feat(oci)!: make GlobalAccessPolicy optional and toggleable by jakobmoellerdev · Pull Request #2275 · open-component-model/open-component-model

jakobmoellerdev · 2026-04-13T15:42:21Z

Summary

Add GlobalAccessPolicy to RepositoryOptions with two modes: Never (disabled) and Auto (force global access on all local blobs if the repo supports it)
Wire through OCI repository spec (globalAccessPolicy JSON field) and provider
Fix bug: ResourceLocalBlobOCILayout was ignoring EnforceGlobalAccess (unlike ResourceLocalBlobOCILayer)
Remove GlobalAccessPolicy from CTF spec — CTF is local storage, global access references would be invalid

Test plan

New test: ResourceLocalBlobOCILayout with EnforceGlobalAccess: true
All existing OCI tests pass
Code generators (task generate) run clean
Build compiles without errors

Global access was previously always added for remote stores and had no way to be toggled from the repository configuration level. This adds a GlobalAccessPolicy to RepositoryOptions with two modes: - GlobalAccessPolicyDefault: only add global access for remote stores - GlobalAccessPolicyAlways: enforce global access on all local blobs Also fixes ResourceLocalBlobOCILayout which was not respecting the EnforceGlobalAccess option, unlike ResourceLocalBlobOCILayer. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Extend both OCI and CTF repository specifications with a globalAccessPolicy field (string: "" or "always") that controls whether global access references are added to local blobs. The CachingComponentVersionRepositoryProvider now reads this field from repository specs and passes it through as a RepositoryOption when constructing repositories. Generated JSON schemas updated accordingly. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

CTF archives are local storage — global access references would be invalid since content is not globally reachable. Remove the field from CTF spec, provider wiring, and regenerate schemas. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

netlify · 2026-04-13T15:42:26Z

✅ Deploy Preview for ocm-website ready!

Name	Link
🔨 Latest commit	`37f627d`
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/69e23140da9f1300088b8c95
😎 Deploy Preview	https://deploy-preview-2275--ocm-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-04-13T15:42:29Z

Warning

Rate limit exceeded

@matthiasbruns has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 4 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 14 minutes and 4 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aa239422-170b-4e38-abd6-98997baf6473

📥 Commits

Reviewing files that changed from the base of the PR and between 65f79d2 and 37f627d.

📒 Files selected for processing (6)

bindings/go/oci/internal/pack/pack.go
bindings/go/oci/internal/pack/pack_test.go
bindings/go/oci/internal/policy/global_access.go
bindings/go/oci/repository.go
bindings/go/oci/repository_options.go
bindings/go/oci/transformer/add_local_resource.go

📝 Walkthrough

Walkthrough

Introduced GlobalAccessPolicy type to replace the EnforceGlobalAccess boolean flag across Go OCI bindings. Added policy constants (Never, Auto) and updated pack, repository, transformer, and specification layers to support the new configuration mechanism for controlling global access reference handling.

