|COPY specific files" . -g '!**/*.png' || trueRepository: openshift/must-gather-operator
Length of output: 259
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files images/ci/Dockerfile.coverage images/ci | sed -n '1,200p'
printf '\n--- file ---\n'
nl -ba images/ci/Dockerfile.coverage | sed -n '1,220p'
printf '\n--- related references ---\n'
rg -n "registry\.ci\.openshift\.org/ocp/builder|registry\.access\.redhat\.com|ubi|minimal|HEALTHCHECK|USER 65534|COPY .*" images/ci hack -g '!**/*.png' || trueRepository: openshift/must-gather-operator
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- images/ci/Dockerfile.coverage ---'
cat -n images/ci/Dockerfile.coverage | sed -n '1,220p'
echo
echo '--- coverage-related references ---'
rg -n "e2e-cover|e2e-coverage|/tmp/e2e-cover|coverage" hack images/ci -g '!**/*.png' || true
echo
echo '--- image reference / security policy references ---'
rg -n "floating tag|pin by digest|Red Hat images|non-RH images|HEALTHCHECK|non-root|COPY specific files" . -g '!**/*.png' || trueRepository: openshift/must-gather-operator
Length of output: 8032
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- similar Dockerfiles ---'
for f in build/Dockerfile Dockerfile.openshift images/ci/Dockerfile.coverage; do
if [ -f "$f" ]; then
echo
echo "### $f"
cat -n "$f" | sed -n '1,220p'
fi
done
echo
echo '--- all registry.ci.openshift.org / registry.access.redhat.com references in repo ---'
rg -n "registry\.ci\.openshift\.org|registry\.access\.redhat\.com" . -g '!vendor/**' -g '!**/*.png' || trueRepository: openshift/must-gather-operator
Length of output: 5585
🌐 Web query:
registry.ci.openshift.org/ocp/builder Red Hat managed image policy
💡 Result:
The registry registry.ci.openshift.org is an internal OpenShift CI registry used primarily by OpenShift's internal automation and build processes, not for general user or production consumption [1][2]. Key points regarding its policy and usage: 1. Authoritative CI Registry: While registry.ci.openshift.org is used for internal processes like Release Controllers and mirroring, the authoritative CI registry and source of truth for all OpenShift CI images is quay.io/openshift/ci (often called QCI) [1][2]. 2. Usage Policy for Clients: Users and external integrations should not reference images from registry.ci.openshift.org [1]. Instead, they are directed to use the corresponding images hosted in QCI [1]. 3. Builder Images: Red Hat's ART (Architecture, Release, and Tools) team manages and pushes "builder images" (e.g., golang, rhel-based images) to registry.ci.openshift.org [3][1]. These images are specifically mirrored to ensure that CI image builds and productized image builds are consistent [3]. 4. Access and Authentication: Access to the registry is restricted and managed via internal CI infrastructure [1]. Because it is not a public registry, pull requests and automation scripts often require specific authentication (e.g., via pull secrets) or configuration to interact with it [4][5]. 5. Image Policy Configurations: OpenShift clusters allow for complex image policies (such as ClusterImagePolicy or ImagePolicy) that control which registries are allowed for importing images [6][7]. When configuring these policies, users must ensure they do not inadvertently block necessary OpenShift release or infrastructure images [6][7]. Users are responsible for configuring their own cluster's image policies to align with their security requirements while ensuring critical component connectivity [8][6]. In summary, registry.ci.openshift.org is a managed component of the internal OpenShift CI pipeline [1]. It is not intended for general use, and production workflows should rely on official, supported registries such as registry.redhat.io or quay.io [1][8].
Citations:
- 1: https://docs.ci.openshift.org/how-tos/use-registries-in-build-farm/
- 2: https://docs.ci.openshift.org/internals/images-in-ci/
- 3: https://docs.ci.openshift.org/architecture/images/
- 4: https://docs.ci.openshift.org/architecture/ci-operator/
- 5: UnAuthenticated Registry Deprecation: registry.svc.ci.openshift.org assisted-service#6552
- 6: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/config_apis/clusterimagepolicy-config-openshift-io-v1
- 7: https://docs.okd.io/latest/rest_api/config_apis/imagepolicy-config-openshift-io-v1.html
- 8: OpenShift 4 - builds don't work if whitelist in registrySources defined. builder#71
🌐 Web query:
site:github.com openshift registry.ci.openshift.org/ocp/builder Dockerfile digest tag policy
💡 Result:
In OpenShift CI, there is no single, explicit global policy that forces the use of digest tags over standard tags in Dockerfiles. Instead, the behavior is managed by the specific tooling, primarily the ci-operator system, which automates image resolution and build processes [1][2]. Key aspects of image tagging and usage in OpenShift CI include: 1. Automatic Resolution: ci-operator is designed to handle image references intelligently [2]. When ci-operator builds components, it often uses its own internal logic to resolve base images, particularly those from registry.ci.openshift.org [2]. It can automatically detect base images referenced in a Dockerfile, reducing the need for manual configuration or strict digest requirements [2]. 2. Immutable References: While not strictly a policy requiring manual digest tagging in Dockerfiles, the OpenShift build system itself promotes the use of immutable image references for reproducibility [3]. When image change triggers are used, the system automatically resolves and updates the build configuration to use an immutable reference (often a digest or a specific tag that points to an immutable image) to ensure consistent builds [3]. 3. Registry Roles: - registry.ci.openshift.org (often referred to as app.ci) is primarily for internal automation, such as Release Controllers [1]. Users are generally advised not to reference images here directly for external use; instead, they should use the authoritative registry, quay.io/openshift/ci (QCI) [1]. - If you are authoring a Dockerfile for a project within the OpenShift CI pipeline, you should follow the specific component's ci-operator configuration, which defines how images are managed, promoted, and referenced [1][2]. 4. Security and Policy: For production-grade or hardened environments, OpenShift supports features like ClusterImagePolicy [4]. This allows administrators to enforce specific identity matching policies, such as MatchRepoDigestOrExact, which can mandate the use of digests or specific, verified signatures for images pulled from registries, including registry.ci.openshift.org [4]. In summary, while you are not generally required to manually write digest tags in your Dockerfiles, the CI system and cluster policies often abstract this by resolving tags to immutable versions behind the scenes or by enforcing strict policies through admission controllers [2][4][3]. Always consult the official openshift/ci-docs for project-specific best practices when working with the CI build farm [1][2].
Citations:
- 1: https://github.com/openshift/ci-docs/blob/main/content/en/how-tos/use-registries-in-build-farm.md
- 2: https://github.com/openshift/ci-docs/blob/main/content/en/architecture/ci-operator.md
- 3: https://github.com/openshift/openshift-docs/blob/main/modules/builds-using-image-change-triggers.adoc
- 4: OCPNODE-1632: Support ClusterImagePolicy CRD machine-config-operator#4160
Use a floating tag for the final UBI base image. The builder image is a managed OpenShift CI reference, so digest pinning isn’t needed here; the ubi9/ubi-minimal stage should follow the floating-tag policy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@images/ci/Dockerfile.coverage` at line 4, Update the final ubi9/ubi-minimal
base-image reference in images/ci/Dockerfile.coverage to use the required
floating tag instead of a pinned digest, while leaving the managed OpenShift
builder image reference unchanged.
Source: Path instructions
|
|
||
| WORKDIR $SRC_DIR | ||
|
|
||
| COPY . . |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not copy the entire build context.
COPY . . can include unintended files or credentials in builder layers and cache. Replace it with an explicit source-file allowlist, ideally matching the existing production Dockerfile.
As per path instructions, “COPY specific files, not entire context” and “No secrets in ENV, ARG, or COPY.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@images/ci/Dockerfile.coverage` at line 10, Replace the broad COPY . .
instruction in Dockerfile.coverage with an explicit allowlist of required source
files and directories, matching the existing production Dockerfile’s COPY
sources where applicable; exclude credentials, secrets, and unrelated
build-context files.
Source: Path instructions
| FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1771346502 | ||
|
|
||
| RUN microdnf install -y tar gzip openssh-clients wget shadow-utils procps sshpass nc findutils && \ | ||
| microdnf clean all | ||
|
|
||
| ARG SRC_DIR=/go/src/github.com/openshift/must-gather-operator | ||
| COPY --from=builder $SRC_DIR/must-gather-operator /usr/local/bin/must-gather-operator | ||
| COPY --from=builder $SRC_DIR/build/bin /usr/local/bin | ||
|
|
||
| # 65534 is the 'nobody' user/group - a standard unprivileged user for containers | ||
| RUN mkdir -p /tmp/e2e-cover && chown 65534:65534 /tmp/e2e-cover && chmod 700 /tmp/e2e-cover | ||
| USER 65534:65534 | ||
| ENV GOCOVERDIR=/tmp/e2e-cover | ||
| ENTRYPOINT ["/usr/local/bin/must-gather-operator"] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Define a container HEALTHCHECK.
This image has no healthcheck, so container runtimes cannot detect a wedged operator process through the image metadata. Add a healthcheck using the operator’s supported health signal.
As per path instructions, “HEALTHCHECK defined”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@images/ci/Dockerfile.coverage` around lines 15 - 28, Add a Docker HEALTHCHECK
after the existing container configuration, using must-gather-operator’s
supported health signal and ensuring it works with the configured non-root user.
Keep the existing ENTRYPOINT and GOCOVERDIR settings unchanged.
Source: Path instructions
|
@praveencodes: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Summary
This change wires end-to-end (cluster) test coverage and Codecov into the must-gather-operator workflow.
Dockerfile.coverage — Multi-stage image that builds the operator with Go’s -cover / -coverpkg=./... instrumentation, sets GOCOVERDIR (default /tmp/e2e-cover), and prepares a writable directory so the running pod can emit coverage data.
Makefile — Adds docker-build-coverage, docker-push-coverage (image tag$(COVERAGE_IMG), default $ (IMG)-e2e-coverage), and e2e-coverage-collect to run the collection script; documents the typical local flow (build/push → patch CSV → e2e → collect/upload).
hack/e2e-coverage.sh — setup: finds the operator CSV from the deployment owner reference, patches the CSV to use COVERAGE_IMAGE, injects GOCOVERDIR, and adds an emptyDir volume mount; collect: SIGTERM to flush coverage, oc cp data off the pod, go tool covdata textfmt / percent, and optional Codecov upload (token from env or /var/run/secrets/codecov/CODECOV_TOKEN, with Prow-friendly flags when JOB_TYPE is presubmit/postsubmit).
Summary by CodeRabbit
New Features
Tests