🌱 Update boxcutter integration for sibling owners API

[perdasilva]

Description

Adapt the ClusterObjectSet controller to boxcutter v0.14.0's replacement of WithPreviousOwners with WithSiblingOwners.

The previous API only passed lower-numbered revisions, meaning boxcutter could not distinguish between an unknown controller (a true collision) and a known higher-numbered sibling revision during handover. The new WithSiblingOwners API expects all active sibling revision owners — both lower and higher — so that boxcutter can properly classify them and avoid false collision reports.

Changes

• listSiblingRevisions — new method that returns all active revisions belonging to the same ClusterExtension, excluding the current one, regardless of revision number. Filters out archived and deleting revisions. The existing listPreviousRevisions is retained for the archiving use case.
• buildBoxcutterPhases — calls listSiblingRevisions + WithSiblingOwners instead of listPreviousRevisions + WithPreviousOwners.
• NewObjectEngine — passes the new required managedBy parameter (empty string = default "boxcutter" value).
• Dependency bumps — boxcutter v0.13.1 → v0.14.0, plus transitive updates (prometheus/common, kube-openapi, cel.dev/expr).
• Unit tests — comprehensive table-driven tests for listSiblingRevisions covering: both directions, archived exclusion, deleting exclusion, cross-extension filtering, and missing owner label.

Reviewer Checklist

• API Go Documentation
• Tests: Unit Tests (and E2E Tests, if appropriate)
• Comprehensive Commit Messages
• Links to related GitHub Issue(s)

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	507f415
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/6a2bfa28c3e624000822d1e1
😎 Deploy Preview	https://deploy-preview-2764--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tmshort for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR updates the operator-controller’s Boxcutter integration to treat all active sibling ClusterObjectSet revisions (both lower and higher revision numbers) as relevant “owners”, aiming to avoid false-positive collision reporting during revision handover. It also adds coverage to validate collision behavior when a conflicting ClusterExtension is upgraded.

Changes:

• Switch Boxcutter ownership inputs from “previous revisions only” to “all active sibling revisions” and add unit tests for the sibling listing logic.
• Add an e2e scenario asserting collisions persist even when a conflicting ClusterExtension upgrades to a different version.
• Update Go module dependencies for Boxcutter (and related transitive deps).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/e2e/features/update.feature	Adds an e2e scenario for collision persistence across upgrades (but needs step/param fixes).
internal/operator-controller/controllers/revision_engine_factory.go	Adjusts Boxcutter object engine factory invocation to match updated dependency API.
internal/operator-controller/controllers/clusterobjectset_controller.go	Introduces sibling revision listing and feeds sibling owners into Boxcutter.
internal/operator-controller/controllers/clusterobjectset_controller_internal_test.go	Adds unit tests for listSiblingRevisions.
go.mod	Bumps Boxcutter + deps, but currently includes merge-conflict markers and an invalid local replace.
go.sum	Updates dependency sums, but currently includes multiple unresolved merge-conflict blocks.

Comments suppressed due to low confidence (2)

go.mod:7

• go.mod still contains unresolved merge-conflict markers (<<<<<<< / ======= / >>>>>>>). This makes the module file invalid and will break go tooling in CI. Resolve the conflict by choosing a single go directive line and removing all conflict markers, then re-run go mod tidy to ensure go.sum is consistent.

go 1.26.3

require (
	github.com/BurntSushi/toml v1.6.0
	github.com/Masterminds/semver/v3 v3.5.0

go.mod:329

• This replace points to a developer-local filesystem path, which will not exist in CI and will break module resolution for anyone else. Repository go.mod files should not contain machine-specific local replaces; rely on the tagged boxcutter version instead.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

[codecov]

Codecov Report

❌ Patch coverage is 89.28571% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.81%. Comparing base (b5f05bb) to head (507f415).

Files with missing lines	Patch %	Lines
...troller/controllers/clusterobjectset_controller.go	88.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2764      +/-   ##
==========================================
- Coverage   66.90%   66.81%   -0.09%     
==========================================
  Files         149      149              
  Lines       11382    11403      +21     
==========================================
+ Hits         7615     7619       +4     
- Misses       3210     3223      +13     
- Partials      557      561       +4     

Flag	Coverage Δ
e2e	35.14% <0.00%> (+0.02%)	⬆️
experimental-e2e	52.47% <89.28%> (-0.03%)	⬇️
unit	52.17% <78.57%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[pedjak]

question (non-blocking): The Copilot review on an earlier push mentioned an e2e .feature file change for collision persistence across upgrades, but it's absent from the current diff. Is that planned as a follow-up PR? The unit tests cover listSiblingRevisions well, but an e2e test exercising the higher-sibling handover path would add confidence that the behavioral change works end-to-end.

[pedjak]

suggestion (non-blocking): listSiblingRevisions and listPreviousRevisions share ~15 lines of identical logic (label lookup, TrackingCache.List, skip-self, skip-archived, skip-deleting). The only difference is the Revision >= cos.Spec.Revision filter. Consider extracting a private helper to reduce the duplication:

func (c *ClusterObjectSetReconciler) listActiveRevisions(
    ctx context.Context,
    cos *ocv1.ClusterObjectSet,
    include func(*ocv1.ClusterObjectSet) bool,
) ([]*ocv1.ClusterObjectSet, error)

Then listSiblingRevisions passes func(*ocv1.ClusterObjectSet) bool { return true } and listPreviousRevisions passes the revision-number check. Fine as a follow-up.