Repository: ansible/ansible-builder

Issue:
Fix `hadolint` issues in the template.
I `create` my context and `build` the image from a `kaniko` container, but my pipeline runs `hadolint` before building... Then I've noticed a few issues with the `Dockefile` generated...

```Dockerfile
ARG EE_BASE_IMAGE=****
ARG EE_BUILDER_IMAGE=****

FROM $EE_BASE_IMAGE as galaxy
ARG ANSIBLE_GALAXY_CLI_COLLECTION_OPTS=
ARG ANSIBLE_GALAXY_CLI_ROLE_OPTS=
USER root

ADD _build/ansible.cfg ~/.ansible.cfg

ADD _build /build
WORKDIR /build

RUN ansible-galaxy role install $ANSIBLE_GALAXY_CLI_ROLE_OPTS -r requirements.yml --roles-path "/usr/share/ansible/roles"
RUN ANSIBLE_GALAXY_DISABLE_GPG_VERIFY=1 ansible-galaxy collection install $ANSIBLE_GALAXY_CLI_COLLECTION_OPTS -r requirements.yml --collections-path "/usr/share/ansible/collections"

FROM $EE_BUILDER_IMAGE as builder

COPY --from=galaxy /usr/share/ansible /usr/share/ansible

RUN ansible-builder introspect --sanitize --write-bindep=/tmp/src/bindep.txt --write-pip=/tmp/src/requirements.txt
RUN assemble

FROM $EE_BASE_IMAGE
USER root

COPY --from=galaxy /usr/share/ansible /usr/share/ansible

COPY --from=builder /output/ /output/
RUN /output/install-from-bindep && rm -rf /output/wheels
LABEL ansible-execution-environment=true
```

The previous file yields a report as follows:

```
context/Dockerfile:4 DL3006 warning: Always tag the version of an image explicitly
context/Dockerfile:6 DL3002 warning: Last USER should not be root
context/Dockerfile:8 DL3020 error: Use COPY instead of ADD for files and folders
context/Dockerfile:10 DL[30](https://gitlab.rnd.nxp.com/shared/execution_environment/default/-/jobs/885556#L30)20 error: Use COPY instead of ADD for files and folders
context/Dockerfile:14 DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
context/Dockerfile:16 DL3006 warning: Always tag the version of an image explicitly
context/Dockerfile:21 DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
context/Dockerfile:23 DL3006 warning: Always tag the version of an image explicitly
context/Dockerfile:24 DL3002 warning: Last USER should not be root
```

Maybe is worth checking these issues and seeing if there is any improvement there. :)

Discussion:

Patch:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9756a45..e9f3fc1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
       - id: has_secrets
         if: ${{ env.secret_user != '' && env.secret_pass != '' }}
         run: |
-          echo "::set-output name=has_secrets::${{ true }}"
+          echo "has_secrets=${{ true }}" >> $GITHUB_OUTPUT
     outputs:
       has_secrets: ${{ steps.has_secrets.outputs.has_secrets }}
 
diff --git a/ansible_builder/containerfile.py b/ansible_builder/containerfile.py
index 0f5575b..6035bb2 100644
--- a/ansible_builder/containerfile.py
+++ b/ansible_builder/containerfile.py
@@ -292,7 +292,7 @@ class Containerfile:
             context_file_path = os.path.join(
                 constants.user_content_subfolder, 'ansible.cfg')
             self.steps.extend([
-                f"ADD {context_file_path} ~/.ansible.cfg",
+                f"COPY {context_file_path} ~/.ansible.cfg",
                 "",
             ])
 
@@ -315,7 +315,7 @@ class Containerfile:
     def _prepare_build_context(self):
         if any(self.definition.get_dep_abs_path(thing) for thing in ('galaxy', 'system', 'python')):
             self.steps.extend([
-                "ADD {0} /build".format(constants.user_content_subfolder),
+                f"COPY {constants.user_content_subfolder} /build",
                 "WORKDIR /build",
                 "",
             ])
@@ -359,13 +359,13 @@ class Containerfile:
 
             if requirements_file_exists:
                 relative_requirements_path = os.path.join(constants.user_content_subfolder, constants.CONTEXT_FILES['python'])
-                self.steps.append(f"ADD {relative_requirements_path} {constants.CONTEXT_FILES['python']}")
+                self.steps.append(f"COPY {relative_requirements_path} {constants.CONTEXT_FILES['python']}")
                 # WORKDIR is /build, so we use the (shorter) relative paths there
                 introspect_cmd += " --user-pip={0}".format(constants.CONTEXT_FILES['python'])
             bindep_exists = os.path.exists(os.path.join(self.build_outputs_dir, constants.CONTEXT_FILES['system']))
             if bindep_exists:
                 relative_bindep_path = os.path.join(constants.user_content_subfolder, constants.CONTEXT_FILES['system'])
-                self.steps.append(f"ADD {relative_bindep_path} {constants.CONTEXT_FILES['system']}")
+                self.steps.append(f"COPY {relative_bindep_path} {constants.CONTEXT_FILES['system']}")
                 introspect_cmd += " --user-bindep={0}".format(constants.CONTEXT_FILES['system'])
 
             introspect_cmd += " --write-bindep=/tmp/src/bindep.txt --write-pip=/tmp/src/requirements.txt"


Test patch:
diff --git a/test/unit/test_main.py b/test/unit/test_main.py
index 9382b24..8da9d73 100644
--- a/test/unit/test_main.py
+++ b/test/unit/test_main.py
@@ -41,7 +41,7 @@ def test_galaxy_requirements(exec_env_definition_file, galaxy_requirements_file,
     with open(aee.containerfile.path) as f:
         content = f.read()
 
-    assert f'ADD {constants.user_content_subfolder} /build' in content
+    assert f'COPY {constants.user_content_subfolder} /build' in content
 
 
 def test_base_image_via_build_args(exec_env_definition_file, tmp_path):
@@ -129,7 +129,7 @@ def test_ansible_config_for_galaxy(exec_env_definition_file, tmp_path, data_dir)
     with open(aee.containerfile.path) as f:
         content = f.read()
 
-    assert f'ADD {constants.user_content_subfolder}/ansible.cfg ~/.ansible.cfg' in content
+    assert f'COPY {constants.user_content_subfolder}/ansible.cfg ~/.ansible.cfg' in content
 
 
 @pytest.mark.test_all_runtimes