NO-JIRA: Dockerfile.art: package oc-mirror binaries as tar.gz archives

[aguidirh]

Summary

• Create /releases/ directory in the ART Dockerfile
• Package the rhel9 oc-mirror binary as oc-mirror-rhel9-linux-amd64.tar.gz
• Package the rhel8 oc-mirror.rhel8 binary as oc-mirror-rhel8-linux-amd64.tar.gz

Test plan

• Verify the image builds successfully with the new RUN steps
• Confirm /releases/ directory contains the expected tar archives after build

Summary by CodeRabbit

• New Features
  • Added release tarballs for the RHEL 8 and RHEL 9 Linux AMD64 versions of the oc-mirror tool.
  • The tarballs are generated automatically during the container image build and include the corresponding executable.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@aguidirh: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Create /releases/ directory in the ART Dockerfile
• Package the rhel9 oc-mirror binary as oc-mirror-rhel9-linux-amd64.tar.gz
• Package the rhel8 oc-mirror.rhel8 binary as oc-mirror-rhel8-linux-amd64.tar.gz

Test plan

• Verify the image builds successfully with the new RUN steps
• Confirm /releases/ directory contains the expected tar archives after build

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The final CLI image build now creates a /releases/ directory containing compressed tarballs for the RHEL 9 and RHEL 8 oc-mirror binaries.

Changes

CLI release artifacts

Layer / File(s)	Summary
Package release archives images/cli/Dockerfile.art	The final image stage packages oc-mirror and oc-mirror.rhel8 into separate gzip-compressed tarballs under /releases/.

Estimated code review effort: 1 (Trivial) | ~2 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	images/cli/Dockerfile.art ends at ENTRYPOINT with no USER directive in the final stage, so the oc-mirror image runs as root by default.	Add a non-root USER in the final stage before ENTRYPOINT, or document why root is required; keep privilege-escalation settings absent.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: packaging oc-mirror binaries into tar.gz archives in Dockerfile.art.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only modifies images/cli/Dockerfile.art; no test files or Ginkgo titles were changed.
Test Structure And Quality	✅ Passed	Only Dockerfile.art changed; no Ginkgo test code was modified, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only Dockerfile.art changed; no new Ginkgo test declarations or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only images/cli/Dockerfile.art changed; no new Ginkgo e2e tests or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only Dockerfile artifact packaging changed; no manifests, controllers, or scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	Only images/cli/Dockerfile.art changed; no process-level Go code or suite setup was modified, and the new RUN steps only create tarballs.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only changes images/cli/Dockerfile.art; no new Ginkgo e2e tests or network-using code were added, so this check is not applicable.
No-Weak-Crypto	✅ Passed	Dockerfile change only adds tarball packaging; no weak crypto, custom crypto, or secret/token comparisons appear in the diff.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds tar archive creation in Dockerfile.art; no new logging, echo, or secret-bearing output was introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aguidirh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [aguidirh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ashwindasr]

/hold

Until we get confirmation from konflux

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/cli/Dockerfile.art`:
- Around line 46-48: Add an appropriate non-root USER directive in the final
image stage after the archive-generation RUN commands and before ENTRYPOINT.
Ensure the resulting image, including its release artifacts, runs as a non-root
user and never defaults to root.
- Around line 46-48: Update the release packaging commands in the Dockerfile so
the archive architecture suffix matches the binaries produced by the build:
either invoke the amd64-pinned build target before creating the archives or
derive the names from the actual build platform. Ensure both oc-mirror release
tarballs cannot be labeled amd64 when the build output uses another
architecture.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: efdae02e-45b7-4328-b07a-7053df3daade

📥 Commits

Reviewing files that changed from the base of the PR and between 2522a9e and d6ddd86.

📒 Files selected for processing (1)

• images/cli/Dockerfile.art

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the final image as a non-root user.

The final stage has no USER directive, so the image—including the new release artifacts—runs as root by default. Add an appropriate non-root USER after the archive-generation steps and before ENTRYPOINT.

As per path instructions: “USER non-root; never run as root.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/cli/Dockerfile.art` around lines 46 - 48, Add an appropriate non-root
USER directive in the final image stage after the archive-generation RUN
commands and before ENTRYPOINT. Ensure the resulting image, including its
release artifacts, runs as a non-root user and never defaults to root.

Source: Path instructions

---

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files images/cli/Dockerfile.art
printf '\n---\n'
cat -n images/cli/Dockerfile.art | sed -n '1,140p'

Repository: openshift/oc-mirror

Length of output: 3644

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|linux-amd64" .github . -g '!**/vendor/**' -g '!**/bin/**'

Repository: openshift/oc-mirror

Length of output: 964

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ast-grep outline Makefile --view expanded
printf '\n---\n'
sed -n '1,180p' Makefile | cat -n
printf '\n=== workflows ===\n'
rg -n "images/cli/Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|cross-build-linux-amd64|GOARCH=amd64|platform" .github

Repository: openshift/oc-mirror

Length of output: 4912

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files | rg '(^|/)(.*images.*|.*image.*|.*\.yaml$|.*\.yml$)'
printf '\n=== Dockerfile.art refs ===\n'
rg -n "Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64|cross-build-linux-amd64|platforms?|arch|amd64" . \
  -g '!**/vendor/**' -g '!**/bin/**' -g '!**/dist/**'

Repository: openshift/oc-mirror

Length of output: 50376

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files images/cli
printf '\n---\n'
rg -n "Dockerfile\.art|cross-build-linux-amd64|linux-amd64|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64" images/cli .github Makefile --max-count 20

Repository: openshift/oc-mirror

Length of output: 815

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "images/cli/Dockerfile\.art|Dockerfile\.art|oc-mirror-rhel9-linux-amd64|oc-mirror-rhel8-linux-amd64" .github images Makefile --glob '*.yml' --glob '*.yaml' --glob 'Dockerfile*' --max-count 50

Repository: openshift/oc-mirror

Length of output: 379

---

Align the release archive names with the build arch.
In images/cli/Dockerfile.art:46-48, make build doesn’t pin GOARCH, so these tarballs can be mislabeled if the image is built on anything other than amd64. Either use the amd64 cross-build target here or derive the suffix from the build platform.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@images/cli/Dockerfile.art` around lines 46 - 48, Update the release packaging
commands in the Dockerfile so the archive architecture suffix matches the
binaries produced by the build: either invoke the amd64-pinned build target
before creating the archives or derive the names from the actual build platform.
Ensure both oc-mirror release tarballs cannot be labeled amd64 when the build
output uses another architecture.

[openshift-ci]

@aguidirh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dorzel]

/lgtm

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.