fix: avoid append aliasing of caller-owned component slices

[ronlv10]

What does this PR do?

Fixes an append-aliasing footgun in two spots that assemble a combined "children + root" component list:

• pkg/resource/component_factory.go (NewComponentFactory)
• pkg/api/runai/v1alpha1/validation.go (KartaValidator.initialize)

Both did:

allDefinitions := append(karta.Spec.StructureDefinition.ChildComponents, karta.Spec.StructureDefinition.RootComponent)

append(s, x) reuses s's backing array whenever cap(s) > len(s). ChildComponents is owned by the caller's Karta, so when that slice has spare capacity the append writes RootComponent into caller-owned memory instead of allocating fresh. A freshly unmarshalled Karta (JSON/YAML decoders over-allocate slice capacity) can hit this; a DeepCopy (make([]T, len(...))) cannot.

The fix allocates a dedicated slice sized len(ChildComponents)+1 and copies into it, so the caller's slice is never touched. Iteration contents are unchanged.

Related issue(s)

N/A

Checklist

• All commits are signed off with DCO (git commit -s)
• New/modified files have SPDX license and copyright headers
• Documentation updated (if applicable) - N/A
• Tests pass (make check)
• No proprietary or internal information included

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of component lists to avoid unintended sharing of internal slice data.
  • Made validator and component setup more reliable when combining child components with the root component.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: ad1c3fa4-210d-4afe-919e-9dffc651d560

📥 Commits

Reviewing files that changed from the base of the PR and between f1b55be and f6b1524.

📒 Files selected for processing (2)

• pkg/api/runai/v1alpha1/validation.go
• pkg/resource/component_factory.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/resource/component_factory.go
• pkg/api/runai/v1alpha1/validation.go

---

Walkthrough

In two places, the code now preallocates a fresh local slice before appending child components and the root component, instead of appending the root directly onto the existing child slice.

Changes

Slice aliasing fix

Layer / File(s)	Summary
Fresh slice allocation for component iteration pkg/api/runai/v1alpha1/validation.go, pkg/resource/component_factory.go	Both paths now create a new slice with capacity for children plus root, append children first, and then append the root.

Estimated code review effort: 2 (Simple) | ~5 minutes

Poem

🐇 I hopped through slices, neat and new,
I stacked the children, then root came through.
No borrowed arrays, no tangled seams—
Just tidy appends and happier dreams.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main fix: preventing append aliasing of caller-owned component slices.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/append-aliasing-component-slices

---

_{Comment @coderabbitai help to get the list of available commands.}