Changes

Cohort / File(s)	Summary
Pack Layer `bindings/go/oci/internal/pack/pack.go`, `bindings/go/oci/internal/pack/pack_test.go`	Replaced `EnforceGlobalAccess bool` with `GlobalAccessPolicy` type and constants. Updated `ResourceLocalBlobOCILayer` and `ResourceLocalBlobOCILayout` to resolve global access via `resolveGlobalAccess()` function based on policy. Adjusted test cases and assertions to validate new policy behavior.
Repository Layer `bindings/go/oci/repository.go`, `bindings/go/oci/repository_options.go`	Added `globalAccessPolicy` field to `Repository` struct and `RepositoryOptions`. Introduced `SetGlobalAccessPolicy()` method and `WithGlobalAccessPolicy()` option constructor. Updated `uploadAndUpdateLocalArtifact` to pass policy to pack layer.
OCI Specification `bindings/go/oci/spec/repository/v1/oci/repository.go`, `bindings/go/oci/spec/transformation/v1alpha1/oci_add_local_resource.go`	Added `GlobalAccessPolicy` string type and constants (`Never`, `Auto`) to specification types. Extended `OCIAddLocalResourceSpec` struct with `GlobalAccessPolicy` field for configuration.
JSON Schemas `bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResource.schema.json`, `bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResourceSpec.schema.json`	Defined new `GlobalAccessPolicy` schema with allowed values (empty string and `"auto"`). Added `globalAccessPolicy` property to transformation spec schemas with descriptive documentation.
Transformer `bindings/go/oci/transformer/add_local_resource.go`	Updated `AddLocalResource.Transform` to capture and apply `GlobalAccessPolicy` from spec. Validates policy applicability to OCI repositories and invokes `SetGlobalAccessPolicy()` accordingly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰 Pack it up, store it global, or never at all,
A policy for access—I'm having a ball!
No more simple booleans in sight today,
GlobalAccessPolicy leads the way! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: introducing a GlobalAccessPolicy configuration option that makes global access behavior optional (Never/Auto) and configurable through repository options.
Description check	✅ Passed	The pull request description clearly relates to the changeset, detailing the addition of GlobalAccessPolicy to RepositoryOptions, the bug fix for ResourceLocalBlobOCILayout, and wiring through the OCI spec.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Replace EnforceGlobalAccess bool with three-valued GlobalAccessPolicy enum in pack.Options: - Default: auto-detect from storage backend (unchanged behavior) - Always: force global access on all blobs - Never: suppress global access even on remote registries This gives full control over global access at repository level via spec or Go API. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Change zero value of GlobalAccessPolicy from Default (auto-detect) to Never (suppress) across all layers. This discourages reliance on global access references by making suppression opt-out rather than opt-in. Spec values: "" (never, default), "default" (auto-detect), "always". Go API: iota 0=Never, 1=Default, 2=Always. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Remove GlobalAccessPolicyAlways — forcing global access on non-global backends produces invalid references and is not a valid use case. Rename GlobalAccessPolicyDefault to GlobalAccessPolicyAuto for clarity. Two values remain: - Never (zero value, default): suppress global access - Auto: auto-detect from storage backend Spec values: "" (never) and "auto". Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

bindings/go/oci/internal/pack/pack_test.go (1)
299-320: These additions still don't prove the policy is wired through.

Both tables run against a local file store, the new never case uses the zero/default policy, and the layout table never sets checkGlobalAccess. If the policy were ignored in either code path, these assertions would still pass. Please add one case where GlobalAccess actually flips based on the supplied policy/store combination.

Also applies to: 753-812
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@bindings/go/oci/internal/pack/pack_test.go` around lines 299 - 320, The tests
add a "never" GlobalAccessPolicy case but never demonstrate the policy actually
toggles GlobalAccess; update the table-driven tests to include at least one pair
of cases that differ only by Options.GlobalAccessPolicy (e.g.,
GlobalAccessPolicyNever vs GlobalAccessPolicyAlways) and run against the same
store type so the result differs, then in the checkGlobalAccess callback assert
that resource.Access.(*v2.LocalBlob).GlobalAccess is nil for the Never case and
non-nil (or has the expected value) for the Always case; modify the test rows
that use Options (AccessScheme, BaseReference, GlobalAccessPolicy) and the
checkGlobalAccess functions to explicitly verify the flip so the wiring from
Options.GlobalAccessPolicy to the produced descriptor.Resource is exercised.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/oci/internal/pack/pack.go`:
- Around line 57-61: The comment for Options.GlobalAccessPolicy is out of date:
update the doc for the GlobalAccessPolicy field (in type Options) to describe
the current enum values (GlobalAccessPolicy with values Never and Auto), state
that the zero value is Never (i.e., global access is suppressed by default), and
explain the behavior of Auto (auto-detects based on storage backend) and Never
(never add global access references). Ensure the text replaces references to the
removed Always mode and the incorrect zero-value behavior.

In `@bindings/go/oci/repository/provider/provider.go`:
- Around line 142-144: The code silently treats unknown globalAccessPolicy enum
strings as nil (effectively "never") instead of failing; update validation so
typos are rejected. Modify globalAccessPolicyFromOCI (or add a validator in
getConvertedTypedSpec) to return an error for any unrecognized
GlobalAccessPolicy value and propagate that error from getConvertedTypedSpec to
the caller instead of returning nil; update both call sites that append opts
(the block using globalAccessPolicyFromOCI at the shown lines and the similar
block around lines 195-201) to handle the error and fail fast when an unknown
enum is encountered.

---

Nitpick comments:
In `@bindings/go/oci/internal/pack/pack_test.go`:
- Around line 299-320: The tests add a "never" GlobalAccessPolicy case but never
demonstrate the policy actually toggles GlobalAccess; update the table-driven
tests to include at least one pair of cases that differ only by
Options.GlobalAccessPolicy (e.g., GlobalAccessPolicyNever vs
GlobalAccessPolicyAlways) and run against the same store type so the result
differs, then in the checkGlobalAccess callback assert that
resource.Access.(*v2.LocalBlob).GlobalAccess is nil for the Never case and
non-nil (or has the expected value) for the Always case; modify the test rows
that use Options (AccessScheme, BaseReference, GlobalAccessPolicy) and the
checkGlobalAccess functions to explicitly verify the flip so the wiring from
Options.GlobalAccessPolicy to the produced descriptor.Resource is exercised.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8eb911fe-1c99-493f-9435-92e9be6fbcb9

📥 Commits

Reviewing files that changed from the base of the PR and between cec9ee3 and f3d1ed1.

📒 Files selected for processing (15)

bindings/go/oci/internal/pack/pack.go
bindings/go/oci/internal/pack/pack_test.go
bindings/go/oci/repository.go
bindings/go/oci/repository/provider/provider.go
bindings/go/oci/repository_options.go
bindings/go/oci/spec/repository/v1/oci/repository.go
bindings/go/oci/spec/repository/v1/oci/schemas/Repository.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddComponentVersion.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddComponentVersionSpec.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResource.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResourceSpec.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIGetComponentVersion.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIGetComponentVersionSpec.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIGetLocalResource.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIGetLocalResourceSpec.schema.json

Fix stale Options.GlobalAccessPolicy doc that still referenced removed Always mode. Make globalAccessPolicyFromOCI return error for unrecognized policy values instead of silently falling back to never. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

GlobalAccessPolicyAuto is carried over from OCM v1 for backwards compatibility. Mark it as experimental across all layers (Go API, pack internals, OCI repo spec) and note that its future availability is being evaluated by the community. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Schemas still referenced "default" instead of "auto" after rename. Regenerate to match current spec constants. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

…spec Remove globalAccessPolicy from OCI Repository JSON serialization (field kept internal for plumbing via json:"-"). Add it to OCIAddLocalResourceSpec as the user-facing configuration point. Transformer sets policy on embedded repo struct before passing to provider. This scopes the experimental OCM v1 carry-over to transformers only, keeping repo spec clean. Regenerated JSON schemas reflect the move. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Remove GlobalAccessPolicy from oci.Repository spec struct entirely. Policy now only configurable via OCIAddLocalResourceSpec transformer spec. Transformer applies policy via SetGlobalAccessPolicy on the concrete *oci.Repository after provider creates it. Provider no longer wires globalAccessPolicy — removed helper and validation. Type + constants remain in spec package for transformer import. Regenerated schemas. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

…ackage Move canonical GlobalAccessPolicy type + iota to internal/policy. Both oci and pack packages now alias from same source — no duplicate iota definitions. Remove type cast in repository.go since types match. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bindings/go/oci/transformer/add_local_resource.go`:
- Around line 101-113: The code currently skips applying a global access policy
when globalAccessPolicy == "" (documented as "Never"), which can leave a repo's
previous policy intact; update the logic that inspects globalAccessPolicy (and
the repo type assertion to *oci.Repository) to explicitly handle the empty
string case by calling
ociRepo.SetGlobalAccessPolicy(oci.GlobalAccessPolicyNever), and keep the
existing case for ocirepospecv1.GlobalAccessPolicyAuto ->
oci.GlobalAccessPolicyAuto and the default error path for unknown values so that
"" properly resets the repo policy instead of leaking prior state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7c058c64-672b-4611-a17f-7a66b28b2693

📥 Commits

Reviewing files that changed from the base of the PR and between abe5b77 and 65f79d2.

📒 Files selected for processing (6)

bindings/go/oci/repository.go
bindings/go/oci/spec/repository/v1/oci/repository.go
bindings/go/oci/spec/transformation/v1alpha1/oci_add_local_resource.go
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResource.schema.json
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResourceSpec.schema.json
bindings/go/oci/transformer/add_local_resource.go

✅ Files skipped from review due to trivial changes (1)

bindings/go/oci/spec/repository/v1/oci/repository.go

🚧 Files skipped from review as they are similar to previous changes (2)

bindings/go/oci/repository.go
bindings/go/oci/spec/transformation/v1alpha1/schemas/OCIAddLocalResource.schema.json

Apply policy explicitly (including Never) on every OCI transform to prevent cached repo instances from leaking prior auto policy. Skip type assertion for non-OCI repos when policy is Never (noop). Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Verify auto policy on non-remote store does not set global access, confirming auto-detect logic only activates for remote backends. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

Pack now uses policy.GlobalAccessPolicy directly instead of re-exporting type alias + constants. Single definition in internal/policy, oci package re-exports for public API only. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

matthiasbruns

lgtm

…ponent-model#2275) ## Summary - Add `GlobalAccessPolicy` to `RepositoryOptions` with two modes: `Never` (disabled) and `Auto` (force global access on all local blobs if the repo supports it) - Wire through OCI repository spec (`globalAccessPolicy` JSON field) and provider - Fix bug: `ResourceLocalBlobOCILayout` was ignoring `EnforceGlobalAccess` (unlike `ResourceLocalBlobOCILayer`) - Remove `GlobalAccessPolicy` from CTF spec — CTF is local storage, global access references would be invalid ## Test plan - [x] New test: `ResourceLocalBlobOCILayout` with `EnforceGlobalAccess: true` - [x] All existing OCI tests pass - [x] Code generators (`task generate`) run clean - [x] Build compiles without errors --------- Signed-off-by: Jakob Möller <contact@jakob-moeller.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com>

…to v0.0.40 (#2331) (#2352) #### What this PR does / why we need it Adapts all consumers to the breaking change introduced in #2275: `GlobalAccessPolicy` now defaults to `Never`, meaning `localBlob` resources no longer have a `globalAccess` field populated after transfer. This upgrades `bindings/go/oci` from v0.0.39 to v0.0.40 and updates `go.mod`/`go.sum` across 8 consuming modules (constructor, helm, oci/integration, transfer, transfer/integration, cli, cli/integration, kubernetes/controller). **Test fixes:** - `transfer/integration`: Rewrites the `CopyModeAllResources` test — instead of verifying `globalAccess` is non-nil and resolvable in the target registry, it now asserts `globalAccess` is nil and verifies the blob is directly readable from the target repository via `GetLocalResource` - `cli/integration`: Replaces weak output assertions (checking registry addresses from `globalAccess` image references) with a stronger negative test that proves component-b is unreachable from registry-a without resolver config, confirming resolver routing actually works **Conformance scenario fixes:** - RGD: Replaces `resource.access.globalAccess.imageReference.toOCI()` with `resource.access.toOCI()`, which constructs the OCI reference directly from the component's repository spec and local reference digest - RGD: Uses `image.digest` instead of `image.tag` in HelmRelease values, since `toOCI()` on a `localBlob` returns only a digest reference (no tag) - RGD: Drops the `tag` field from `additionalStatusFields` — no longer available without `globalAccess` - Helm chart templates (notes + postgres): Switches image references from `:tag` to `@digest` format - Helm chart values: Replaces `tag` field with `digest` field **Documentation:** - Sovereign cloud ADR: Updates CEL expression examples from `resource.access.globalAccess.imageReference.toOCI()` to `resource.access.toOCI()` - OCM controllers concept page: Updates CEL example from `resource.access.globalAccess.imageReference.split('/')[0]` to `resource.access.toOCI().registry` #### How it was tested - Unit tests: all modules pass - Integration tests: `transfer/integration` and `cli/integration` pass - E2E tests: 12/12 pass on Kind cluster - Conformance scenario: passes with both the current CLI (`0.0.0-main`, which still populates `globalAccess`) and a locally-built CLI using OCI v0.0.40 (which does not) #### Which issue(s) this PR fixes Fixes #2331 --------- Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com> Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com>

…to v0.0.40 (#2331) (#2352) #### What this PR does / why we need it Adapts all consumers to the breaking change introduced in #2275: `GlobalAccessPolicy` now defaults to `Never`, meaning `localBlob` resources no longer have a `globalAccess` field populated after transfer. This upgrades `bindings/go/oci` from v0.0.39 to v0.0.40 and updates `go.mod`/`go.sum` across 8 consuming modules (constructor, helm, oci/integration, transfer, transfer/integration, cli, cli/integration, kubernetes/controller). **Test fixes:** - `transfer/integration`: Rewrites the `CopyModeAllResources` test — instead of verifying `globalAccess` is non-nil and resolvable in the target registry, it now asserts `globalAccess` is nil and verifies the blob is directly readable from the target repository via `GetLocalResource` - `cli/integration`: Replaces weak output assertions (checking registry addresses from `globalAccess` image references) with a stronger negative test that proves component-b is unreachable from registry-a without resolver config, confirming resolver routing actually works **Conformance scenario fixes:** - RGD: Replaces `resource.access.globalAccess.imageReference.toOCI()` with `resource.access.toOCI()`, which constructs the OCI reference directly from the component's repository spec and local reference digest - RGD: Uses `image.digest` instead of `image.tag` in HelmRelease values, since `toOCI()` on a `localBlob` returns only a digest reference (no tag) - RGD: Drops the `tag` field from `additionalStatusFields` — no longer available without `globalAccess` - Helm chart templates (notes + postgres): Switches image references from `:tag` to `@digest` format - Helm chart values: Replaces `tag` field with `digest` field **Documentation:** - Sovereign cloud ADR: Updates CEL expression examples from `resource.access.globalAccess.imageReference.toOCI()` to `resource.access.toOCI()` - OCM controllers concept page: Updates CEL example from `resource.access.globalAccess.imageReference.split('/')[0]` to `resource.access.toOCI().registry` #### How it was tested - Unit tests: all modules pass - Integration tests: `transfer/integration` and `cli/integration` pass - E2E tests: 12/12 pass on Kind cluster - Conformance scenario: passes with both the current CLI (`0.0.0-main`, which still populates `globalAccess`) and a locally-built CLI using OCI v0.0.40 (which does not) #### Which issue(s) this PR fixes Fixes #2331 --------- Signed-off-by: Frederic Wilhelm <frederic.wilhelm@sap.com> Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com> f71796b

jakobmoellerdev added 3 commits April 13, 2026 15:10

github-actions Bot added kind/feature new feature, enhancement, improvement, extension size/m Medium labels Apr 13, 2026

jakobmoellerdev added 3 commits April 13, 2026 17:50

jakobmoellerdev marked this pull request as ready for review April 14, 2026 06:20

jakobmoellerdev requested a review from a team as a code owner April 14, 2026 06:20

coderabbitai Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread bindings/go/oci/internal/pack/pack.go Outdated

Comment thread bindings/go/oci/repository/provider/provider.go Outdated

fabianburth reviewed Apr 14, 2026

View reviewed changes

Comment thread bindings/go/oci/internal/pack/pack.go Outdated

Comment thread bindings/go/oci/spec/repository/v1/oci/repository.go Outdated

jakobmoellerdev mentioned this pull request Apr 14, 2026

feat(transfer): add file buffer cleanup transformation #2248

Merged

4 tasks

jakobmoellerdev added 3 commits April 15, 2026 11:20

fix(oci): regenerate JSON schemas for globalAccessPolicy auto rename

1bcbcd6

Schemas still referenced "default" instead of "auto" after rename. Regenerate to match current spec constants. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

fabianburth previously approved these changes Apr 16, 2026

View reviewed changes

jakobmoellerdev dismissed fabianburth’s stale review via 65f79d2 April 16, 2026 07:29

coderabbitai Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread bindings/go/oci/transformer/add_local_resource.go Outdated

Skarlso reviewed Apr 16, 2026

View reviewed changes

Comment thread bindings/go/oci/internal/pack/pack.go

jakobmoellerdev changed the title ~~feat(oci): make GlobalAccessPolicy optional and toggleable~~ feat(oci)!: make GlobalAccessPolicy optional and toggleable Apr 16, 2026

github-actions Bot added the !BREAKING-CHANGE! Breaking change in API or ocm-cli or spec label Apr 16, 2026

Skarlso previously approved these changes Apr 16, 2026

View reviewed changes

test(oci): add test case for auto global access policy on local store

3d01da5

Verify auto policy on non-remote store does not set global access, confirming auto-detect logic only activates for remote backends. Signed-off-by: Jakob Möller <contact@jakob-moeller.com>

jakobmoellerdev dismissed Skarlso’s stale review via 3d01da5 April 16, 2026 07:45

Skarlso previously approved these changes Apr 16, 2026

View reviewed changes

jakobmoellerdev dismissed Skarlso’s stale review via 894eef9 April 16, 2026 07:52

jakobmoellerdev requested review from Skarlso and fabianburth April 16, 2026 08:08

fabianburth approved these changes Apr 16, 2026

View reviewed changes

frewilhelm reviewed Apr 17, 2026

View reviewed changes

Comment thread bindings/go/oci/internal/policy/global_access.go

Merge branch 'main' into vk/cb21-make-global-acce

37f627d

matthiasbruns approved these changes Apr 17, 2026

View reviewed changes

jakobmoellerdev merged commit c9c7790 into open-component-model:main Apr 17, 2026
24 checks passed

frewilhelm mentioned this pull request Apr 21, 2026

fix: update module ocm.software/open-component-model/bindings/go/oci to v0.0.40 (#2331) #2352

Merged

coderabbitai Bot mentioned this pull request Apr 23, 2026

feat(oci): push ownership referrer on local artifact upload #2368

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(oci)!: make GlobalAccessPolicy optional and toggleable#2275

feat(oci)!: make GlobalAccessPolicy optional and toggleable#2275
jakobmoellerdev merged 16 commits into
open-component-model:mainfrom
jakobmoellerdev:vk/cb21-make-global-acce

jakobmoellerdev commented Apr 13, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 13, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matthiasbruns left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

jakobmoellerdev commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

netlify Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ocm-website ready!

Uh oh!

coderabbitai Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matthiasbruns left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jakobmoellerdev commented Apr 13, 2026 •

edited

Loading

netlify Bot commented Apr 13, 2026 •

edited

Loading

coderabbitai Bot commented Apr 13, 2026 •

edited

Loading