fix(oci): allow digest-only and OCM tag+digest references in UploadResourceStream by jakobmoellerdev · Pull Request #2723 · open-component-model/open-component-model

jakobmoellerdev · 2026-06-01T15:31:52Z

Summary

UploadResourceStream previously rejected all references except tagged ones (Form C: repo:tag) due to a ValidateReferenceAsTag() guard — this blocked digest-only (Form A: repo@sha256:...) and OCM tag+digest references (repo:tag@sha256:...) from uploading
The guard also made the digest-pinning code added in this branch unreachable: for Form C, ref.Reference.Reference is always the tag string (non-empty), so the if ref.Reference.Reference == "" pin branch was never entered
Replaced the guard with a tag-or-digest check: only bare repository references with neither tag nor digest are rejected

Changes

bindings/go/oci/repository.go: relax guard from ValidateReferenceAsTag() to ref.Tag == "" && ref.ValidateReferenceAsDigest() != nil
bindings/go/oci/repository_test.go: add TestRepository_UploadResourceStream with 4 table-driven cases covering all reference forms

Test plan

go test ./... -count=1 passes in bindings/go/oci
tag-only ref: tag preserved, resource digest applied
digest-only ref: digest preserved, no tag call issued
OCM tag+digest ref: both preserved (previously blocked by old guard)
bare repo ref: rejected with "can only upload ... if it has a tag or digest" error

Signed-off-by: Jakob Möller <contact@jakob-moeller.com> On-behalf-of: @SAP <jakob.moeller@sap.com>

coderabbitai · 2026-06-01T15:32:01Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ab928fea-c859-4d91-83fc-5c9d4b05e466

📥 Commits

Reviewing files that changed from the base of the PR and between ec1ae6f and cec71c3.

📒 Files selected for processing (2)

bindings/go/oci/repository.go
bindings/go/oci/repository_test.go

💤 Files with no reviewable changes (1)

bindings/go/oci/repository.go

🚧 Files skipped from review as they are similar to previous changes (1)

bindings/go/oci/repository_test.go

📝 Walkthrough

Walkthrough

The PR extends UploadResourceStream to accept OCI image references specified by tag, digest, or both instead of requiring only tags. It updates reference validation, conditionally applies tagging based on presence of a tag, and adds digest pinning logic. Comprehensive table-driven tests validate the new behavior across reference forms.

Changes

Support Digest-Based OCI Image References

Layer / File(s)	Summary
UploadResourceStream implementation for tag or digest references `bindings/go/oci/repository.go`	Reference validation is relaxed to allow upload targets with either a tag or digest; conditional tagging applies only when a tag is present; digest pinning sets `ref.Reference.Reference` from the uploaded graph root's digest when not already pinned.
Test helper and comprehensive test coverage `bindings/go/oci/repository_test.go`	New imports for memory store and OCI streams enable a `buildTestManifestStream` helper that prepares test manifests; `TestRepository_UploadResourceStream` validates the implementation across tag-only, digest-only, and combined reference forms with per-case result assertions. Many test composite-literal formatting changes are grouped with the new tests.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A rabbit hops through refs both tagged and dug,
No more tag-only hugs—digests fit snug,
The stream uploads true, with pinning so neat,
Tests verify paths from source to receipt! 📦✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: relaxing a validation guard to allow additional reference forms in UploadResourceStream.
Description check	✅ Passed	The description is well-structured and directly related to the changeset, explaining the problem, solution, and test plan for the validation guard relaxation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

netlify · 2026-06-01T15:32:01Z

✅ Deploy Preview for ocm-website ready!

Name	Link
🔨 Latest commit	`1f5c674`
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/6a2017d5647db000079a884c
😎 Deploy Preview	https://deploy-preview-2723--ocm-website.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

bindings/go/oci/repository_test.go (1)

2081-2181: ⚡ Quick win

Add a mismatched pinned-digest case.

