feat: bypass {{inherit}} for coverage so DPDY plugins are covered too

Addresses review feedback: the nightly resolves DPDY (default.packages.yaml)
plugins via {{inherit}}, which deploys the Konflux catalog image
(registry.access.redhat.com/rhdh) — not instrumentable. The previous
version only swapped the non-{{inherit}} ghcr plugins, so GA/TP plugins
got no coverage.

In a coverage run (E2E_NIGHTLY_COVERAGE=true), a rolled-out frontend DPDY
plugin now bypasses {{inherit}} and deploys the overlay's instrumented
ghcr __coverage build of the same source instead — so no Konflux pipeline
changes are needed. The functional nightly (no opt-in) is unchanged: it
still uses {{inherit}} and tests the shipped Konflux build.

Tests updated accordingly; docs (changelog + resolution reference) reflect
the bypass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavolira

docs/changelog.md

@@ -6,7 +6,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- **Nightly coverage image swap** (`E2E_NIGHTLY_COVERAGE`): In nightly plugin resolution, an explicit opt-in swaps a rolled-out frontend plugin (workspace with a `coverage-anchors/` directory) from its released OCI image to the instrumented `__coverage` variant, so a coverage-dedicated nightly run can collect browser coverage. Gated separately from the ambient `E2E_COLLECT_COVERAGE` so the functional nightly's resolution is unchanged; `{{inherit}}` (DPDY) plugins are never swapped.
+- **Nightly coverage image swap** (`E2E_NIGHTLY_COVERAGE`): In nightly plugin resolution, an explicit opt-in points a rolled-out frontend plugin (workspace with a `coverage-anchors/` directory) at the overlay's instrumented `__coverage` ghcr build so a coverage-dedicated nightly run can collect browser coverage. This includes DPDY plugins: in a coverage run they bypass `{{inherit}}` (the Konflux catalog image, which can't be instrumented) and use the ghcr build of the same source. Gated separately from the ambient `E2E_COLLECT_COVERAGE`, so the functional nightly's resolution is unchanged — it still deploys the shipped `{{inherit}}`/Konflux builds.
 
 ## [2.1.0]
 

docs/overlay/reference/plugin-metadata-resolution.md

@@ -106,16 +106,20 @@ For each plugin, the resolver checks in order:
    No  ↓
 
 3. Is nightly mode AND plugin is in default.packages.yaml AND metadata spec.dynamicArtifact is OCI?
-   Yes → use {{inherit}} tag:  oci://{registry}/plugin:{{inherit}}
+   Yes ↓
+       In a coverage run (E2E_NIGHTLY_COVERAGE=true), a rolled-out frontend plugin
+       bypasses {{inherit}} and uses the ghcr __coverage build instead (see step 4),
+       because the {{inherit}}/Konflux catalog image can't be instrumented.
+       Otherwise → use {{inherit}} tag:  oci://{registry}/plugin:{{inherit}}
          RHDH resolves both the OCI tag (version) and default config from its built-in DPDY.
          Registry: NIGHTLY_DPDY_OCI_REGISTRY_MAP > NIGHTLY_DPDY_OCI_REGISTRY > default registry.access.redhat.com/rhdh
    No  ↓
 
