refactor: extract OCI artifact contract into shared spec

[bennyz]

Summary

• Define media types, annotation keys, and referrer types in a single JSON contract file (internal/common/oci/spec.json) consumed by Go via //go:embed and by shell scripts via exported variables
• External tools (like AIB) can consume spec.json directly to produce compatible OCI artifacts
• Contract enforcement test fails if anyone hardcodes OCI strings in Tekton task scripts

Replaces #295 (accidentally closed).

Assisted-by: claude-opus-4.6

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• New Features

  • Introduced centralized OCI artifact specification configuration, replacing hardcoded annotation keys and media types with configurable environment-driven values throughout artifact building, pushing, and inspection workflows.

• Tests

  • Added comprehensive test coverage for OCI specification handling and contract validation to ensure consistency across scripts.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fd18a675-9129-4d09-80ff-de2955fcaaf9

📥 Commits

Reviewing files that changed from the base of the PR and between 1b04735 and a1d0810.

📒 Files selected for processing (11)

• cmd/caib/common/oci_artifact.go
• cmd/caib/inspectcmd/inspect.go
• cmd/caib/inspectcmd/inspect_test.go
• internal/common/oci/spec.go
• internal/common/oci/spec.json
• internal/common/oci/spec_test.go
• internal/common/tasks/oci_contract_test.go
• internal/common/tasks/scripts.go
• internal/common/tasks/scripts/build_image.sh
• internal/common/tasks/scripts/push_artifact.sh
• internal/common/tasks/scripts/sealed_operation.sh

---

📝 Walkthrough

Walkthrough

This PR centralizes OCI artifact specification—annotation keys, media types, and referrer types—behind a new internal/common/oci/spec.go package, replacing hardcoded values scattered across shell scripts and Go commands with dynamically loaded configuration and generated shell variables.

Changes

OCI Specification Centralization

Layer / File(s)	Summary
OCI Spec Infrastructure internal/common/oci/spec.go, internal/common/oci/spec.json, internal/common/oci/spec_test.go	New spec package loads OCI annotation prefixes, annotation keys, media types, and referrer artifact metadata from embedded spec.json. Exported Get() and methods (AnnotationKey, ReferrerFileMap, AllManifestAnnotationKeys, ReferrerArtifactTypeByLabel, ShellVars) provide centralized access; ShellVars() generates deterministic shell export statements for all OCI constants. Tests validate spec parsing, key composition, file mappings, and shell variable determinism.
Script Integration and Contract internal/common/tasks/scripts.go, internal/common/tasks/oci_contract_test.go	scripts.go imports OCI spec and injects oci.Get().ShellVars() into embedded task scripts during init(). Contract test validates that no hardcoded OCI media types or annotation key patterns remain in the final scripts after stripping the generated block.
Shell Script OCI Constants internal/common/tasks/scripts/build_image.sh, internal/common/tasks/scripts/push_artifact.sh, internal/common/tasks/scripts/sealed_operation.sh	Replace hardcoded media types (e.g., application/vnd.automotive.sources.v1+tar+gzip), annotation keys (e.g., automotive.sdv.cloud.redhat.com/builder-image), and referrer types with generated environment variables (OCI_REFERRER_TYPE_*, OCI_MEDIA_*, OCI_ANN_*, OCI_LAYER_ANN_*). Embedded Python in push_artifact.sh refactored to build annotation objects from environment keys rather than literal label strings.
Go Command Spec Adoption cmd/caib/common/oci_artifact.go, cmd/caib/inspectcmd/inspect.go, cmd/caib/inspectcmd/inspect_test.go	Refactor commands to use oci.Get() helpers (AnnotationKey, AllManifestAnnotationKeys, ReferrerFileMap, ReferrerArtifactTypeByLabel) instead of local hardcoded annotation prefixes, known annotation lists, referrer type lists, and file maps. Tests updated to construct annotation keys using ociSpec.AnnotationPrefix for consistency.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• centos-automotive-suite/automotive-dev-operator#116: Adds builder-image annotations using hardcoded keys; this PR refactors those keys to be derived from the shared OCI spec.
• centos-automotive-suite/automotive-dev-operator#123: Modifies embedded script concatenation in scripts.go's init(); directly related to the OCI shell variable injection added here.
• centos-automotive-suite/automotive-dev-operator#197: Modifies OCI artifact pushing and attestation in push_artifact.sh, overlapping with the referrer type and annotation constant refactoring.

Suggested reviewers

• bkhizgiy

Poem

🐰 Specs in JSON, helpers so clean,
Shell vars injected, no hardcodes seen,
One source of truth for types and keys,
Build and push now dance with ease! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}