[deckhouse-cli] Fix --include-module ignoring semver constraints

internal/mirror/cmd/pull/pull.go

@@ -98,6 +98,7 @@ func NewCommand() *cobra.Command {
 	}
 
 	pullflags.AddFlags(pullCmd.Flags())
+	pullCmd.MarkFlagsMutuallyExclusive("include-module", "exclude-module")
 	pullflags.ParseEnvironmentVariables()
 
 	return pullCmd
@@ -375,14 +376,18 @@ func (p *Puller) validateModulesAccess() error {
 
 // createModuleFilter creates the appropriate module filter based on whitelist/blacklist
 func (p *Puller) createModuleFilter() (*modules.Filter, error) {
-	filterExpressions := pullflags.ModulesBlacklist
-	filterType := modules.FilterTypeBlacklist
+	// Flags are mutually exclusive:
+	// - --include-module: whitelist mode (mirror only listed modules);
+	// - otherwise: blacklist mode via --exclude-module (skip listed modules).
 	if pullflags.ModulesWhitelist != nil {
-		filterExpressions = pullflags.ModulesWhitelist
-		filterType = modules.FilterTypeWhitelist
+		filter, err := modules.NewFilter(pullflags.ModulesWhitelist, modules.FilterTypeWhitelist)
+		if err != nil {
+			return nil, fmt.Errorf("Prepare module filter: %w", err)
+		}
+		return filter, nil
 	}
 
-	filter, err := modules.NewFilter(filterExpressions, filterType)
+	filter, err := modules.NewFilter(pullflags.ModulesBlacklist, modules.FilterTypeBlacklist)
 	if err != nil {
 		return nil, fmt.Errorf("Prepare module filter: %w", err)
 	}

internal/mirror/cmd/pull/pull_test.go

@@ -54,6 +54,18 @@ func TestNewCommand(t *testing.T) {
 	assert.NotNil(t, cmd.Flags())
 }
 
+func TestNewCommandMutuallyExclusiveModuleFlags(t *testing.T) {
+	cmd := NewCommand()
+	cmd.PreRunE = nil
+	cmd.RunE = func(_ *cobra.Command, _ []string) error { return nil }
+	cmd.SetArgs([]string{"--include-module", "module-a", "--exclude-module", "module-b", "bundle-path"})
+
+	err := cmd.Execute()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "include-module")
+	assert.Contains(t, err.Error(), "exclude-module")
+}
+
 func TestSetupLogger(t *testing.T) {
 	tests := []struct {
 		name        string

internal/mirror/modules/filter.go

@@ -123,7 +123,7 @@ func parseVersionConstraint(v string) (VersionConstraint, error) {
 }
 
 func parseExact(body string) (VersionConstraint, error) {
-	// exac match, console@=1.38.1 = registry.deckhouse.io/deckhouse/ce/modules/console:v1.38.1
+	// exact match, console@=v1.38.1 -> registry.deckhouse.io/deckhouse/ce/modules/console:v1.38.1
 	tag, ch, _ := strings.Cut(body, "+")
 	if tag == "" {
 		return nil, fmt.Errorf("empty tag in %q", body)
@@ -146,33 +146,37 @@ func parseSemver(v string) (VersionConstraint, error) {
 }
 
 func (f *Filter) ShouldMirrorReleaseChannels(moduleName string) bool {
-	if c, ok := f.modules[moduleName]; ok && c.IsExact() {
+	constraint, hasConstraint := f.modules[moduleName]
+	if hasConstraint && constraint.IsExact() {
 		return false
 	}
 	return true
 }
 
+// VersionsToMirror resolves module constraints from --include-module into concrete tags to pull.
+// Returns nil when no explicit version tags should be added for this module.
 func (f *Filter) VersionsToMirror(mod *Module) []string {
-	c, ok := f.modules[mod.Name]
-	if !ok {
+	constraint, hasConstraint := f.modules[mod.Name]
+	if !hasConstraint {
 		return nil
 	}
 
-	if c.IsExact() {
-		if e, ok := c.(*ExactTagConstraint); ok {
-			return []string{e.Tag()}
+	if constraint.IsExact() {
+		exact, isExactTag := constraint.(*ExactTagConstraint)
+		if !isExactTag {
+			return nil
 		}
-		return nil
+		return []string{exact.Tag()}
 	}
 
-	sc, ok := c.(*SemanticVersionConstraint)
-	if !ok {
+	semver, isSemver := constraint.(*SemanticVersionConstraint)
+	if !isSemver {
 		return nil
 	}
 
 	var tags []string
 	for _, v := range mod.Versions() {
-		if sc.Match(v) {
+		if semver.Match(v) {
 			tags = append(tags, "v"+v.String())
 		}
 	}