Repository navigation
fix(release): accept normalized PostgreSQL digest refs - #536
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 63fa64f92b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| and "@" in repo_digest | ||
| and repo_digest.rsplit("@", 1)[1] == digest |
There was a problem hiding this comment.
When either report contains a malformed entry such as @sha256:<locked digest> or not a repository@sha256:<locked digest>, this predicate accepts it because it validates only the presence of @ and the suffix. The advisory checker therefore no longer fails closed on malformed repoDigests metadata, despite this being a release-provenance gate; parse and validate the repository component while allowing only the intended Docker Hub alias normalization.
AGENTS.md reference: AGENTS.md:L79-L81
Useful? React with 👍 / 👎.
| fail(f"{report_name} image target must use a sha256 digest") | ||
| repo_digests = target.get("repoDigests") | ||
| if not isinstance(repo_digests, list) or user_input not in repo_digests: | ||
| if ( |
There was a problem hiding this comment.
The full message for commit c5361ccf5edae41e560c77807d7f27832a6861e2 has no Signed-off-by: trailer, while the root AGENTS.md requires a DCO sign-off on every commit; recreate this commit with a matching sign-off before it is merged.
AGENTS.md reference: AGENTS.md:L70-L70
Useful? React with 👍 / 👎.
Summary
@docker.ioandindex.docker.ioThis addresses the sole failure in candidate run 30363651864. Both first-party image advisory policies passed with 3 reviewed findings, 0 invalid, and 0 unreviewed. The PostgreSQL check failed before evaluating findings only because the scan target and
repoDigestsused different equivalent Docker Hub repository spellings.Verification
python3 -m unittest release.scripts.test_registry_release.RegistryReleaseTest.test_postgresql_advisory_policy_fails_closedpython3 -m unittest release.scripts.test_registry_release(92 passed)python3 release/scripts/check-gates-inventory.py(168 gates)git diff --check