CNTRLPLANE-3533: Add Dockerfiles to codecov ignore list

[bryan-cox]

Summary

• Adds **/Dockerfile* to the codecov ignore list so Dockerfile-only PRs (e.g. NO-JIRA: feat(ci): add skopeo and gh CLI to ARC runner image #8627) don't fail patch coverage checks

Test plan

• Verify codecov no longer flags Dockerfile changes as uncovered

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated code coverage reporting configuration to exclude Docker-related files from coverage metrics.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3533 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds **/Dockerfile* to the codecov ignore list so Dockerfile-only PRs (e.g. NO-JIRA: feat(ci): add skopeo and gh CLI to ARC runner image #8627) don't fail patch coverage checks

Test plan

• Verify codecov no longer flags Dockerfile changes as uncovered

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a2d955a7-c6ff-4d05-8893-8c707b58592d

📥 Commits

Reviewing files that changed from the base of the PR and between 9f16502 and f5b07d0.

📒 Files selected for processing (1)

• codecov.yml

---

📝 Walkthrough

Walkthrough

The codecov.yml configuration file was updated to exclude paths matching the **/Dockerfile* glob pattern from Codecov coverage reporting. This single-line addition prevents Dockerfile-related files from being included in coverage calculations.

Suggested reviewers

• csrwng
• Nirshal

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding Dockerfiles to the codecov ignore list, which matches the changeset that updates codecov.yml.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Verified 17 Ginkgo test files in PR; none contain dynamic test names (fmt.Sprintf, variable concatenation, etc.). All Ginkgo test names use static, descriptive strings as required.
Test Structure And Quality	✅ Passed	PR only modifies codecov.yml configuration; no Ginkgo test code changes present. The test quality check is not applicable to configuration-only changes.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only modifies codecov.yml to exclude Dockerfiles from coverage analysis; no deployment manifests, operator code, controllers, or scheduling constraints are affected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR only modifies codecov.yml to add Dockerfiles to the ignore list. No Ginkgo e2e tests are added, so the check for IPv6/disconnected network compatibility is not applicable.
No-Weak-Crypto	✅ Passed	PR modifies only codecov.yml to add **/Dockerfile* to ignore list. No weak crypto usage (MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB) or custom crypto implementations detected.
Container-Privileges	✅ Passed	This PR only modifies codecov.yml to add "**/Dockerfile*" to the ignore list for code coverage. It does not introduce, modify, or deploy any Kubernetes or container manifests with privileged settings.
No-Sensitive-Data-In-Logs	✅ Passed	PR only modifies codecov.yml to add "**/Dockerfile*" to ignore list; no logging code or sensitive data exposure present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[bryan-cox]

/area ci-tooling

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bryan-cox]

/verified later @bryan-cox

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @bryan-cox.

Details

In response to this:

/verified later @bryan-cox

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.68%. Comparing base (9b67f7b) to head (f5b07d0).
⚠️ Report is 23 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8640      +/-   ##
==========================================
- Coverage   45.84%   40.68%   -5.17%     
==========================================
  Files         440      755     +315     
  Lines       52824    93363   +40539     
==========================================
+ Hits        24218    37985   +13767     
- Misses      26816    52645   +25829     
- Partials     1790     2733     +943     

see 315 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	34.70% <ø> (?)
cpo-hostedcontrolplane	41.80% <ø> (ø)
cpo-other	41.39% <ø> (ø)
hypershift-operator	50.82% <ø> (ø)
other	31.61% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cblecker]

/lgtm

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 5c01c96 and 2 for PR HEAD f5b07d0 in total

[cblecker]

@bryan-cox do we need to add the codecov config file to it's own ignore? 😬

[hypershift-jira-solve-ci]

Now I have the complete picture. Here is the analysis:

Test Failure Analysis Complete

Job Information

• Prow Job: codecov/project (GitHub Check Run, not a Prow CI job)
• Build ID: Check Run ID 78579585048
• PR: #8640 — CNTRLPLANE-3533: Add Dockerfiles to codecov ignore list
• Commit: f5b07d0989f4e105819d5237ccceac3ddda90701
• Base Commit: 9b67f7b (main)

