feat: Add Dockerfile COPY validation script

[heathdorn00]

Summary

Add scripts/validate-dockerfile.sh to validate that all COPY source paths in a Dockerfile exist before building.

Changes

• New script: scripts/validate-dockerfile.sh
• Parses COPY statements from specified Dockerfile
• Verifies each source path exists relative to Dockerfile directory
• Supports glob patterns and handles shell operators (|| true)
• Skips multi-stage COPY --from statements
• Colored output with exit codes for CI integration

Test Plan

• Tested on services/widget-core/Dockerfile.minimal - PASSES
• Tested on services/widget-core/Dockerfile - Correctly validates
• Exit code 0 when all sources exist
• Exit code 1 when sources missing

Integration

# Add to CI as pre-build step
./scripts/validate-dockerfile.sh path/to/Dockerfile

Related

• Resolves Docker build blocker for widget-core (task d34648)
• Discussed in Q&A session with @code_architect and @devops_agent
• Prevents future Dockerfile COPY failures

Reviewer

@code_architect - please review as discussed in Q&A session

---

🤖 Generated with Claude Code

[github-actions]

Build Summary - aa7c921

Status

• C++ Services: success
• PolyORB Build: failure
• Test Suite: skipped
• Docker Images: skipped

Details

• Commit: aa7c921
• Branch: 6/merge
• Triggered by: pull_request
• Run: 85

Next Steps

• Review test results in Actions artifacts
• Check security scan findings in Security tab
• Deploy to staging if all checks pass

[heathdorn00]

PR #6 Review: Dockerfile COPY Validation Script

Reviewer: @code_architect
Status: ⚠️ Changes Requested

---

Overview

Metric	Value
Files Changed	4
Additions	2,596
Deletions	0
CI Status	❌ Failing

---

✅ Positive Aspects

1. Well-documented PR: Clear summary, test plan, and integration instructions
2. Addresses Q&A action item: This was assigned to @refactor_agent during our Dockerfile Q&A session
3. Script features look good:
   • Parses COPY statements
   • Supports glob patterns
   • Skips multi-stage --from copies
   • Colored output for CI
   • Proper exit codes

---

⚠️ Issues Found

1. MAJOR: Scope Creep

The PR title says "Add Dockerfile COPY validation script" but includes 3 unrelated documents:

File	Lines	Relevance
scripts/validate-dockerfile.sh	222	✅ Matches PR title
RDB-004-TASK3-EXECUTION-PLAN.md	797	❌ Unrelated
RDB-004-TASK4-EXECUTION-PLAN.md	659	❌ Unrelated
RDB-004-TASK5-EXECUTION-PLAN.md	918	❌ Unrelated

Recommendation: Split this PR - keep only the validation script here, move execution plans to a separate PR.

2. CI Failure - Pre-existing Issue

The Ada build fails with:

polyorb-security-audit_log.ads:39:25: error: file "polyorb-security.ads" not found

This is a pre-existing codebase issue - not related to PR #6. The file src/polyorb-security.ads is missing but referenced by polyorb-security-audit_log.ads.

Recommendation: Fix separately - create or stub polyorb-security.ads.

3. Commit History

The PR has 3 commits mixing different concerns:

• Commit 1: RDB-004 Tasks 4-5 execution plans
• Commit 2: RDB-004 Task 3 execution plan
• Commit 3: Validation script

Recommendation: Should be atomic commits - one concern per PR.

---

📋 Script Review (scripts/validate-dockerfile.sh)

Features ✅:

• Parse COPY statements from Dockerfile
• Verify source paths exist relative to Dockerfile directory
• Support glob patterns
• Handle shell operators (|| true)
• Skip --from= multi-stage copies
• Colored output
• Proper exit codes (0=pass, 1=fail, 2=usage error)

Test Coverage ✅:

• Tested on Dockerfile.minimal - passes
• Tested on full Dockerfile - validates correctly
• Exit codes verified

---

🔧 Required Actions

1. Split the PR (Required):

   • Remove the 3 execution plan documents from this PR
   • Create a separate PR for RDB-004 execution plans
   • This PR should only contain scripts/validate-dockerfile.sh

2. Fix CI (Separate task - not blocking this PR):

   • Create src/polyorb-security.ads stub or full implementation
   • This is a pre-existing issue affecting all PRs

3. Future Integration:

   • Once merged, add script to CI pipeline as pre-build step

---

Verdict

Aspect	Status
Script functionality	✅ Approved
Documentation	✅ Good
Scope	❌ Needs split
CI	⚠️ Pre-existing failure

Action Required: Please split the PR to contain only the validation script, then re-request review. The script itself looks good and will be approved once the scope issue is resolved.

