add dry-run flag for sync --products

[amartin120]

Please check below, if the PR fulfills these requirements:

• Commit(s) and code follow the repositories guidelines.
• Test(s) have been added or updated to support these change(s).
• Doc(s) have been added or updated to support these change(s).

Associated Links:

• [feature] Template option for displaying manifest before sync #307

Types of Changes:

• Feature

Proposed Changes:

• Add --dry-run flag to hauler store sync --products

Summary

• Adds a --dry-run flag that outputs the product manifest YAML to stdout instead of syncing all referenced artifacts, allowing users to inspect manifest contents before committing to a full sync
• Fetches the manifest directly from the remote registry and streams it to stdout with zero local side effects — no store writes, no files extracted to disk
• Validates that --dry-run is only used with --products and suppresses log output so stdout contains only the manifest YAML, enabling clean piping (e.g., > manifest.yaml)

Usage

• Inspect a product manifest before syncing
  hauler store sync --products rancher=v2.10.1 --dry-run

• Save to a file for review or customization
  hauler store sync --products rancher=v2.10.1 --dry-run > rancher-manifest.yaml

• Multiple products
  hauler store sync --products rancher=v2.10.1,rke2=v1.31.5+rke2r1 --dry-run

Verification/Testing of Changes:

• --dry-run with valid product prints manifest YAML to stdout
• --dry-run without --products returns a clear error
• --dry-run does not write to the OCI store or extract files to disk
• Without --dry-run, existing sync behavior is unchanged
• make fmt, make vet, make test all pass

Additional Context:

[Copilot]

Pull request overview

Adds a --dry-run mode for hauler store sync --products to fetch the product manifest from the product registry and emit its contents to stdout instead of syncing referenced artifacts.

Changes:

• Introduces --dry-run flag on store sync and wires it into sync options.
• Implements a dry-run execution path that fetches the product manifest image remotely and streams manifest content to stdout.
• Adds CLI validation/log suppression for dry-run and a new dry-run-focused unit test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
internal/flags/sync.go	Adds DryRun to SyncOpts and registers the --dry-run flag.
cmd/hauler/cli/store/sync.go	Implements dry-run behavior for --products by fetching and printing the manifest content.
cmd/hauler/cli/store/sync_test.go	Adds a test verifying dry-run prints manifest YAML and does not write to the store.
cmd/hauler/cli/store.go	Validates --dry-run requires --products and suppresses logging during dry-run.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zackbradys]

old behavior...

zackbradys@Zacks-MacBook-Pro hauler % ./dist/hauler_darwin_arm64_v8.0/hauler store sync --products kubewarden=kubewarden-controller-5.11.1         
2026-04-09 02:09:11 WRN !!! WARNING !!! [--products] will be updating its default registry in a future release.
2026-04-09 02:09:11 INF processing product manifest for [kubewarden=kubewarden-controller-5.11.1] to store [/Users/zackbradys/Documents/Coding/GitHub/hauler/store]
2026-04-09 02:09:11 INF fetching product manifest from [rgcrprod.azurecr.us/hauler/kubewarden-manifest.yaml:kubewarden-controller-5.11.1]
2026-04-09 02:09:11 INF adding image [rgcrprod.azurecr.us/hauler/kubewarden-manifest.yaml:kubewarden-controller-5.11.1] to the store
ççç2026-04-09 02:09:14 INF successfully added image [rgcrprod.azurecr.us/hauler/kubewarden-manifest.yaml:kubewarden-controller-5.11.1]
zackbradys@Zacks-MacBook-Pro hauler % 
zackbradys@Zacks-MacBook-Pro hauler % 
zackbradys@Zacks-MacBook-Pro hauler % hauler store ls
+----------------------------------------------------------------------------------+-------+-------------+----------+---------+
| REFERENCE                                                                        | TYPE  | PLATFORM    | # LAYERS | SIZE    |
+----------------------------------------------------------------------------------+-------+-------------+----------+---------+
| rgcrprod.azurecr.us/hauler/kubewarden-manifest.yaml:kubewarden-controller-5.11.1 | image | -           |        1 | 975 B   |
| rgcrprod.azurecr.us/kubewarden/audit-scanner:v1.33.1                             | image | -           |        1 | 289 B   |
|                                                                                  | image | linux/amd64 |        3 | 31.9 MB |
|                                                                                  | image | linux/arm64 |        3 | 29.2 MB |
+----------------------------------------------------------------------------------+-------+-------------+----------+---------+
|                                                                                                           TOTAL   | 61.0 MB |
+----------------------------------------------------------------------------------+-------+-------------+----------+---------+
zackbradys@Zacks-MacBook-Pro hauler %
zackbradys@Zacks-MacBook-Pro hauler % 
zackbradys@Zacks-MacBook-Pro hauler %  hauler store extract rgcrprod.azurecr.us/hauler/kubewarden-manifest.yaml:kubewarden-controller-5.11.1
2026-04-09 02:09:36 INF extracted [application/vnd.oci.image.manifest.v1+json] from store with digest [sha256:62a3d79e937ad57db4f6abae59b7232050181d6ab50956b9ce0ed357b5a32d51]
zackbradys@Zacks-MacBook-Pro hauler %
zackbradys@Zacks-MacBook-Pro hauler % 
zackbradys@Zacks-MacBook-Pro hauler %  cat kubewarden-manifest.yaml 
apiVersion: content.hauler.cattle.io/v1
kind: Images
metadata:
  name: carbide-kubewarden-images
spec:
  images:
    - name: rgcrprod.azurecr.us/kubewarden/audit-scanner:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/kubewarden-controller:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/policy-server:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/policies/allow-privilege-escalation-psp:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/capabilities-psp:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/host-namespaces-psp:v1.1.8
    - name: rgcrprod.azurecr.us/kubewarden/policies/hostpaths-psp:v1.1.7
    - name: rgcrprod.azurecr.us/kubewarden/policies/pod-privileged:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/user-group-psp:v1.1.5
    - name: rgcrprod.azurecr.us/kyverno/policy-reporter-ui:2.5.1
    - name: rgcrprod.azurecr.us/kyverno/policy-reporter:3.7.3
    - name: rgcrprod.azurecr.us/rancher/kuberlr-kubectl:v8.0.0

new behavior...

zackbradys@Zacks-MacBook-Pro hauler % ./dist/hauler_darwin_arm64_v8.0/hauler store sync --products kubewarden=kubewarden-controller-5.11.1 --dry-run
---
apiVersion: content.hauler.cattle.io/v1
kind: Images
metadata:
  name: carbide-kubewarden-images
spec:
  images:
    - name: rgcrprod.azurecr.us/kubewarden/audit-scanner:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/kubewarden-controller:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/policy-server:v1.33.1
    - name: rgcrprod.azurecr.us/kubewarden/policies/allow-privilege-escalation-psp:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/capabilities-psp:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/host-namespaces-psp:v1.1.8
    - name: rgcrprod.azurecr.us/kubewarden/policies/hostpaths-psp:v1.1.7
    - name: rgcrprod.azurecr.us/kubewarden/policies/pod-privileged:v1.0.10
    - name: rgcrprod.azurecr.us/kubewarden/policies/user-group-psp:v1.1.5
    - name: rgcrprod.azurecr.us/kyverno/policy-reporter-ui:2.5.1
    - name: rgcrprod.azurecr.us/kyverno/policy-reporter:3.7.3
    - name: rgcrprod.azurecr.us/rancher/kuberlr-kubectl:v8.0.0

[zackbradys]

/cherrypick-2.0

[github-actions]

✅ Backport PR created: #562