internal/exec/stages/disks: guard against nil tang Thumbprint deref

[vishnu2ko5]

What this PR does / why we need it:
This PR fixes a runtime panic caused by an unchecked nil pointer dereference on tang.Thumbprint when processing LUKS clevis configurations.

While the config validator enforces that Thumbprint must be present (ErrTangThumbprintRequired), this validation only runs for user-specified configs. Programmatically generated configs, configs merged dynamically, or system base configs can bypass this strict validation. If Thumbprint evaluates to nil, it previously caused a hard panic. This PR introduces a safe check, defaulting to an empty string to allow execution to proceed gracefully or fail appropriately downstream without crashing the provisioner.

Fixes:
(Add the related issue number here if you opened an issue for this, e.g., Fixes #XYZ)

Special notes for your reviewer:

• Verified that when tang.Thumbprint is nil, the value safely defaults to an empty string and the clevis configuration successfully marshals to JSON instead of triggering a panic.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e0f41bb-9dc8-4f2a-9620-afd7cc19b29e

📥 Commits

Reviewing files that changed from the base of the PR and between 5300eed and b51850d.

📒 Files selected for processing (1)

• internal/exec/stages/disks/luks.go

Included review availability: Your plan includes up to 4 reviews per rolling hour; 2 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

**/*.go

📄 CodeRabbit inference engine (AGENTS.md)

**/*.go: Include the required Apache 2.0 license header at the top of every Go source file.
Use the project's import ordering in Go files: standard library imports, blank line, project packages, blank line, then external dependencies.
Follow the project's Go naming conventions: exported identifiers use PascalCase, unexported identifiers use camelCase, and filenames use snake_case.

Files:

• internal/exec/stages/disks/luks.go

internal/exec/stages/{fetch-offline,fetch,disks,mount,files,umount}/**

📄 CodeRabbit inference engine (AGENTS.md)

Treat the execution stage order as fixed (fetch-offline, fetch, disks, mount, files, umount) because external projects hardcode this list.

Files:

• internal/exec/stages/disks/luks.go

internal/exec/stages/**

⚙️ CodeRabbit configuration file

internal/exec/stages/**: Execution stages are fixed (fetch-offline, fetch, disks, mount, files, umount). External projects hardcode this list. Do not add or remove stages. Config must be declarative -- describe desired state, not actions.

Files:

• internal/exec/stages/disks/luks.go

🔇 Additional comments (1)

internal/exec/stages/disks/luks.go (1)

332-338: LGTM!

---

📝 Walkthrough

Walkthrough

Tang configuration generation now handles absent thumbprints without dereferencing a nil pointer. Present thumbprints remain unchanged.

Changes

Tang thumbprint handling

Layer / File(s)	Summary
Tang configuration generation internal/exec/stages/disks/luks.go	The configuration uses an empty string when tang.Thumbprint is absent. Present thumbprints continue to be copied.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to b5185

This localized change prevents a nil Thumbprint from causing a runtime panic during LUKS configuration processing; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes the change and uses imperative mood, but it contains uppercase terms after the colon.	Change the description to lowercase after the colon, for example: "internal/exec/stages/disks: guard against nil tang thumbprint dereference".

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the nil pointer dereference, the cause, and the safe default behavior introduced by the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Commit Message Convention	✅ Passed	The PR range contains one non-merge commit. Its subject is internal/exec/stages/disks: guard against nil tang Thumbprint deref, with a valid lowercase imperative description and no period.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}