ROX-35910: add observability for scanner-type divergence in compliance profile dispatchers

[guzalv]

Description

Follow-up to #21904 and #21905. The compliance coverage join relies on BuildProfileRefID producing identical UUIDs from the profile dispatcher and the scan dispatcher. If they diverge, the result is always the same silent symptom: 0 checks shown. This adds targeted logs to make such divergence detectable without a code change.

Edge cases that are now observable:

• Unknown scanner type (Warn): if CO introduces a new scanner type that also uses the k8s name in ComplianceScan.Spec.Profile (e.g. a hypothetical future type), the dispatcher falls back to XCCDF ID, causing a mismatch. The Warn log names the unknown type and the profile, making root cause obvious.
• Empty ProfileId after selection (Warn): if complianceProfile.ID is empty for a non-CEL profile, BuildProfileRefID silently produces a wrong UUID. Now surfaced.
• CEL scanner detected (Debug): confirms the k8s-name branch was taken, with both the name and the XCCDF ID logged for cross-referencing.

Also fixes a latent issue in the TP dispatcher: the `Status.ID == """ guard skipped CEL TPs that had no XCCDF Status.ID, even though CEL TPs use the k8s name and don't need Status.ID. Now CEL TPs without Status.ID are allowed through.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed

Testing and quality

• the change is production ready
• CI results are inspected

Automated testing

• added unit tests (unknown scanner type fallback, CEL TP without Status.ID)

How I validated my change

Unit tests pass. Build clean.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Corrected profile identification for CEL-based compliance profiles by using their Kubernetes object names.
  • CEL tailored profiles are now processed even when no status ID is available.
  • OpenSCAP profiles continue using their XCCDF identifiers.
  • Added safe fallback behavior for unrecognized scanner types, with improved diagnostics.
• Tests
  • Added coverage for profile and tailored-profile identification across CEL, OpenSCAP, and unknown scanner types.

Walkthrough

Profile dispatchers now derive ProfileId from scanner type: CEL profiles use Kubernetes object names, while OpenSCAP and unknown types use existing payload or status IDs. Tailored CEL profiles with empty status IDs are now forwarded.

Changes

Scanner-aware dispatch

Layer / File(s)	Summary
Profile identifier forwarding sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go, sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles_test.go	Profile events assign CEL identifiers from Kubernetes names and retain payload IDs for OpenSCAP and unknown scanner types across v1 and v2 paths.
Tailored profile identifier forwarding sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go, sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles_test.go	CEL tailored profiles with empty status IDs are forwarded using Kubernetes names; OpenSCAP, empty, and unknown scanner types use status IDs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: added observability around scanner-type divergence in compliance profile dispatchers.
Description check	✅ Passed	The description follows the template well, covering the change summary, documentation, testing, and validation with specific details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gualvare/ROX-35910-tailored-profile-scanner-type

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch gualvare/ROX-35910-tailored-profile-scanner-type

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go (1)

47-77: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated scanner-type → ProfileId dispatch logic across both dispatchers.

Both files independently implement the same CEL/OpenSCAP/unknown switch with parallel debug/warn messages. Any future scanner type must be added in two places in lockstep, risking drift.

• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go#L47-L77: extract the scanner-type switch (CEL → k8s name, OpenSCAP/empty → XCCDF ID, default → warn+fallback) into a shared helper, e.g. resolveProfileID(annotations map[string]string, k8sName, xccdfID, entityName string) string.
• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go#L71-L94: reuse the same shared helper instead of re-implementing the switch, passing tailoredProfile.Status.ID as the XCCDF ID.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go`
around lines 47 - 77, Duplicate scanner-type-to-ProfileId resolution should be
centralized to prevent the two dispatchers from drifting. In
sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go
lines 47-77, extract the CEL, OpenSCAP/empty, and unknown-type handling into a
shared resolveProfileID helper that preserves the existing logging and fallback
behavior; in
sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go
lines 71-94, remove the parallel switch and reuse that helper, passing
tailoredProfile.Status.ID as the XCCDF ID.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go`:
- Around line 47-77: Duplicate scanner-type-to-ProfileId resolution should be
centralized to prevent the two dispatchers from drifting. In
sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go
lines 47-77, extract the CEL, OpenSCAP/empty, and unknown-type handling into a
shared resolveProfileID helper that preserves the existing logging and fallback
behavior; in
sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go
lines 71-94, remove the parallel switch and reuse that helper, passing
tailoredProfile.Status.ID as the XCCDF ID.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f0a25c7-66af-485a-bb7f-834d1b7b5dd3

📥 Commits

Reviewing files that changed from the base of the PR and between 00912c3 and 136727d.

📒 Files selected for processing (4)

• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles.go
• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatorprofiles_test.go
• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles.go
• sensor/kubernetes/complianceoperator/dispatchers/complianceoperatortailoredprofiles_test.go