The digest-bearing cases all reuse manifestDesc.Digest, so this table will miss the bug where UploadResourceStream preserves a caller-supplied digest that does not match rs.Root().Digest. A case like test-repo:v1.0.0@<different-digest> should assert that the upload fails.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/go/oci/repository_test.go` around lines 2081 - 2181, Add a test case
to TestRepository_UploadResourceStream that simulates a mismatched pinned
digest: in the table add an entry (name like "tag+non-matching digest is
rejected") which uses refFunc to return "test-repo:v1.0.0@" + <differentDigest>
where <differentDigest> is derived from manifestDesc.Digest but altered (e.g.
flip one hex char or replace suffix) so it does not equal
manifestDesc.Digest.String(); set wantErr=true and wantErrMsg to something
indicating a digest mismatch (e.g. "digest" or "mismatch"); this will exercise
UploadResourceStream and assert it fails when caller-supplied digest does not
match rs.Root().Digest. Ensure the case references manifestDesc and
UploadResourceStream so reviewers can find where to locate the behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bindings/go/oci/repository.go`:
- Around line 990-995: The code currently preserves a caller-supplied digest in
ref.Reference.Reference even when it differs from rs.Root().Digest, producing an
invalid access reference; update the block around ref.Reference.Reference /
rs.Root().Digest so that if ref.Reference.Reference is non-empty and does not
equal rs.Root().Digest.String() you return a clear error (e.g., fmt.Errorf or
wrapped error) instead of proceeding, otherwise if empty set
ref.Reference.Reference = rs.Root().Digest.String(); finally set
access.ImageReference = ref.String(). This validation should be added in
repository.go where ref and rs.Root().Digest are handled to reject mismatched
pinned digests before returning the access reference.

---

Nitpick comments:
In `@bindings/go/oci/repository_test.go`:
- Around line 2081-2181: Add a test case to TestRepository_UploadResourceStream
that simulates a mismatched pinned digest: in the table add an entry (name like
"tag+non-matching digest is rejected") which uses refFunc to return
"test-repo:v1.0.0@" + <differentDigest> where <differentDigest> is derived from
manifestDesc.Digest but altered (e.g. flip one hex char or replace suffix) so it
does not equal manifestDesc.Digest.String(); set wantErr=true and wantErrMsg to
something indicating a digest mismatch (e.g. "digest" or "mismatch"); this will
exercise UploadResourceStream and assert it fails when caller-supplied digest
does not match rs.Root().Digest. Ensure the case references manifestDesc and
UploadResourceStream so reviewers can find where to locate the behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 703cb0d0-2cda-47e4-9f0e-ff36627a2fb5

📥 Commits

Reviewing files that changed from the base of the PR and between d7ac8a5 and ec1ae6f.

📒 Files selected for processing (2)

bindings/go/oci/repository.go
bindings/go/oci/repository_test.go

…CM tag+digest references The previous guard called ValidateReferenceAsTag() which only passes for tag-only references (Form C). This made the digest-pinning code added in the parent commit unreachable, and blocked digest-only (Form A) and OCM tag+digest references from uploading. Replace the guard with a tag-or-digest check: reject only bare repository references that have neither a tag nor a valid digest. Add table-driven tests covering all four reference forms: - tag-only: tag preserved, resource digest applied - digest-only: digest preserved, no tag call - tag+digest (OCM form): both preserved (was previously blocked) - bare repo: rejected with clear error Signed-off-by: Jakob Möller <contact@jakob-moeller.com> On-behalf-of: @SAP <jakob.moeller@sap.com>

feat: Add conditional tag and digest pinning during artifact upload

c179a64

Signed-off-by: Jakob Möller <contact@jakob-moeller.com> On-behalf-of: @SAP <jakob.moeller@sap.com>

github-actions Bot added size/m Medium kind/bugfix Bug labels Jun 1, 2026

jakobmoellerdev marked this pull request as ready for review June 1, 2026 16:15

jakobmoellerdev requested a review from a team as a code owner June 1, 2026 16:15

coderabbitai Bot reviewed Jun 1, 2026

View reviewed changes

Comment thread bindings/go/oci/repository.go

jakobmoellerdev force-pushed the digest-processing-transfer branch from ec1ae6f to b65617e Compare June 1, 2026 16:23

jakobmoellerdev force-pushed the digest-processing-transfer branch from b65617e to 42b6b5c Compare June 1, 2026 16:56

fabianburth approved these changes Jun 2, 2026

View reviewed changes

Merge branch 'main' into digest-processing-transfer

cec71c3

frewilhelm approved these changes Jun 3, 2026

View reviewed changes

Merge branch 'main' into digest-processing-transfer

1f5c674

jakobmoellerdev merged commit 17db1eb into open-component-model:main Jun 3, 2026
20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(oci): allow digest-only and OCM tag+digest references in UploadResourceStream#2723

fix(oci): allow digest-only and OCM tag+digest references in UploadResourceStream#2723
jakobmoellerdev merged 4 commits into
open-component-model:mainfrom
jakobmoellerdev:digest-processing-transfer

jakobmoellerdev commented Jun 1, 2026

Uh oh!

coderabbitai Bot commented Jun 1, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jakobmoellerdev commented Jun 1, 2026

Summary

Changes

Test plan

Uh oh!

coderabbitai Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ocm-website ready!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jun 1, 2026 •

edited

Loading

netlify Bot commented Jun 1, 2026 •

edited

Loading