fix(images): hide unpublished Utah testing image commands and attestations - #1113
Open
castrojo wants to merge 1 commit into
Open
fix(images): hide unpublished Utah testing image commands and attestations#1113castrojo wants to merge 1 commit into
castrojo wants to merge 1 commit into
Conversation
…tions Utah's product spec only has a single 'testing' stream tag. When the ghcr.io/projectbluefin/utah:testing tag has never been pushed, the registry tag list is empty, but buildTopStreams' fallback path still fabricated a bootc switch command for it, and buildSecurityInfo still rendered cosign verify/verify-attestation commands with hasAttestation: true — even though skopeo inspect reports 'manifest unknown' for that tag. Add isImagePublished(spec, tagSet) to check whether any of a product's streamOrder tags actually exist in the registry before building switch commands or security/attestation commands. When a product's primary tag isn't published yet, streams/testingStreams are left empty and security is cleared, and the images.json product gains an explicit imagePublished: false flag. ImagesCatalog.tsx now renders an 'awaiting initial release' message in both the Streams and Signing/SBOM sections instead of empty tag lists or unpublished commands when imagePublished is false. Regenerated the Utah entry in static/data/images.json to reflect the new awaiting-initial-release state until the next scheduled fetch job runs. Fixes projectbluefin#1081 Signed-off-by: castrojo <castrojo@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
docs/utah.mdxand the generated image catalog (static/data/images.json) publishedbootc switchand cosign verify/attestation commands forghcr.io/projectbluefin/utah:testing, even though that tag has never been pushed (skopeo inspect docker://ghcr.io/projectbluefin/utah:testingreturnsmanifest unknown).Root cause:
buildTopStreams' fallback path inscripts/fetch-github-images.jsfabricated a switch command for the firststreamOrderentry whenever none of the registry's tags matched, even if the registry had no tags at all.buildSecurityInfohad no way to know a tag was unpublished, so it always rendered live verify/attest commands based on repo signing config alone.Fix
isImagePublished(spec, tagSet)to check whether any of a product'sstreamOrdertags actually exist in the registry before building switch/security commands.buildProduct, when a product's primary tag isn't published,streams/testingStreamsstay empty andsecurityis cleared (hasAttestation: false, no commands). The product output now carries an explicitimagePublished: falseflag.ImagesCatalog.tsxnow renders an "awaiting initial release" message in the Streams and Signing/SBOM sections instead of an empty tag list or unpublished commands whenimagePublishedisfalse.static/data/images.jsonto reflect the new state immediately (rather than waiting for the next scheduled fetch job).Testing
npm run test(486 tests, all passing)npm run typecheck(no new errors; pre-existing unrelated error inMusicPlaylist.tsxfrom an untracked generated data file)npx eslinton changed files (no new warnings/errors)npx prettier --checkon changed filesFixes #1081
— hive: backend=copilot model=claude-sonnet-5
🐝 Hive Agent:
contributor| SHA:89ef75a1