Add verify-test stage to operator Containerfile

[alebedev87]

Summary

Add a dedicated verify-test build stage to Containerfile.bpfman-operator.openshift that compiles all code including integration tests (-tags=integration_tests). The bpfman-operator-build stage depends on verify-test via a COPY --from, so the verification runs before the main build proceeds.

This would have caught the podExec duplicate symbol introduced by #2037 (cherry-pick of upstream PRs #530 and #536 without their dependency #528).

Summary by CodeRabbit

• Chores
  • Added an additional build verification step that compiles the integration test suite (compile-only) to improve build confidence.
  • The build now includes a completion marker from the verification step in the final build output for improved traceability.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

A verify-test stage is added to Containerfile.bpfman-operator.openshift to compile integration tests, and the final image copies a success marker from that stage.

Changes

Containerfile verification update

Layer / File(s)	Summary
Verify-test stage Containerfile.bpfman-operator.openshift	Adds a verify-test multi-stage build step that copies the repository, runs compile-only integration tests, and writes a completion marker.
Marker copy into final image Containerfile.bpfman-operator.openshift	Copies the completion marker from the verification stage into /tmp/ in the final image build.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• anfredette
• Billy99

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ipv6 And Disconnected Network Test Compatibility	⚠️ Warning	Integration tests hardcode clusters.IPv4 for existing clusters and deploy workloads from github.com URLs, so they assume IPv4 and public internet.	Detect cluster IP family and avoid IPv4-only paths; mirror example kustomizations/images or mark the tests [Skipped:Disconnected] for offline CI.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a verify-test stage to the operator Containerfile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: PR only adds a Containerfile stage; repo scan found no Ginkgo DSL calls or test-title changes, so no unstable test names were introduced.
Test Structure And Quality	✅ Passed	Only Containerfile.bpfman-operator.openshift changed; no Ginkgo test code or test-related files were modified, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the added integration tests are plain testing.T and use only core Kubernetes APIs, with no MicroShift-incompatible OpenShift resources.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only Containerfile.bpfman-operator.openshift changed; no Ginkgo e2e tests or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Change only adds a build-stage compile check in a Containerfile; no scheduling manifests, replicas, selectors, or affinity were introduced.
Ote Binary Stdout Contract	✅ Passed	The PR only changes Containerfile build stages; no main/init/BeforeSuite stdout code was added or modified.
No-Weak-Crypto	✅ Passed	PASS: The PR only adds a Docker build stage; searches found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB usage or secret/token comparisons in the touched file.
Container-Privileges	✅ Passed	The PR only adds a build-time verify-test stage; no new privileged/hostNetwork/hostPID/hostIPC/allowPrivilegeEscalation settings appear, and the lone USER root is pre-existing build-stage config.
No-Sensitive-Data-In-Logs	✅ Passed	The only new stage runs compile checks and touches a marker; no added logging of secrets/PII/internal hosts appears in the changed Containerfile.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Containerfile.bpfman-operator.openshift`:
- Line 10: The verify stage is copying the entire build context with COPY . .,
which can pull in unintended files and secrets. Update the
Containerfile.bpfman-operator.openshift build steps to copy only the Go module
metadata and the specific source/test directories needed for the compile check,
using the relevant build stage instructions around the COPY step instead of
broad context copying.
- Line 8: The new verify-test stage is hard-pinning the UBI toolset image tag,
which should instead follow the repo policy for Red Hat images by using a
floating tag. Update the base image reference in the verify-test stage of
Containerfile.bpfman-operator.openshift to a floating Red Hat tag so it tracks
Red Hat-managed updates consistently with the rest of the fleet.
- Around line 11-12: The verification stage is building with default module mode
and tags, so it can diverge from the real shipped build configuration. Update
the RUN step to mirror the operator build flags used later in the Containerfile
by applying the same module mode and build tags (for example, the flags used for
the final binary build) to the fail-fast `go build` command, while keeping the
`GOFLAGS` integration test invocation separate. This keeps the verification
behavior aligned with the actual build and ensures the stage exercises the same
dependency/tag set as the final operator image.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 64db33fe-26c0-4c92-96d3-246a2bd579c6

📥 Commits

Reviewing files that changed from the base of the PR and between b43e41a and 31820e4.

📒 Files selected for processing (1)

• Containerfile.bpfman-operator.openshift

[frobware]

Is it worth adding a throwaway commit that adds broken Go code to the tests / integration tests and proves the failure is surfaced?

[frobware]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87, frobware

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [alebedev87,frobware]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment