fix(ci): resolve published upgrade baseline by digest

scripts/ci/resolve-upgrade-baseline.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env sh
+# Stdout is one immutable image reference (or empty for PR/explicit first release).
+# A published baseline is not necessarily the operator's deployed production image.
+set -eu
+previous="${PREVIOUS_IMAGE:-}"
+if [ -n "$previous" ]; then
+  printf '%s\n' "$previous" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[0-9a-f]{64}$' || { echo 'EVOFW_PREVIOUS_IMAGE must be an immutable repository@sha256 digest reference' >&2; exit 1; }
+  printf '%s\n' "$previous"
+  exit 0
+fi
+if [ "${REQUIRE_UPGRADE:-false}" != true ] || [ "${FIRST_RELEASE:-false}" = true ]; then exit 0; fi
+repository="${IMAGE_REPOSITORY:?IMAGE_REPOSITORY required for published upgrade baseline}"
+printf '%s\n' "$repository" | grep -Eq '^[a-z0-9][a-z0-9._:/-]*$' || { echo 'Invalid published image repository' >&2; exit 1; }
+echo 'Resolving the previously published latest image as upgrade baseline; set EVOFW_PREVIOUS_IMAGE to test an explicitly deployed digest instead' >&2
+if ! docker pull "$repository:latest" >&2; then
+  echo 'Cannot pull published upgrade baseline. Supply EVOFW_PREVIOUS_IMAGE, or explicitly configure the approved first-release exception; no automatic exception is applied.' >&2
+  exit 1
+fi
+digests="$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$repository:latest")"
+matches="$(printf '%s\n' "$digests" | awk -v prefix="$repository@" 'index($0,prefix)==1 {print}')"
+count="$(printf '%s\n' "$matches" | awk 'NF {n++} END {print n+0}')"
+[ "$count" = 1 ] || { echo 'Published image must have exactly one matching repository digest; refusing absent, unrelated or ambiguous RepoDigests' >&2; exit 1; }
+digest="${matches#"$repository@"}"
+printf '%s\n' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo 'Published image has an invalid repository digest' >&2; exit 1; }
+printf '%s\n' "$repository@$digest"

scripts/ci/resolve-upgrade-baseline.test.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env sh
+# No registry/network access: exercise the actual resolver with a fake Docker CLI.
+set -eu
+resolver="$(pwd)/scripts/ci/resolve-upgrade-baseline.sh"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+mkdir "$tmp/bin"
+cat >"$tmp/bin/docker" <<'DOCKER'
+#!/usr/bin/env sh
+set -eu
+printf '%s\n' "$*" >>"$FAKE_LOG"
+case "$1" in
+  pull) exit "$FAKE_PULL_EXIT" ;;
+  image) printf '%s\n' "$FAKE_DIGESTS" ;;
+  *) exit 98 ;;
+esac
+DOCKER
+chmod +x "$tmp/bin/docker"
+export PATH="$tmp/bin:$PATH" FAKE_LOG="$tmp/docker.log" FAKE_PULL_EXIT=0
+export IMAGE_REPOSITORY=git.shx.one/team/evofw REQUIRE_UPGRADE=true FIRST_RELEASE=false
+digest="sha256:$(printf '%064d' 0)"
+export FAKE_DIGESTS="$IMAGE_REPOSITORY@$digest" PREVIOUS_IMAGE="another.registry/deployed/app@$digest"
+sh "$resolver" >"$tmp/result"
+[ "$(cat "$tmp/result")" = "$PREVIOUS_IMAGE" ]
+[ ! -s "$FAKE_LOG" ] || { echo 'Explicit pinned override must not resolve latest' >&2; exit 1; }
+export PREVIOUS_IMAGE=''
+sh "$resolver" >"$tmp/result"
+[ "$(cat "$tmp/result")" = "$IMAGE_REPOSITORY@$digest" ]
+grep -F "pull $IMAGE_REPOSITORY:latest" "$FAKE_LOG" >/dev/null
+grep -F " $IMAGE_REPOSITORY:latest" "$FAKE_LOG" >/dev/null
+export FAKE_PULL_EXIT=27
+if sh "$resolver" >"$tmp/result" 2>/dev/null; then echo 'Missing published image must fail' >&2; exit 1; fi
+[ ! -s "$tmp/result" ]
+export FAKE_PULL_EXIT=0 FAKE_DIGESTS="wrong.registry/team/evofw@$digest"
+if sh "$resolver" >"$tmp/result" 2>/dev/null; then echo 'Unrelated RepoDigest must fail' >&2; exit 1; fi
+export FAKE_DIGESTS="$IMAGE_REPOSITORY@$digest
+$IMAGE_REPOSITORY@sha256:$(printf '%064d' 1)"
+if sh "$resolver" >"$tmp/result" 2>/dev/null; then echo 'Ambiguous RepoDigests must fail' >&2; exit 1; fi
+export PREVIOUS_IMAGE="$IMAGE_REPOSITORY:latest"
+if sh "$resolver" >"$tmp/result" 2>/dev/null; then echo 'Mutable override must fail rather than fall back' >&2; exit 1; fi
+export PREVIOUS_IMAGE='' REQUIRE_UPGRADE=false
+: >"$FAKE_LOG"
+sh "$resolver" >"$tmp/result"
+[ ! -s "$tmp/result" ] && [ ! -s "$FAKE_LOG" ]
+export REQUIRE_UPGRADE=true FIRST_RELEASE=true
+sh "$resolver" >"$tmp/result"
+[ ! -s "$tmp/result" ] && [ ! -s "$FAKE_LOG" ]
+echo 'Upgrade baseline resolver passed (override, latest digest, failure, wrong/ambiguous repo, PR and explicit first release)'