Fix group write permissions on CI image workdir

[kasturinarra]

Summary

• OpenShift CI assigns a random UID in the root group. Without g+rwx on /opt/app-root/src/edge-tooling, the eval harness gets "Permission denied" creating eval/runs/ and falls back to /tmp
• The copy_artifacts trap then finds no reports at the expected path, so report.html and summary.yaml are missing from Spyglass artifacts
• Adds chmod -R g+rwx matching the same pattern used in the ai-helpers base image

Test plan

• After merge + image rebuild, run /test eval-all on an edge-tooling PR
• Verify report.html and summary.yaml appear in Spyglass artifacts

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved shared access permissions for application files in CI build environments.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kasturinarra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kasturinarra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The CI container build now recursively grants group read, write, and execute permissions to /opt/app-root/src/edge-tooling after copying repository contents.

Changes

Container build permissions

Layer / File(s)	Summary
Apply repository group permissions images/Containerfile.ci	Adds a recursive chmod -R g+rwx step for the copied repository path.

Estimated code review effort: 1 (Trivial) | ~2 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	PR/commit mention Claude Code, but the only AI attribution trailer is Co-Authored-By; no Assisted-by or Generated-by trailer is present.	Replace the AI Co-Authored-By trailer with the required Red Hat attribution trailer (Assisted-by: or Generated-by:) in the commit/PR metadata.
No-Weak-Crypto	❓ Inconclusive	placeholder2	need investigation

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change to add group write permissions in the CI image workdir.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Container-Privileges	✅ Passed	No privileged/K8s security flags were found; the only root use is USER 0:0 in the build Containerfile for chmod/dnf, which is justified.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only adds a chmod line; it introduces no new logging or secret-bearing output.
No-Hardcoded-Secrets	✅ Passed	PR only adds a chmod line; no hardcoded secrets, tokens, passwords, or credentialed URLs appear in the diff.
No-Injection-Vectors	✅ Passed	The PR only adds a chmod line in images/Containerfile.ci; no SQL/shell/eval/pickle/yaml/innerHTML sinks are introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@images/Containerfile.ci`:
- Line 8: Update the permission command following the repository setup to limit
recursive group-write access to the required eval/runs directories, or otherwise
replace g+rwx with g+rwX so regular files do not gain execute permissions;
preserve only the shared access needed by those directories.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ce595d40-21a1-47af-8ced-f733a5b40a08

📥 Commits

Reviewing files that changed from the base of the PR and between 97e1bfb and 6c554b5.

📒 Files selected for processing (1)

• images/Containerfile.ci

[jeff-roche]

/lgtm