NO-JIRA: fix: ephemeral config override merge + Go-template variable scan

[theautoroboto]

Summary

Two independent bug fixes extracted from the self-managed Karpenter migration branch (#698), landing ahead of it since neither depends on the cluster rebuild:

• Ephemeral provider: _inject_ephemeral_config deleted and replaced every file in config/ephemeral/, including defaults.yaml, when a .ephemeral-env/ override directory was supplied. Since overrides are typically partial, any base environment setting they didn't include (e.g. dns.domain) silently disappeared from the config used to provision the environment. Now only region YAML files are replaced; defaults.yaml is deep-merged with the override instead, reusing the same load_and_merge utility already used by _apply_provision_overrides elsewhere in the file.
• render.py: scan_template_variables() misreported Go template keywords (if/else/end) as undocumented Jinja variables when they appeared inside an escaped Go template string (e.g. {{ '{{ if .foo }}X{{ else }}Y{{ end }}' }}, used to emit literal Go template syntax into rendered output). This affects config/templates/argocd-bootstrap/applicationset.yaml.j2 today. Added a regex that identifies these escaped spans and skips any variable match inside one.

Test plan

• python3 -m pytest scripts/test_render.py — 170 passed, including two new tests covering single- and double-quoted escaped Go template strings
• python3 -m py_compile on both changed files
• Ran scan_template_variables() against this repo's real config/templates/ directory to confirm no regressions on live templates

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Environment-specific configuration overrides now retain default settings that are not explicitly overridden.
  • Replaced region configurations no longer leave outdated region settings behind.
  • Documentation checks no longer incorrectly flag Go-template keywords as configuration variables.

• Tests

  • Added coverage for detecting genuine template variables while ignoring embedded Go-template control keywords.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change preserves default ephemeral configuration during overrides and replaces only region files. It also prevents escaped Go-template keywords from being reported as Jinja variables, with coverage for double- and single-quoted literals.

Changes

Ephemeral configuration overrides

Layer / File(s)	Summary
Merge ephemeral configuration overrides ci/ephemeral-provider/orchestrator.py	The orchestrator preserves defaults.yaml, deep-merges override defaults, removes existing region YAML files, and copies replacement region files.

Template variable scanning

Layer / File(s)	Summary
Filter escaped Go-template matches scripts/render.py, scripts/test_render.py	scan_template_variables skips standard and bracket-access matches inside escaped Go-template strings. Tests cover double- and single-quoted literals while retaining real Jinja variables.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both main changes: ephemeral configuration merging and Go-template variable scan fixes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/render.py`:
- Around line 427-429: Update _is_inside_escaped_go_template to avoid closing
over the loop-local skip_ranges variable by accepting skip_ranges as an explicit
argument, and update all call sites accordingly; preserve the existing
range-check behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 36bbd936-d870-4c88-ac01-71af39a6d6fc

📥 Commits

Reviewing files that changed from the base of the PR and between 864eb2e and 4a5059e.

📒 Files selected for processing (3)

• ci/ephemeral-provider/orchestrator.py
• scripts/render.py
• scripts/test_render.py

[typeid]

/lgtm
/approve
/test on-demand-e2e

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: typeid

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [typeid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@theautoroboto: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Two independent bug fixes extracted from the self-managed Karpenter migration branch (#698), landing ahead of it since neither depends on the cluster rebuild:

• Ephemeral provider: _inject_ephemeral_config deleted and replaced every file in config/ephemeral/, including defaults.yaml, when a .ephemeral-env/ override directory was supplied. Since overrides are typically partial, any base environment setting they didn't include (e.g. dns.domain) silently disappeared from the config used to provision the environment. Now only region YAML files are replaced; defaults.yaml is deep-merged with the override instead, reusing the same load_and_merge utility already used by _apply_provision_overrides elsewhere in the file.
• render.py: scan_template_variables() misreported Go template keywords (if/else/end) as undocumented Jinja variables when they appeared inside an escaped Go template string (e.g. {{ '{{ if .foo }}X{{ else }}Y{{ end }}' }}, used to emit literal Go template syntax into rendered output). This affects config/templates/argocd-bootstrap/applicationset.yaml.j2 today. Added a regex that identifies these escaped spans and skips any variable match inside one.

Test plan

• python3 -m pytest scripts/test_render.py — 170 passed, including two new tests covering single- and double-quoted escaped Go template strings
• python3 -m py_compile on both changed files
• Ran scan_template_variables() against this repo's real config/templates/ directory to confirm no regressions on live templates

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

• Environment-specific configuration overrides now retain default settings that are not explicitly overridden.

• Replaced region configurations no longer leave outdated region settings behind.

• Documentation checks no longer incorrectly flag Go-template keywords as configuration variables.

• Tests

• Added coverage for detecting genuine template variables while ignoring embedded Go-template control keywords.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.