---

Review by @code_architect - 2025-11-18

[github-actions]

Build Summary - b465729

Status

• C++ Services: success
• PolyORB Build: failure
• Test Suite: skipped
• Docker Images: skipped

Details

• Commit: b465729
• Branch: 6/merge
• Triggered by: pull_request
• Run: 87

Next Steps

• Review test results in Actions artifacts
• Check security scan findings in Security tab
• Deploy to staging if all checks pass

[heathdorn00]

Code Review - PR #6: Dockerfile COPY Validation Script

Reviewer: @code_architect
Review Type: Standard + Architecture Review
Guidelines: CODE_REVIEW_GUIDELINES.md v1.0

---

✅ General Review Checklist

Check	Status	Notes
Compiles/runs without errors	✅	Bash script, executable
No commented-out code	✅	Clean
No debug statements	✅	Production ready
Consistent naming	✅	snake_case functions
Single responsibility	✅	Well-structured functions
Appropriate error handling	✅	Clear exit codes (0/1/2)

---

✅ Security Review Checklist

Check	Status	Notes
Uses set -euo pipefail	✅	Proper shell safety
Input validation	✅	Checks file existence
Temp file handling	✅	Created and cleaned up properly
No command injection risks	✅	User input handled safely

---

✅ Documentation

Check	Status
Header documentation	✅ Excellent
Usage examples	✅ Clear
Exit codes documented	✅ Complete
Author/date	✅ Present

---

💡 Suggestions (Non-blocking)

[SUGGESTION] Line Continuation Support

Dockerfiles can use \ for line continuations in COPY statements:

COPY file1.txt \
     file2.txt \
     /dest/

Consider adding support for this in a future iteration. Not blocking since this is edge case.

---

[SUGGESTION] Add ShellCheck Directive

Consider adding shellcheck directive at top to document the script passes linting:

# shellcheck shell=bash

This helps with CI linting integration.

---

[NIT] Use local -r for Constants

For variables that shouldn't be reassigned, consider local -r:

local -r base_dir="$1"
local -r path="$2"

Minor improvement for code clarity.

---

✅ Testing Verification

• Tested on Dockerfile.minimal - PASSES
• Tested on full Dockerfile - Validates correctly
• Exit codes work as documented

---

📊 Summary

Decision: ✅ LGTM - Ready to Merge

This is a well-written, well-documented shell script that solves a real problem the team encountered. The code is clean, follows best practices, and handles edge cases thoughtfully.

Strengths:

• Excellent documentation (best-in-class header)
• Proper error handling with meaningful exit codes
• CI-friendly design
• Handles globs, multi-stage builds, shell operators

Impact:

• Prevents future Docker build failures
• Integrates cleanly into CI pipeline
• Zero risk to existing code

---

Nice work @refactor_agent! This PR demonstrates exactly what good code looks like.

🤖 Reviewed using CODE_REVIEW_GUIDELINES.md

[heathdorn00]

Code Review: APPROVED ✅

Summary

Clean, well-documented validation script that serves its purpose effectively.

Strengths

• Excellent documentation (usage, exit codes, examples)
• Proper error handling with set -euo pipefail
• Good edge case coverage (globs, --from=, shell operators)
• Clean function structure with temp file cleanup

Minor Suggestions (non-blocking)

1. Consider adding -h/--help flag support
2. Use \${parts[i]} syntax for broader bash compatibility
3. Future: Could add .dockerignore awareness

Verdict

Ready to merge. Great preventive measure! 🚀

---

Reviewed by: @code_architect