HYPERFLEET-1467 - feat: Add the read-only tenancy map to the Resource spec

[mliptak0]

Summary

Add the read-only tenancy map to the Resource spec

• HYPERFLEET-1467

Test Plan

• Unit tests added/updated
• make test-all passes
• make lint passes
• Helm chart changes validated with make test-helm (if applicable)
• Deployed to a development cluster and verified (if Helm/config changes)
• E2E tests passed (if cross-component or major changes)

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Resource responses now include an optional, server-populated tenancy map with dimensions such as organization and account identifiers.
  • The field is read-only and isn’t accepted when creating or updating resources.

• Documentation

  • Updated API documentation and examples to describe the new tenancy information.

• Release

  • Published version 1.0.27 with updated release notes and API version metadata.

Walkthrough

The API version advances to 1.0.27. The Resource model and OpenAPI schema add an optional, server-populated, read-only tenancy map with string-valued dimensions. Resource examples include organization_id and account_id. Package metadata and changelog links are updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: rh-amarin, ma-hill

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	CWE-532 review found no slog, log, logr, zap, fmt.Print*, or equivalent log calls in non-excluded files; no secret-bearing log fields or interpolated strings exist.
No Hardcoded Secrets	✅ Passed	PR additions contain no API key, token, password, private key, credential literal, embedded-credential URL, or base64 string over 32 characters; no CWE-798 finding.
No Weak Cryptography	✅ Passed	The two added lines only mark Resource.tenancy read-only; repository and diff scans found no banned primitive, custom crypto, or secret comparison (CWE-327 not present).
No Injection Vectors	✅ Passed	The patch adds only @visibility(Lifecycle.Read) and OpenAPI readOnly: true; no SQL, command execution, template.HTML, or yaml.Unmarshal patterns (CWE-89/78/79/502).
No Privileged Containers	✅ Passed	The full PR diff changes only API schema, TypeSpec, changelog, and package metadata; no Kubernetes, Helm, or Docker files or prohibited privilege settings are present. No CWE applies.
No Pii Or Sensitive Data In Logs	✅ Passed	The PR changes only TypeSpec/OpenAPI model and schema files; the commit diff and repository-wide search found no slog, logr, zap, log, or fmt.Print logging statements.
Title check	✅ Passed	The title clearly identifies the addition of a read-only tenancy map to the Resource specification.
Description check	✅ Passed	The description directly explains the addition of the read-only tenancy map and references the related tracking issue.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@shared/models/resource/model.tsp`:
- Around line 52-53: Update the tenancy property in the Resource model with
`@visibility`(Lifecycle.Read) so generated Resource schemas mark it readOnly while
create and patch schemas continue omitting it. Add a schema test verifying
tenancy is response-only.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b2c12b78-d7da-4f72-b591-63aa0bb0c726

📥 Commits

Reviewing files that changed from the base of the PR and between c0862ff and d441c7b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• CHANGELOG.md
• main.tsp
• package.json
• schemas/core/openapi.yaml
• shared/models/resource/example_resource.tsp
• shared/models/resource/model.tsp

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

[mliptak0]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[rh-amarin]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rh-amarin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rh-amarin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment