fix(orchestrator): implement Docker COPY merge semantics in template builds

[mishushakov]

Problem

The template build COPY command silently dropped files whenever a copied directory already existed non-empty at the destination:

• COPY rootfs/ / dropped everything (every top-level dir like etc, usr already exists in /), leaving files only in the /tmp unpack dir
• COPY rootfs/etc /etc copied /etc/motd but silently dropped /etc/profile.d/test-env.sh, because /etc/profile.d already exists on the Ubuntu image

Root cause: copy_script.sh moved directory contents with find -exec mv, but mv cannot merge into a non-empty directory and find -exec \; exits 0 even when the command fails. A second bug made the script operate on the alphabetically-first entry of the source's parent directory instead of the entry named by the source path.

Fix

Merge directory contents with cp -a (existing directories merged, existing files overwritten — Docker COPY semantics), select the entry by basename of the source path, and fail the build step on copy errors instead of swallowing them. Added regression tests covering merging into existing trees, overwriting existing files, and correct entry selection; verified they reproduce the bugs against the old script and pass (with -race) against the fix, with golangci-lint v2.11.4 clean.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes core template image layer installation behavior for all directory COPY steps; incorrect tar flags could still mis-merge trees, but scope is limited to the build copy script with broad regression tests.

Overview
Template build COPY could silently lose files when the destination directory already had content, because directory installs used mv via find -exec (which does not merge into non-empty dirs and still exits 0 on failure). The script also copied the alphabetically first item in the unpack folder instead of the path named by the source.

copy_script.sh now resolves the source with basename of the source path, merges directories with a tar pipe (--keep-directory-symlink, --no-overwrite-dir) so symlinks and existing dir metadata behave like Docker COPY, restores write bits before removing the source tree, and uses pipefail. Comments in copy.go document merge semantics. copy_test.go adds cases for merge into existing trees, overwrites, symlink replacement, usrmerge-style dir symlinks, read-only cleanup, and non-alphabetical source selection.

^{Reviewed by Cursor Bugbot for commit b0c22a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request updates the copy command behavior in the orchestrator to align with Docker COPY semantics, allowing directories to be merged into existing target directories and overwriting existing files instead of failing when moving into non-empty destinations. It also fixes an issue where the wrong source entry was copied if it was not the first alphabetically, and adds comprehensive unit tests to verify these behaviors. The review feedback highlights a potential permission issue where deleting the source directory after copying could fail if read-only permissions were applied to it, suggesting a chmod restoration step before removal.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2a97cb0ee

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!