mindersec / minder / 43513446151

68%

push

github

fix(artifact): scope DockerHub/Quay ingestion to the entity's own tag (#7131)

* Scope OCI artifact ingestion to the entity's tag

A DockerHub/Quay artifact entity is a single repo:tag, but the artifact
ingester listed and evaluated every tag in the repository, repeating
that work for each registered tag. It now evaluates only the version
the entity's own tag points to, resolving its digest and creation time
from the registry at evaluation time, and records that digest on the
checkpoint.

A tag that doesn't match the rule's tags or tag_regex now skips the
rule silently. Other filter rejections, such as an image older than
the retention period, still fail the evaluation. GHCR packages and
entities still carrying a pre-repo:tag "repo@digest" identity keep the
repository-wide path. The public artifact API output is unchanged.

Known limitation: a rule listing several tags (tags: [a, b]) no longer
matches DockerHub/Quay entities, since each carries one tag; tag_regex
covers that case. Cross-tag lookup is left out of scope.

Fixes #7089

* Address review feedback on tag-scoped ingestion

Move repo:tag detection into the provider. OCITagVersionProvider gains
ArtifactTag, implemented next to NewArtifactProperties so the upstream
ID format and its parser live in one place. A round-trip test catches
format drift instead of ingestion silently falling back to the
repository-wide path.

Add ErrArtifactTagNotFound to pkg/providers/v1 and return it (wrapped)
from GetArtifactVersion for a deleted tag, so the ingester checks it
with errors.Is and no longer imports the oci provider package. The
exported IsNotFound helper is removed.

Log at info level when a multi-tag rule (tags: [a, b]) skips a
single-tag entity, pointing to tag_regex, so the lost coverage is
discoverable. It remains a silent skip.

Document why a deleted tag fails every evaluation rather than being
skipped, with #7090 as the follow-up. Drop the stale tags param and
TODO(#7089) from the registration ... (continued)

110 of 126 new or added lines in 4 files covered. (87.3%)

24269 of 35977 relevant lines covered (67.46%)

59.45 hits per line