stacklok / toolhive / 24771261351

66%

Build Type

push

github

Committed by web-flow

Commit Message

Mark local skill builds with an OCI descriptor annotation (#5000)

* Add local-build descriptor annotation for skills OCI store

Introduce a `dev.stacklok.toolhive.local-build` annotation that marks
tags in the shared local OCI store as produced by a local `Build`
rather than by an OCI pull. The marker lives on the descriptor entry
in `index.json`, not inside the manifest blob, so the artifact digest
is unchanged and nothing crosses the wire on push: oras-go resolves
the push reference by digest, which returns a plain descriptor and
strips descriptor annotations.

Adds `tagAsLocalBuild` (Tag + annotation) and `isLocalBuild` helpers.
Self-contained — no callers yet. Subsequent commits wire it into the
skill service so `ListBuilds` can filter out artifacts pulled into
the store by install or the content API only for caching.

Made-with: Cursor

* Hide pulled skill artifacts from local builds listing

Skills pulled into the shared OCI store by install or the content
API were tagged for caching and then surfaced by `ListBuilds`,
making every previewed or installed remote skill look like a local
build.

Wire the local-build descriptor annotation into the skill service:

- `Build` calls `tagAsLocalBuild` instead of `ociStore.Tag`, stamping
  the marker on the root-index descriptor entry in a single step.
- `ListBuilds` iterates `ociStore.ListTags` and filters by
  `isLocalBuild` before running the usual metadata enrichment, so
  pulled tags are skipped.
- `DeleteBuild` needs no change: removing the tag also drops its
  descriptor entry (and its annotation) from `index.json`.

OCI pulls (install and content) continue to tag the local store as
a cache, but `Registry.Pull` tags by digest — which resolves to a
plain descriptor in oras-go — so no annotation lands on the tag and
the cached artifact stays invisible to `ListBuilds`. Intent-documenting
comments at each pull site explain why the marker is deliberately
skipped there.

Made-with: Cursor

* Assert OCI p... (continued)

Coverage Stats

33 of 42 new or added lines in 4 files covered. (78.57%)

44 existing lines in 5 files now uncovered.

58605 of 88503 relevant lines covered (66.22%)

61.56 hits per line