fix(supply-chain): publish mirrors with digest-preserving crane copy

[williaby]

Problem

The publish job pushed the scanned docker-archive tar with crane push, which
re-serializes the image and mints a new manifest digest. For a registry
(mirror) source this breaks the approved-lock invariant source_digest == target_digest (RT-11). The first distroless-static promotion was correctly
rejected by the lock schema validator:

ERROR: [distroless-static] source_digest != target_digest
(sha256:7d14daf… vs sha256:4d52ef30…); the GHCR copy must be the exact upstream digest

7d14daf… is the verified upstream manifest (mirror-verify, --platform
linux/amd64); 4d52ef30… is the digest crane minted when re-pushing the tar.

Fix

Publish a registry source with crane copy "${SOURCE_REF}" "${TARGET}"
(digest-preserving, registry-to-registry) instead of pushing the tar. It copies
the exact @digest the scan job already pulled and scanned, so:

• the bytes are identical => RT-4 (scan-before-publish) still holds;
• target_digest now equals the verified source_digest => RT-11 invariant holds;
• cosign now signs the true upstream digest.

The oci-tar (build) path keeps crane push (no upstream registry; its
source_digest collapses to the target digest in update-lock). Adds an optional
upstream login before the copy for authenticated mirrors (dhi.io).

Rollout

Callers pin promote-core by SHA, so the container-images bake caller will be
re-pinned to this commit's SHA (bundled with the lock-YAML-indent fix) before
the next bake.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

[coderabbitai]

Warning

Review limit reached

@williaby, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 87306b86-26da-43dd-ac53-4a1fdc043d36

📥 Commits

Reviewing files that changed from the base of the PR and between c6c72c3 and e855f4e.

📒 Files selected for processing (1)

• .github/workflows/supply-chain-promote-core.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/promote-core-digest-preserving-copy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR updates the reusable supply-chain promotion workflow to preserve upstream manifest digests when publishing mirrored images to GHCR, so the approved-lock invariant source_digest == target_digest remains valid for registry sourced promotions.

Changes:

• Switch registry sourced publishing from crane push <tar> to digest-preserving crane copy "${SOURCE_REF}" "${TARGET}".
• Add an optional upstream registry login in the publish job to support authenticated upstream mirrors (for example, dhi.io).
• Keep the existing oci-tar (build) path publishing via crane push since there is no upstream registry digest to preserve.

Comments suppressed due to low confidence (1)

.github/workflows/supply-chain-promote-core.yml:367

• The step is named "Publish to GHCR and assert digest", but it only shape-checks the GHCR digest. For registry sources, this is the critical invariant the PR is addressing: the published digest should equal the digest embedded in SOURCE_REF. Adding an explicit equality check here will fail fast (before cosign/signing and before any lock update) if something regresses and a digest mismatch is reintroduced.

          TARGET_DIGEST=$(crane digest "${TARGET}" --platform "${PLATFORM}")
          if ! printf '%s' "${TARGET_DIGEST}" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
            echo "::error::GHCR digest has unexpected shape: ${TARGET_DIGEST}"; exit 1
          fi
          echo "target_ref=${TARGET}" >> "${GITHUB_OUTPUT}"