Fix OKD image build procedure

[ggiguash]

Closes #223

Summary by CodeRabbit

• Bug Fixes

  • Adjusted the OKD image build’s builder base image reference to ensure the expected build stage is used.

• Chores

  • Improved reliability of downloads and “latest”/tag resolution by making HTTP errors fail fast across workflows and build/release scripts (including image manifest/tag selection and CNI plugin artifact retrieval).
  • Updated container and automation steps to use stricter download behavior, reducing silent or partial failures when artifacts are unavailable.

[coderabbitai]

📝 Walkthrough

Walkthrough

Several curl commands now use -fsSL for stricter download and tag-lookup behavior. The OKD image build helper also adds a targeted rewrite for the Dockerfile builder stage.

Changes

curl Flag Hardening

Layer / File(s)	Summary
CI workflow and action curl hardening .github/actions/prebuild/action.yaml, .github/workflows/cncf-conformance.yaml	curl updated to -fsSL for the OKD client tarball download and latest release tag resolution.
Container and build script curl hardening packaging/srpm.Containerfile, src/copr/cni/build.sh, src/kindnet/generate_manifests.sh	curl updated to -fsSL for OKD client archive, CNI plugin amd64/arm64 tarballs, and kindnet/kube-proxy tag and manifest list fetches.
Install and quickstart script curl hardening src/quickrpm.sh, src/quickstart.sh, src/rpm/postinstall.sh	curl updated to -fsSL for GitHub script/RPM tarball downloads, latest-tag lookups, and CNI plugin package retrieval.

OKD build image rewrite

Layer / File(s)	Summary
Builder stage rewrite src/okd/build_images.sh	base_image() adds a sed -i rewrite for the Dockerfile FROM ... AS builder stage to use the CentOS Stream 9 builder image.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• microshift-io/microshift#105: Touches src/okd/build_images.sh’s base_image() logic, which this PR also changes.
• microshift-io/microshift#122: Modifies src/quickstart.sh’s latest release lookup path, which this PR also updates.
• microshift-io/microshift#177: Modifies .github/workflows/cncf-conformance.yaml’s latest tag resolution logic, which this PR also changes.

Suggested reviewers

• pmtk

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Several unrelated curl-hardening edits and the src/okd/build_images.sh rewrite go beyond the OKD ARM fix in #223.	Split the general curl-consistency and builder-image changes into separate PRs, keeping only the #223 OKD ARM download fix here.
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The OKD client download change aligns with the ARM build failure described in #223.
Title check	✅ Passed	The title is broad, but it accurately reflects the main OKD build-related changes in the pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/copr/cni/build.sh (1)

52-53: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Add --retry for consistency and resilience. These release-tarball downloads gate the build but lack --retry, unlike curl at Line 18 and the other hardened calls in this PR. Since the PR aims for consistent curl options, align them.

♻️ Proposed change

-curl -fsSL -o amd64.tgz "https://github.com/containernetworking/plugins/releases/download/v${version}/cni-plugins-linux-amd64-v${version}.tgz"
-curl -fsSL -o arm64.tgz "https://github.com/containernetworking/plugins/releases/download/v${version}/cni-plugins-linux-arm64-v${version}.tgz"
+curl -fsSL --retry 3 -o amd64.tgz "https://github.com/containernetworking/plugins/releases/download/v${version}/cni-plugins-linux-amd64-v${version}.tgz"
+curl -fsSL --retry 3 -o arm64.tgz "https://github.com/containernetworking/plugins/releases/download/v${version}/cni-plugins-linux-arm64-v${version}.tgz"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/copr/cni/build.sh` around lines 52 - 53, The release-tarball download
commands in the cni build script are missing the same retry behavior used
elsewhere, so update the amd64.tgz and arm64.tgz curl calls to include --retry
for consistency and resilience. Make the change in the build.sh download block
alongside the existing curl options, matching the hardened pattern already used
by the other curl invocations in this script.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/copr/cni/build.sh`:
- Around line 52-53: The release-tarball download commands in the cni build
script are missing the same retry behavior used elsewhere, so update the
amd64.tgz and arm64.tgz curl calls to include --retry for consistency and
resilience. Make the change in the build.sh download block alongside the
existing curl options, matching the hardened pattern already used by the other
curl invocations in this script.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d1211d41-accf-4bc4-88fc-fa24e3dee42d

📥 Commits

Reviewing files that changed from the base of the PR and between b6e7a99 and 5d40f63.

📒 Files selected for processing (8)

• .github/actions/prebuild/action.yaml
• .github/workflows/cncf-conformance.yaml
• packaging/srpm.Containerfile
• src/copr/cni/build.sh
• src/kindnet/generate_manifests.sh
• src/quickrpm.sh
• src/quickstart.sh
• src/rpm/postinstall.sh