OPCT-428: make mco-sanitize COPY optional for arm64

[bshaw7]

Fix CI release-latest build failure on arm64. The tools:v0.6.0 arm64 image does not have mco-sanitize (not published for aarch64). Use wildcard glob so COPY succeeds silently on arm64. collector.sh already handles the missing binary with manual redaction fallback.

Fixes: https://github.com/redhat-openshift-ecosystem/provider-certification-plugins/actions/runs/29516430669

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved tools image builds across supported architectures by using the correct architecture-specific mco-sanitize download.
  • Simplified installation of the mco-sanitize utility during image creation.

Walkthrough

The tools image build now derives an architecture-specific mco-sanitize URL, passes it as a build argument, and installs the artifact at /usr/bin/mco-sanitize with executable permissions.

Changes

mco-sanitize build flow

Layer / File(s)	Summary
Architecture mapping and binary installation build.sh, tools/Containerfile	build_tools maps TARGET_ARCH, passes MCO_SANITIZE_URL to the image build, and the Containerfile adds the artifact and makes it executable.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: jcpowermac, rvanderp3

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the arm64 mco-sanitize change, though it omits the new build-arg URL mechanism.
Description check	✅ Passed	The description clearly explains the arm64 build failure and the mco-sanitize handling change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/Containerfile`:
- Around line 57-60: Make the mco-sanitize download optional in
tools/Containerfile lines 57-60 by conditionally fetching and installing it only
when the architecture-specific URL is available, allowing the image build to
continue otherwise. Apply the same conditional handling to
artifacts-collector/Containerfile lines 39-43; both sites must permit runtime
fallback when the binary cannot be downloaded.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 886af716-a486-4de3-a9bd-4c7b88fd39ea

📥 Commits

Reviewing files that changed from the base of the PR and between d649d08 and 19855d1.

📒 Files selected for processing (2)

• artifacts-collector/Containerfile
• tools/Containerfile

[bshaw7]

Below test shows now quay.io/opct/tools:v0.6.0 has mco-sanitize for amd64 and arm64

bshaw-mac:~ bshaw$ podman run --platform linux/amd64 --rm quay.io/opct/tools:v0.6.0 ls -lh /usr/bin/mco-sanitize 2>&1
-rwxr-xr-x. 1 root root 16M Jul 16 18:02 /usr/bin/mco-sanitize
bshaw-mac:~ bshaw$ podman run --platform linux/arm64 --rm quay.io/opct/tools:v0.6.0 ls -lh /usr/bin/mco-sanitize 2>&1
Trying to pull quay.io/opct/tools:v0.6.0...
Getting image source signatures
Copying blob sha256:a771bf091b727a339c58f00467531eac89b635681c60b898558eb67cfb3751ee
Copying blob sha256:2fd886f70b95d5f317bf29e960dcdf5c7091773dd8ec9fd5ec64fc24b6fdbc31
Copying blob sha256:fd0df3639653398ce8a5f9e272f4f7e997c15eaf6a6eac00b751df20f85b4aac
Copying blob sha256:3f29f9133612692f229da6de17889fea78a57f68afed396ad8ceea4547f99748
Copying blob sha256:91fdc0d03821c50468f5dda3d430320b530e939c5655cfc775a52cabecaee768
Copying blob sha256:1df0e4997943de47853ba0ff78160d0638fe838be6d7e5422cebe9d12fad1600
Copying blob sha256:6a538b592e474b2b2cd2e0a37fbc4ebe79912e457bad41eab96dba6072a6e102
Copying config sha256:9c4434c8ef900b3d5d988fac91a6cd891dad282dedc860647657e37ecd837ba6
Writing manifest to image destination
-rwxr-xr-x. 1 root root 17M Jul 16 18:03 /usr/bin/mco-sanitize
bshaw-mac:~ bshaw$ 

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/Containerfile`:
- Around line 57-59: Replace the unconditional ADD of MCO_SANITIZE_URL with a
curl-based download that tolerates missing or unavailable URLs, leaving
/usr/bin/mco-sanitize absent rather than creating an invalid or empty file. Keep
the chmod step conditional on a successfully downloaded executable so image
builds continue when mco-sanitize is unpublished.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: d1cfb82c-eef8-4e0b-b63d-f9f594fa143f

📥 Commits

Reviewing files that changed from the base of the PR and between 19855d1 and a11f660.

📒 Files selected for processing (2)

• build.sh
• tools/Containerfile

[bshaw7]

Verification: tools:v0.6.0 rebuilt with build.sh approach

All binaries present on both architectures:

$ podman run --platform linux/amd64 --rm quay.io/opct/tools:v0.6.0 ls -lh /usr/bin/oc /usr/bin/jq /usr/bin/camgi /usr/bin/mco-sanitize
-rwxr-xr-x. 1 1000 1000 1.5M Jul 17 06:48 /usr/bin/camgi
-rwx--x--x. 1 root root 2.3M Dec 13  2023 /usr/bin/jq
-rwx--x--x. 1 root root  16M Jan  1  1970 /usr/bin/mco-sanitize
-rwxr-xr-x. 1 root root 128M Jul 17 06:48 /usr/bin/oc

$ podman run --platform linux/arm64 --rm quay.io/opct/tools:v0.6.0 ls -lh /usr/bin/oc /usr/bin/jq /usr/bin/camgi /usr/bin/mco-sanitize
-rwxr-xr-x. 1 1000 1000 1.5M Jul 17 06:49 /usr/bin/camgi
-rwx--x--x. 1 root root 1.7M Dec 13  2023 /usr/bin/jq
-rwx--x--x. 1 root root  17M Jan  1  1970 /usr/bin/mco-sanitize
-rwxr-xr-x. 1 root root 126M Jul 17 06:49 /usr/bin/oc

[mtulio]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mtulio

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mtulio]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment