Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@kubernetes/controller/internal/cel/functions/oci.go`:
- Around line 53-68: The unsupported-input error in BindingToOCI incorrectly
states only 'imageReference' is accepted; update the error message in
BindingToOCI (and/or where it returns types.NewErr) to list all supported input
forms: 'imageReference', 'globalAccess.imageReference', and 'referenceName' so
callers get accurate diagnostics; locate the error return in BindingToOCI (and
the extractImageReference error path if it returns similar messages) and replace
the message text to mention all three accepted keys.

---

Nitpick comments:
In `@kubernetes/controller/internal/cel/functions/oci_test.go`:
- Around line 149-158: The CEL subtest should defensively handle both error
paths: first check the returned err from prog.ContextEval and assert/handle it
when non-nil, and only when err is nil inspect val for a CEL types.Err; update
the logic around prog.ContextEval(...) to assert on err (r.NoError/require.Error
as appropriate) before assuming val is a *types.Err, and when validating
expected errors (tc.err) support both checking err and checking val.(*types.Err)
(types.Err) so BindingToOCI test cases that surface via the err return are
handled.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@kubernetes/controller/internal/cel/functions/oci.go`:
- Around line 149-159: The code currently ignores a non-object globalAccess
(when m["globalAccess"] exists but is not a map[string]any) and falls through,
which can hide malformed input; update the globalAccess handling in the function
that inspects m (the block referencing variables ga, gaMap and the
"imageReference" key) to explicitly detect when ga exists but is not an object
and return a clear error (e.g., "expected 'globalAccess' to be an object, got
%T") instead of falling back to referenceName or the generic missing-key error;
keep the existing check that validates that globalAccess.imageReference is a
string (imgRefStr) and return it when valid.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/runtime/registry.go`:
- Around line 407-439: convertFromRaw and convertFromUnstructured are
unmarshalling into any concrete into value without verifying that the decode
target matches the source fromType (allowing mismatched types like converting
unstructured<TestType/v1> into &TestType2{}); add the same guard used in
convertFromTyped to reject targets whose concrete type does not correspond to
fromType before unmarshalling. Concretely, in convertFromRaw(from *Raw, into
Typed, fromType Type) and convertFromUnstructured(from *Unstructured, into
Typed, fromType Type) call the existing type-matching check (the logic used by
convertFromTyped) to ensure the concrete target type of into matches fromType
and return an error if not, then proceed with json.Unmarshal only when the types
match; also add tests in bindings/go/runtime/registry_convert_test.go covering
Convert(unstructured<...>, &OtherType{}) rejection.

In `@kubernetes/controller/internal/cel/functions/oci.go`:
- Around line 67-73: The code regressed by relying solely on Scheme.Convert()
and now rejects plain typeless maps; update extractImageReference to detect
untyped maps (e.g., map[string]any or map[interface{}]any) and perform a direct
key-based lookup for "imageReference", "globalAccess", or "referenceName" (if
found, use the value or recursively call extractImageReference for nested maps)
before returning the type error, and apply the same fallback behavior where the
same logic appears (lines with similar switch handling around
extractImageReference); add a regression test in
kubernetes/controller/internal/cel/functions/oci_test.go that passes plain maps
like map[string]any{"imageReference":"registry.io/app:v1"} and nested
map[string]any{"globalAccess":
map[string]any{"imageReference":"registry.io/app:v1"}} to assert correct
extraction.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/runtime/registry.go`:
- Around line 428-440: The convertFromUnstructured function currently marshals
Unstructured.Data and unmarshals into the target, which loses payload when the
target is *Raw (because Raw.Data has json:"-"); update convertFromUnstructured
to detect when into is a *Raw (use the Raw type check used in
convertFromRaw/convertFromTyped), and in that branch set Raw.Type (from
fromType) and assign Raw.Data to the raw marshaled JSON bytes (rather than going
through json.Unmarshal). Preserve existing error handling for the marshal step
and return early after populating the Raw struct.

In `@kubernetes/controller/internal/cel/functions/oci_test.go`:
- Around line 401-409: The failing test case "Helm access has no imageReference
and returns error" references a non-existent helmspec package; either import the
correct package that defines helmspec.Helm or replace the typed helmspec usage
with an equivalent plain map (e.g., use typedToMap(t, map[string]any{ "Type":
runtime.NewVersionedType("Helm","v1"),
"HelmRepository":"oci://ghcr.io/org/charts", "HelmChart":"my-chart:1.0.0" }))
and remove the helmspec import; update the test case in the oci_test.go block
and ensure typedToMap and the test's err: require.Error remain unchanged.

---

Nitpick comments:
In `@kubernetes/controller/internal/cel/functions/oci_test.go`:
- Around line 269-313: Add a new table-driven test case in the tests slice (the
same place other cases call functions.BindingToOCI and then run the "cel"
subtest) that uses a typeless map input (e.g.,
map[string]any{"imageReference":"registry.io/myrepo/myapp:v1"}) and asserts the
call returns an error; reference the existing test harness around BindingToOCI,
functions.ToOCI and functions.ToOCIFunctionName so the new case exercises both
the direct BindingToOCI path and the cel evaluation path and expects an error
(use the same tc.err require.Error check pattern used by other cases).

In `@kubernetes/controller/internal/cel/functions/oci.go`:
- Around line 67-73: The error text in the default branch is misleading because
extractImageReference uses Scheme.Convert (which requires a type field) rather
than key-based lookup; either update the returned error from the default case to
explain that a typed map (with a "type" field) or a string is required, or
implement a typeless-map fallback inside the same switch: if lhs.Value() is a
map[string]interface{} check for keys "imageReference", "globalAccess", or
"referenceName" and call extractImageReference with the constructed typed value
before returning types.NewErr; reference the extractImageReference function and
the default switch branch when making the change.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@kubernetes/controller/internal/cel/functions/oci.go`:
- Line 182: The error message in the OCI map-check (when returning
fmt.Errorf("expected map with key 'imageReference',
'globalAccess.imageReference', or 'referenceName', got %v", m)) exposes the
entire map m; change it to only include the map's keys to avoid
verbose/sensitive logging. Locate the return in
kubernetes/controller/internal/cel/functions/oci.go where variable m is
validated, extract the keys from m (e.g., iterate m to build a []string of keys
or use a helper keysFromMap(m)), and format the error as something like
"expected map with key 'imageReference', 'globalAccess.imageReference', or
'referenceName'; available keys: [a,b,c]" so only the keys are logged instead of
the full map contents.