Guard Public ECR candidate cleanup

Author: gontzess

cmd/publish-public-ecr-release-tags/main.go

@@ -14,7 +14,10 @@ import (
 
 const defaultRegistryURI = "public.ecr.aws/conductorone"
 
-var sha256DigestPattern = regexp.MustCompile(`^(?:sha256:)?([A-Fa-f0-9]{64})$`)
+var (
+	sha256DigestPattern        = regexp.MustCompile(`^(?:sha256:)?([A-Fa-f0-9]{64})$`)
+	releaseCandidateTagPattern = regexp.MustCompile(`^release-candidate-[0-9]+-[0-9]+$`)
+)
 
 type config struct {
 	repositoryName string
@@ -265,6 +268,10 @@ func putImageTag(aws commandRunner, repositoryName, manifest, tag, digest string
 }
 
 func deleteImageTag(aws commandRunner, repositoryName, tag string) error {
+	if !releaseCandidateTagPattern.MatchString(tag) {
+		return fmt.Errorf("refusing to delete non-candidate Public ECR tag %q", tag)
+	}
+
 	args := []string{
 		"ecr-public", "batch-delete-image",
 		"--repository-name", repositoryName,

cmd/publish-public-ecr-release-tags/main_test.go

@@ -293,6 +293,38 @@ func TestPublishPublicECRTagsCandidateCleanupIsBestEffort(t *testing.T) {
 	}
 }
 
+func TestPublishPublicECRTagsRefusesUnsafeCandidateCleanup(t *testing.T) {
+	digestFile := writeDigestFile(t, fmt.Sprintf("%s  public.ecr.aws/conductorone/bridge-client:temporary\n", digestA))
+	fake := &fakeAWS{
+		describeResults: []describeResult{
+			{notFound: true},
+			{digest: digestA},
+		},
+	}
+	cfg := config{
+		repositoryName: "bridge-client",
+		versionTag:     "1.2.3",
+		candidateTag:   "temporary",
+		digestFile:     digestFile,
+		registryURI:    defaultRegistryURI,
+	}
+	var stdout, stderr bytes.Buffer
+
+	err := publish(cfg, fake, &fakeDocker{}, &stdout, &stderr)
+	if err != nil {
+		t.Fatalf("publish: %v", err)
+	}
+	if fake.calledCommand("batch-delete-image") {
+		t.Fatal("unsafe candidate tag must not be sent to BatchDeleteImage")
+	}
+	if !strings.Contains(stderr.String(), `refusing to delete non-candidate Public ECR tag "temporary"`) {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "Published public.ecr.aws/conductorone/bridge-client:1.2.3") {
+		t.Fatalf("stdout = %q", stdout.String())
+	}
+}
+
 func runPublishForTest(t *testing.T, digestFile string, fake *fakeAWS) (string, string, error) {
 	t.Helper()
 	return runPublishForTestWithDocker(t, digestFile, fake, &fakeDocker{})