 4. Use metadata's dynamicArtifact as-is
    (OCI ref → OCI ref, wrapper path → wrapper path)
-   In a dedicated coverage run (E2E_NIGHTLY_COVERAGE=true), a frontend plugin
-   whose workspace is rolled out (has a coverage-anchors/ directory) gets its
-   OCI tag swapped to the instrumented __coverage variant:
+   In a coverage run (E2E_NIGHTLY_COVERAGE=true), a rolled-out frontend plugin
+   (workspace has a coverage-anchors/ directory) gets its OCI tag swapped to the
+   instrumented __coverage variant:
      oci://ghcr.io/.../plugin:bs_X__Y!alias → ...:bs_X__Y__coverage!alias
 ```
 
@@ -125,7 +129,9 @@ Metadata is the source of truth for the package reference, except for plugins in
 
 A nightly run can only collect browser coverage if RHDH deploys the **instrumented** `__coverage` plugin image (built by the overlay release publish). When `E2E_NIGHTLY_COVERAGE=true`, step 4 above swaps a rolled-out frontend plugin's released OCI tag to its `__coverage` variant.
 
-This is a separate flag from the ambient `E2E_COLLECT_COVERAGE` (which only toggles the collector fixture) on purpose: the functional nightly runs with `E2E_COLLECT_COVERAGE=true` by default, and the `__coverage` variant is built non-fatally, so swapping there could point at a tag that doesn't exist and break the deployment. The explicit `E2E_NIGHTLY_COVERAGE` opt-in keeps the functional nightly's resolution unchanged; only a coverage-dedicated run (which ensures the images exist) sets it. Plugins resolved via `{{inherit}}` are never swapped — those are RHDH's catalog images, which can't be instrumented.
+This is a separate flag from the ambient `E2E_COLLECT_COVERAGE` (which only toggles the collector fixture) on purpose: the functional nightly runs with `E2E_COLLECT_COVERAGE=true` by default, and the `__coverage` variant is built non-fatally, so swapping there could point at a tag that doesn't exist and break the deployment. The explicit `E2E_NIGHTLY_COVERAGE` opt-in keeps the functional nightly's resolution unchanged; only a coverage-dedicated run (which ensures the images exist) sets it.
+
+In a coverage run this also applies to **DPDY plugins**: instead of resolving to `{{inherit}}` (the Konflux catalog image at `registry.access.redhat.com/rhdh`, which can't be instrumented), a rolled-out frontend DPDY plugin is pointed at the overlay's instrumented ghcr `__coverage` build of the same plugin source. The functional nightly still uses `{{inherit}}` and tests the shipped Konflux build — the coverage run is a separate measurement that deliberately deploys the instrumentable ghcr build instead. No downstream/Konflux pipeline changes are needed.
 
 ## Resolution Scenarios
 

src/utils/plugin-metadata.ts

@@ -530,6 +530,17 @@ async function resolvePluginPackages(
         dpdyPackages?.has(metadata.packageName) &&
         metadata.packagePath.startsWith("oci://")
       ) {
+        // In a coverage run, a {{inherit}} ref would deploy the Konflux catalog
+        // image (registry.access.redhat.com/rhdh), which we can't instrument.
+        // Bypass it and deploy the overlay's instrumented __coverage build from
+        // ghcr (metadata.packagePath) — same plugin source, just built by us, so
+        // the run can collect coverage. The functional nightly (no coverage
+        // opt-in) still uses {{inherit}}, i.e. the shipped Konflux build.
+        if (coverageSwap && metadata.role === "frontend-plugin") {
+          const resolved = toCoverageImageRef(metadata.packagePath);
+          console.log(`[PluginMetadata] DPDY coverage: ${pkg} → ${resolved}`);
+          return { ...plugin, package: resolved };
+        }
         const registry = getDpdyRegistry(metadata.packageName);
         const inheritRef = `oci://${registry}/${displayName}:{{inherit}}`;
         console.log(`[PluginMetadata] DPDY inherit: ${pkg} → ${inheritRef}`);

src/utils/tests/plugin-metadata.nightly.test.ts

@@ -1076,11 +1076,10 @@ describe("processPluginsForDeployment — nightly coverage swap", () => {
     }
   });
 
-  it("does not swap a DPDY plugin (resolves to {{inherit}}) even when opted in", async () => {
-    // Safety guarantee: a plugin in default.packages.yaml resolves via the
-    // {{inherit}} branch (RHDH's catalog image, which we can't instrument), so
-    // the coverage swap must never reach it — otherwise the nightly would point
-    // at a __coverage tag that doesn't exist.
+  it("swaps a DPDY plugin to the ghcr __coverage build (bypassing {{inherit}}) when opted in", async () => {
+    // A {{inherit}} ref would deploy the Konflux catalog image, which can't be
+    // instrumented. In a coverage run, a rolled-out frontend DPDY plugin must
+    // instead use the overlay's instrumented ghcr build of the same source.
     process.env.E2E_NIGHTLY_COVERAGE = "true";
     const metadataDir = await createCoverageWorkspace({
       rolledOut: true,
@@ -1094,12 +1093,32 @@ describe("processPluginsForDeployment — nightly coverage swap", () => {
       );
       assert.strictEqual(
         result.plugins![0].package,
-        "oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-theme:{{inherit}}",
-        "DPDY plugin must resolve to {{inherit}}, never to a __coverage tag",
+        "oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-theme:bs_1.49.4__0.14.5__coverage!red-hat-developer-hub-backstage-plugin-theme",
+        "DPDY plugin in a coverage run must use the ghcr __coverage build, not {{inherit}}",
       );
-      assert.ok(
-        !result.plugins![0].package.includes("__coverage"),
-        "{{inherit}} ref must not be swapped to a __coverage image",
+    } finally {
+      await fs.remove(path.resolve(metadataDir, ".."));
+    }
+  });
+
+  it("keeps a DPDY plugin on {{inherit}} in the functional nightly (no opt-in)", async () => {
+    // The functional nightly (no E2E_NIGHTLY_COVERAGE) must still deploy the
+    // shipped Konflux build via {{inherit}} — unchanged from today.
+    delete process.env.E2E_NIGHTLY_COVERAGE;
+    const metadataDir = await createCoverageWorkspace({
+      rolledOut: true,
+      role: "frontend-plugin",
+    });
+    try {
+      const result = await processPluginsForDeployment(
+        config,
+        metadataDir,
+        new Set(["@red-hat-developer-hub/backstage-plugin-theme"]), // in DPDY
+      );
+      assert.strictEqual(
+        result.plugins![0].package,
+        "oci://registry.access.redhat.com/rhdh/red-hat-developer-hub-backstage-plugin-theme:{{inherit}}",
+        "functional nightly must keep DPDY plugins on {{inherit}}",
       );
     } finally {
       await fs.remove(path.resolve(metadataDir, ".."));