🌱 Update boxcutter integration for sibling owners API

[perdasilva]

Description

Adapt the ClusterObjectSet controller to boxcutter v0.14.0's replacement of WithPreviousOwners with WithSiblingOwners.

The previous API only passed lower-numbered revisions, meaning boxcutter could not distinguish between an unknown controller (a true collision) and a known higher-numbered sibling revision during handover. The new WithSiblingOwners API expects all active sibling revision owners — both lower and higher — so that boxcutter can properly classify them and avoid false collision reports.

Changes

• listOtherActiveRevisions — extracted shared helper that encapsulates the common logic (label lookup, cache list, skip-self, skip-archived, skip-deleting) with an include predicate for caller-specific filtering.
• listSiblingRevisions — delegates to listOtherActiveRevisions passing all non-self revisions. Used by buildBoxcutterPhases with WithSiblingOwners.
• listPreviousRevisions — refactored to delegate to listOtherActiveRevisions, passing only lower revision numbers. Retained for the archiving use case.
• buildBoxcutterPhases — calls listSiblingRevisions + WithSiblingOwners instead of listPreviousRevisions + WithPreviousOwners.
• NewObjectEngine — passes the new required managedBy parameter, set to FieldOwnerPrefix ("olm.operatorframework.io").
• Dependency bumps — boxcutter v0.13.1 → v0.14.0, plus transitive updates (prometheus/common, kube-openapi, cel.dev/expr).
• Unit tests — consolidated into a single parameterized table-driven test (Test_ClusterObjectSetReconciler_listOtherActiveRevisions) that exercises both listSiblingRevisions and listPreviousRevisions against shared scenarios, eliminating ~120 lines of duplicate setup.

Reviewer Checklist

• API Go Documentation
• Tests: Unit Tests (and E2E Tests, if appropriate)
• Comprehensive Commit Messages
• Links to related GitHub Issue(s)

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	8b958c5
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/6a352508797b8d0008bb9357
😎 Deploy Preview	https://deploy-preview-2764--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tmshort for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR updates the operator-controller’s Boxcutter integration to treat all active sibling ClusterObjectSet revisions (both lower and higher revision numbers) as relevant “owners”, aiming to avoid false-positive collision reporting during revision handover. It also adds coverage to validate collision behavior when a conflicting ClusterExtension is upgraded.

Changes:

• Switch Boxcutter ownership inputs from “previous revisions only” to “all active sibling revisions” and add unit tests for the sibling listing logic.
• Add an e2e scenario asserting collisions persist even when a conflicting ClusterExtension upgrades to a different version.
• Update Go module dependencies for Boxcutter (and related transitive deps).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/e2e/features/update.feature	Adds an e2e scenario for collision persistence across upgrades (but needs step/param fixes).
internal/operator-controller/controllers/revision_engine_factory.go	Adjusts Boxcutter object engine factory invocation to match updated dependency API.
internal/operator-controller/controllers/clusterobjectset_controller.go	Introduces sibling revision listing and feeds sibling owners into Boxcutter.
internal/operator-controller/controllers/clusterobjectset_controller_internal_test.go	Adds unit tests for listSiblingRevisions.
go.mod	Bumps Boxcutter + deps, but currently includes merge-conflict markers and an invalid local replace.
go.sum	Updates dependency sums, but currently includes multiple unresolved merge-conflict blocks.

Comments suppressed due to low confidence (2)

go.mod:7

• go.mod still contains unresolved merge-conflict markers (<<<<<<< / ======= / >>>>>>>). This makes the module file invalid and will break go tooling in CI. Resolve the conflict by choosing a single go directive line and removing all conflict markers, then re-run go mod tidy to ensure go.sum is consistent.

go 1.26.3

require (
	github.com/BurntSushi/toml v1.6.0
	github.com/Masterminds/semver/v3 v3.5.0

go.mod:329

• This replace points to a developer-local filesystem path, which will not exist in CI and will break module resolution for anyone else. Repository go.mod files should not contain machine-specific local replaces; rely on the tagged boxcutter version instead.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

[codecov]

Codecov Report

❌ Patch coverage is 94.73684% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 66.77%. Comparing base (a12398a) to head (8b958c5).

Files with missing lines	Patch %	Lines
...troller/controllers/clusterobjectset_controller.go	93.75%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2764      +/-   ##
==========================================
- Coverage   66.78%   66.77%   -0.02%     
==========================================
  Files         149      149              
  Lines       11386    11394       +8     
==========================================
+ Hits         7604     7608       +4     
- Misses       3222     3224       +2     
- Partials      560      562       +2     

Flag	Coverage Δ
e2e	35.03% <0.00%> (-0.06%)	⬇️
experimental-e2e	52.50% <94.73%> (-0.06%)	⬇️
unit	52.11% <78.94%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[pedjak]

question (non-blocking): The Copilot review on an earlier push mentioned an e2e .feature file change for collision persistence across upgrades, but it's absent from the current diff. Is that planned as a follow-up PR? The unit tests cover listSiblingRevisions well, but an e2e test exercising the higher-sibling handover path would add confidence that the behavioral change works end-to-end.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

[pedjak]

Review focused on boxcutter library update and coding style.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

[pedjak]

why not setting to something like "olm" or "operator-controller"? What if boxcutter changes the treatment of empty string in the future and sets to something else than boxcutter?

[perdasilva]

I went for using the field owner prefix olm.operatorframework.io

[pedjak]

/lgtm

some e2e test are failing though