fix(ocp-admin): remove oc CLI dependency from coreos-cve-validator (MGMT-24450)

[p-rog]

Summary

Removes the oc CLI dependency from the coreos-cve-validator skill by replacing
oc adm release info with direct podman-based extraction of the release image's
image-references manifest.

Before: The fetch_coreos_metadata.py script required both oc and podman CLI tools.
It used oc adm release info <version> --pullspecs to query OCP release metadata (creation
date, CoreOS pullspec, component versions) and then podman to extract RPM packages.

After: The script uses only podman — it reads /release-manifests/image-references
directly from the release image (quay.io/openshift-release-dev/ocp-release:<version>-x86_64)
via podman run --rm --entrypoint cat. This JSON file contains all the same metadata
(creation timestamp, CoreOS pullspec, machine-os version, component versions) that
oc adm release info was extracting.

Why: The oc CLI is typically not available in agent execution environments (Cloud Agents,
CI runners). Skills should use MCP tools or bundled scripts with minimal CLI dependencies.
Since podman was already a hard requirement for RPM extraction, reusing it for release
metadata eliminates the extra dependency entirely.

Changes

File	Change
ocp-admin/scripts/security-validation/fetch_coreos_metadata.py	Replace oc adm release info with podman run ... cat /release-manifests/image-references; new parse_image_references() function parses the JSON manifest instead of text output; removed oc prerequisite check
ocp-admin/skills/coreos-cve-validator/SKILL.md	Updated prerequisites (removed oc) and Step 3 description
ocp-admin/skills/cluster-creator/SKILL.md	Minor wording: "use oc CLI" → "use MCP tools or CLI" in two places

Functional verification

Tested against OCP 4.21.5 — all fields populated correctly:

ocp_version: 4.21.5
created: 2026-03-06T13:47:29Z
machine_os: 9.6.20260303-1
rhel_version: 9.6
rpm_count: 567
rpm_by_source: {'rhel': 562, 'ocp': 3, 'fast_datapath': 2}
component_versions: {'kubectl': '1.34.1', 'kubernetes': '1.34.4', 'kubernetes-tests': '1.34.1'}
errors: []

Pack(s) affected

• ocp-admin

Change type

• Update existing skill / agent

Contribution method

• Manual contribution (validated with make validate + make validate-skill-design-changed)

AGENTS.md compliance

• Agents orchestrate skills; no direct MCP/tool calls in agents
• Skills are single-purpose task executors
• Skills encapsulate all tool access (MCP tools invoked only inside skills)
• Document consultation: file is read with the Read tool, then declared to the user
• No credentials hardcoded; env vars used via ${VAR} references
• Human-in-the-loop confirmation added for any destructive or critical operations

Validation

• make validate passes locally (0 failures, 72 pre-existing warnings)
• skill-scanner scan coreos-cve-validator — SAFE, 0 findings
• skill-scanner scan cluster-creator — SAFE, 0 findings
• skill-scanner scan-all ocp-admin/skills — 5 SAFE, 2 pre-existing CRITICAL (false-positive path traversal in cluster-inventory/cluster-report from symlinked docs/INDEX.md)

Resolves: MGMT-24450

Made with Cursor