[gashcrumb]

Summary

Fixes RHDHBUGS-3635

When determining whether to skip a workspace because its last commit is an ancestor of the last published commit, verify that all expected container images for the workspace actually exist in the registry and contain valid, non-empty dynamic package metadata (io.backstage.dynamic-packages).

If any expected artifact is missing from the registry or has invalid/empty dynamic package metadata (such as from a cancelled publish or export failure), do not skip the workspace — proceed with exporting and publishing to self-heal the missing/broken artifact.

[nickboldt]

to validate this is working we should run it against the broken scorecard images?

[gashcrumb]

Great suggestion! We investigated this and tested against those images:

Background & Quay vs GHCR

1. Where the broken images were: The broken scorecard images with empty io.backstage.dynamic-packages annotations were downstream Konflux builds in Quay (quay.io/rhdh/..., from RHDHBUGS-3834), caused by an empty pipeline parameter. The upstream scorecard artifacts that export-dynamic publishes to GHCR were never broken and have always had valid annotations.
2. Image Indexes vs Manifests: Quay/Konflux builds are multi-architecture OCI image indexes (application/vnd.oci.image.index.v1+json). On an image index, the io.backstage.dynamic-packages annotation is stamped on the child platform manifests rather than the root index.

Updates in this PR

We updated the verification check (export-dynamic/verify-registry-artifacts.sh) so that when skopeo inspect --raw returns an image index / manifest list without root annotations, it resolves .manifests[0].digest and inspects the child platform manifest.

Test Results

Tested against both Quay multi-arch images and GHCR single manifests:

1. Broken Quay scorecard image (:2.0.0--1.1.1 from RHDHBUGS-3834):
   • Inspects index $\rightarrow$ resolves child manifest $\rightarrow$ catches empty annotation "" $\rightarrow$ Correctly rejected (skipWorkspace=false, workspace cannot be skipped).
2. Fixed Quay scorecard image (:2.0.0--1.1.2):
   • Inspects index $\rightarrow$ resolves child manifest $\rightarrow$ verifies valid base64 annotation $\rightarrow$ Correctly accepted.
3. Valid GHCR image (bs_1.54.9__1.4.0):
   • Single manifest with annotation $\rightarrow$ Correctly accepted.
4. Non-existent tag / missing annotation:
   • Correctly rejected.

We have also added an automated test suite (export-dynamic/verify-registry-artifacts.test.sh) covering offline mock fixtures (valid manifests, empty annotations, missing annotations, empty arrays, index dereferencing) and live registry checks, wired directly into .github/workflows/test-pack-dist-dynamic.yaml so CI validates this on every PR.

[gashcrumb]

Rebased onto main at f2f7098. The conflicts with #182 are resolved and the PR is mergeable again.

How the conflicts were resolved

• README.md — both sides appended to the same list and added a #### section. Both bullets are kept, feat(export-dynamic): reject hollow OCI payloads before push #182's section is unchanged, and this PR's section follows it.
• export-dynamic/export-dynamic.sh — only the source block conflicted; both source lines are kept. The skip-time verification block lands before the skipWorkspace decision, which is the only position that works: feat(export-dynamic): reject hollow OCI payloads before push #182's gates live inside the else branch, so placing this check after that decision would make it dead code.

Every #182 hunk is byte-identical to main; the diff against main is purely additive.

Relationship to #182 — complementary, not superseded

Worth stating explicitly now that both are in tree, since the two gates sound similar:

	#182 validate-plugin-payload.sh	this PR verify-registry-artifacts.sh
Inspects	local artifact, via containers-storage: / docker-daemon: and an oci-archive layer check	remote image, via skopeo inspect --raw docker://...
Runs	after export and package, before push	before deciding to skip, with no export or push
Answers	"is what I just built non-empty?"	"does a usable image already exist, so may this workspace be skipped?"

#182 cannot cover this PR's cases: it never contacts a registry, so it cannot see a tag that was never pushed (failed sibling run, registry GC, manual deletion), a tag-prefix bump where an ancestor check says "unchanged" but the new tags do not exist yet, or images published before #182 landed.

The one genuinely shared piece is the annotation-emptiness predicate. It is kept here deliberately — it is the only recovery path for images pushed before #182. If we would rather have a single gate, this is the piece to drop, keeping only the existence probe; say so and I will follow up.

Verification on the rebased branch

validate-plugin-payload.test.sh (17 cases) and verify-registry-artifacts.test.sh (offline plus live registry) both pass, shellcheck -x is clean on the touched scripts, and actionlint is clean on the changed workflow.

Two follow-ups this raises, not addressed here

1. The skip path duplicates the command -v skopeo guard rather than calling _require_skopeo, because it must also emit WORKSPACE_SKIPPED_UNCHANGED_SINCE=false before exiting. Worth unifying.
2. feat(export-dynamic): reject hollow OCI payloads before push #182 removed a || true that previously swallowed the non-zero exit when skopeo is missing, so that path now fails the action with an empty failed-exports. The README wording still holds, but downstream always() steps are what actually matter now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud