CMP-4475: Make e2e-profile usable for custom content locally + fix log dir

- Add CONTENT_IMAGE and LOG_DIR make variables (passed as -content-image /
  -log-dir) so e2e-profile can test a custom content image (e.g. one built with
  CEL content) and write artifacts to a writable directory off-CI.
- Create the log directory before writing assertion/mismatch/report artifacts
  (GenerateAssertionFileFromResults, SaveMismatchesAsYAML, GenerateMismatchReport)
  so runs don't fail when the dir does not already exist.
- Add opt-in TestCELProfileBundleLive validating the typed CELContentFile path.

Verified end to end on a fresh OCP 4.21 cluster: make e2e-profile installs CNV,
creates the CEL ProfileBundle (VALID), scans the cis-vm-extension profile, and
records results.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Vincent056

Makefile

@@ -16,6 +16,14 @@ INSTALL_VIRT?=false
 # Path (inside the content image) to the CEL content YAML. Set for CEL profiles
 # (e.g. the CIS OpenShift Virtualization benchmark), e.g. ocp4-cel-content.yaml.
 CEL_CONTENT_FILE?=
+# Content image to test. Leave empty to use the built-in default; set to a
+# custom image (e.g. one built with CEL content) to test it.
+CONTENT_IMAGE?=
+CONTENT_IMAGE_FLAG:=$(if $(strip $(CONTENT_IMAGE)),-content-image="$(CONTENT_IMAGE)")
+# Directory for logs/artifacts (assertion files, reports). Defaults to the CI
+# path; override for local runs, e.g. LOG_DIR=/tmp/artifacts.
+LOG_DIR?=
+LOG_DIR_FLAG:=$(if $(strip $(LOG_DIR)),-log-dir="$(LOG_DIR)")
 
 GOLANGCI_LINT_VERSION=latest
 BUILD_DIR := build
@@ -37,11 +45,11 @@ e2e-node: install-jq ## Run only node compliance tests
 
 .PHONY: e2e-profile
 e2e-profile: install-jq ## Run TestProfile test only
-	set -o pipefail; PATH=$$PATH:/tmp/bin go test $(TEST_FLAGS) . -run=^TestProfile$$ -profile="$(PROFILE)" -product="$(PRODUCT)" -install-operator=$(INSTALL_OPERATOR) -install-virt=$(INSTALL_VIRT) -cel-content-file="$(CEL_CONTENT_FILE)" | tee .e2e-profile-test-results.out
+	set -o pipefail; PATH=$$PATH:/tmp/bin go test $(TEST_FLAGS) . -run=^TestProfile$$ -profile="$(PROFILE)" -product="$(PRODUCT)" -install-operator=$(INSTALL_OPERATOR) -install-virt=$(INSTALL_VIRT) -cel-content-file="$(CEL_CONTENT_FILE)" $(CONTENT_IMAGE_FLAG) $(LOG_DIR_FLAG) | tee .e2e-profile-test-results.out
 
 .PHONY: e2e-profile-remediations
 e2e-profile-remediations: install-jq ## Run TestProfile test only
-	set -o pipefail; PATH=$$PATH:/tmp/bin go test $(TEST_FLAGS) . -run=^TestProfileRemediations$$ -profile="$(PROFILE)" -product="$(PRODUCT)" -install-operator=$(INSTALL_OPERATOR) -install-virt=$(INSTALL_VIRT) -cel-content-file="$(CEL_CONTENT_FILE)" | tee .e2e-profile-test-results.out
+	set -o pipefail; PATH=$$PATH:/tmp/bin go test $(TEST_FLAGS) . -run=^TestProfileRemediations$$ -profile="$(PROFILE)" -product="$(PRODUCT)" -install-operator=$(INSTALL_OPERATOR) -install-virt=$(INSTALL_VIRT) -cel-content-file="$(CEL_CONTENT_FILE)" $(CONTENT_IMAGE_FLAG) $(LOG_DIR_FLAG) | tee .e2e-profile-test-results.out
 
 .PHONY: help
 help: ## Show this help screen

helpers/celbundle_live_test.go

@@ -0,0 +1,91 @@
+package helpers
+
+import (
+	goctx "context"
+	"os"
+	"testing"
+	"time"
+
+	cmpv1alpha1 "github.com/ComplianceAsCode/compliance-operator/pkg/apis/compliance/v1alpha1"
+	backoff "github.com/cenkalti/backoff/v4"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	dynclient "sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// TestCELProfileBundleLive creates a ProfileBundle with the typed
+// spec.celContentFile field (v1.9.0 API) against a real cluster and verifies it
+// parses VALID. Opt-in: RUN_CEL_PB_LIVE=1, CONTENT_IMAGE=<image>,
+// CEL_CONTENT_FILE=<file>. Validates the dependency bump end to end.
+func TestCELProfileBundleLive(t *testing.T) {
+	if os.Getenv("RUN_CEL_PB_LIVE") != "1" {
+		t.Skip("set RUN_CEL_PB_LIVE=1 to run")
+	}
+	img := os.Getenv("CONTENT_IMAGE")
+	cel := os.Getenv("CEL_CONTENT_FILE")
+	if img == "" || cel == "" {
+		t.Fatal("CONTENT_IMAGE and CEL_CONTENT_FILE must be set")
+	}
+	c, err := GenerateKubeConfig()
+	if err != nil {
+		t.Fatalf("client: %s", err)
+	}
+	ns := "openshift-compliance"
+	name := "ocp4-virt-typed"
+
+	pb := &cmpv1alpha1.ProfileBundle{
+		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: ns},
+		Spec: cmpv1alpha1.ProfileBundleSpec{
+			ContentImage:   img,
+			ContentFile:    "ssg-ocp4-ds.xml",
+			CELContentFile: cel, // <-- the field added in v1.9.0
+		},
+	}
+	_ = c.Delete(goctx.TODO(), pb)
+	if err := c.Create(goctx.TODO(), pb); err != nil && !apierrors.IsAlreadyExists(err) {
+		t.Fatalf("create ProfileBundle: %s", err)
+	}
+	t.Logf("Created ProfileBundle %s with celContentFile=%s", name, cel)
+
+	// Wait until the bundle parses VALID.
+	key := types.NamespacedName{Name: name, Namespace: ns}
+	bo := backoff.WithMaxRetries(backoff.NewConstantBackOff(10*time.Second), 30)
+	if err := backoff.RetryNotify(func() error {
+		found := &cmpv1alpha1.ProfileBundle{}
+		if err := c.Get(goctx.TODO(), key, found); err != nil {
+			return err
+		}
+		if found.Status.DataStreamStatus != cmpv1alpha1.DataStreamValid {
+			return &statusErr{string(found.Status.DataStreamStatus)}
+		}
+		// confirm the field round-tripped through the typed API
+		if found.Spec.CELContentFile != cel {
+			t.Fatalf("celContentFile not persisted: got %q", found.Spec.CELContentFile)
+		}
+		return nil
+	}, bo, func(err error, d time.Duration) {
+		t.Logf("waiting for ProfileBundle VALID after %s: %s", d, err)
+	}); err != nil {
+		t.Fatalf("ProfileBundle did not become VALID: %s", err)
+	}
+	t.Logf("ProfileBundle %s is VALID and celContentFile round-tripped via typed API", name)
+
+	// Confirm the CEL profile was created from the CEL content file.
+	profKey := types.NamespacedName{Name: name + "-cis-vm-extension", Namespace: ns}
+	prof := &cmpv1alpha1.Profile{}
+	if err := c.Get(goctx.TODO(), profKey, prof); err != nil {
+		t.Fatalf("expected CEL profile %s: %s", profKey.Name, err)
+	}
+	scanner := prof.Annotations["compliance.openshift.io/scanner-type"]
+	t.Logf("CEL profile %s created (scanner-type=%s) with %d rules", profKey.Name, scanner, len(prof.Rules))
+	if scanner != "CEL" {
+		t.Fatalf("expected scanner-type CEL, got %q", scanner)
+	}
+}
+
+type statusErr struct{ s string }
+
+func (e *statusErr) Error() string { return "ProfileBundle status: " + e.s }
+
+var _ dynclient.Object = &cmpv1alpha1.ProfileBundle{}

helpers/utilities.go

@@ -1010,6 +1010,9 @@ func GenerateAssertionFileFromResults(
 		return fmt.Errorf("failed to marshal assertion content: %w", err)
 	}
 
+	if err := os.MkdirAll(tc.LogDir, 0o755); err != nil {
+		return fmt.Errorf("failed to create log directory %s: %w", tc.LogDir, err)
+	}
 	fullPath := path.Join(tc.LogDir, assertionFile)
 	err = os.WriteFile(fullPath, data, 0o600)
 	if err != nil {
@@ -1790,6 +1793,9 @@ func SaveMismatchesAsYAML(tc *testConfig.TestConfig, mismatchedAssertions []Asse
 	if err != nil {
 		return fmt.Errorf("failed to marshal results to YAML: %w", err)
 	}
+	if err := os.MkdirAll(tc.LogDir, 0o755); err != nil {
+		return fmt.Errorf("failed to create log directory %s: %w", tc.LogDir, err)
+	}
 	err = os.WriteFile(p, yamlData, 0o600)
 	if err != nil {
 		return fmt.Errorf("failed to write YAML file: %w", err)
@@ -1848,6 +1854,9 @@ func GenerateMismatchReport(
 	f := fmt.Sprintf("%s-report.md", bindingName)
 	p := path.Join(tc.LogDir, f)
 
+	if err := os.MkdirAll(tc.LogDir, 0o755); err != nil {
+		return fmt.Errorf("failed to create log directory %s: %w", tc.LogDir, err)
+	}
 	err := os.WriteFile(p, []byte(report.String()), 0o600)
 	if err != nil {
 		return fmt.Errorf("failed to write markdown report: %w", err)