Test Failure Analysis

Error

codecov/project: 40.68% (-5.17%) compared to 9b67f7b

Summary

The codecov/project check failed because it detected a 5.17% coverage drop (45.84% → 40.68%). This is a false positive caused by an incomplete coverage baseline. The base commit 9b67f7b's Unit Tests workflow on main was cancelled mid-run — only 3 of 5 test shards uploaded coverage (440 files). The PR head ran all 5 shards (755 files). Codecov compared an artificially inflated 3-shard base (45.84%) against a complete 5-shard head (40.68%), producing a phantom 5.17% regression. The PR itself only adds one line to codecov.yml and Codecov confirms: "All modified and coverable lines are covered by tests."

Root Cause

The root cause is a stale/incomplete coverage baseline for the base commit, not a real coverage regression.

Chain of events:

1. Commit 9b67f7b was pushed to main on 2026-05-29 at 07:11 UTC.
2. The Unit Tests (Reusable) workflow (run ID 26623590420) started on main for this commit but was cancelled before completing.
   • Completed shards (uploaded coverage): cpo-hostedcontrolplane, cpo-other, hypershift-operator
   • Cancelled shards (no coverage upload): cmd-support, other
3. Codecov stored partial coverage for 9b67f7b: 440 files, 52,824 lines, 45.84% coverage — but this only reflects 3 of the 5 test shards.
4. PR CNTRLPLANE-3533: Add Dockerfiles to codecov ignore list #8640 branched from 9b67f7b. Its CI ran all 5 shards successfully on commit f5b07d0, uploading complete coverage: 755 files, 93,363 lines, 40.68% coverage.
5. The missing cmd-support shard (which covers ./cmd/... and ./support/... packages at ~34.70% coverage) and the other shard added 315 files and 40,539 lines of lower-covered code to the head report.
6. Codecov compared the incomplete base against the complete head and flagged the 5.17% drop as a project coverage regression.
7. Since codecov.yml has no explicit coverage: target or threshold configured, Codecov uses its default "auto" threshold, which flags any measurable drop.

Recommendations

1. Rebase the PR onto current main — A more recent main commit with a complete 5-shard coverage upload will serve as the baseline, eliminating the phantom regression. Commits 988f2be and 9f16502 on main both have successful full Unit Tests runs.

2. Add a coverage: section to codecov.yml to prevent this class of false positives in the future:

   coverage:
     status:
       project:
         default:
           threshold: 1%    # Allow up to 1% drop
           # or: target: auto
       patch:
         default:
           target: 80%

3. Investigate why the 9b67f7b workflow was cancelled — There is no concurrency group defined in test-reusable.yaml, so this cancellation was likely manual or triggered by an external mechanism. Adding a concurrency group with cancel-in-progress: false for main branch pushes would prevent future mid-run cancellations that corrupt the codecov baseline.

4. No action needed on the PR itself — The change (adding **/Dockerfile* to the codecov ignore list) is correct and Codecov confirms all modified lines are covered.

Evidence

Evidence	Detail
Check Run conclusion	failure — 40.68% (-5.17%) compared to 9b67f7b
Codecov patch status	✅ "All modified and coverable lines are covered by tests" — no actual coverage issue
Base commit workflow	Run 26623590420 on main for 9b67f7b — conclusion: cancelled
Base shards completed	3/5: cpo-hostedcontrolplane ✅, cpo-other ✅, hypershift-operator ✅
Base shards cancelled	2/5: cmd-support ❌, other ❌
Base coverage (incomplete)	440 files, 52,824 lines, 45.84% (3 shards only)
Head coverage (complete)	755 files, 93,363 lines, 40.68% (all 5 shards)
File count delta	+315 files, +40,539 lines — from the 2 missing shards, not from PR changes
cmd-support flag coverage	34.70% with (?) indicating no base data for comparison
PR diff	1 line added to codecov.yml: - "**/Dockerfile*" in the ignore list
Codecov threshold config	None — no coverage: section in codecov.yml, uses default "auto" threshold
Report staleness	"Report is 19 commits behind head on main" — confirming base data is outdated

---

[bryan-cox]

/override codecov/project

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: codecov/project

Details

In response to this:

/override codecov/project

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.