fix(export-dynamic): verify registry artifacts before skipping workspace (RHDHBUGS-3635)

[gashcrumb]

Summary

Fixes RHDHBUGS-3635

When determining whether to skip a workspace because its last commit is an ancestor of the last published commit, verify that all expected container images for the workspace actually exist in the registry and contain valid, non-empty dynamic package metadata (io.backstage.dynamic-packages).

If any expected artifact is missing from the registry or has invalid/empty dynamic package metadata (such as from a cancelled publish or export failure), do not skip the workspace — proceed with exporting and publishing to self-heal the missing/broken artifact.

[nickboldt]

to validate this is working we should run it against the broken scorecard images?

[gashcrumb]

Great suggestion! We investigated this and tested against those images:

Background & Quay vs GHCR

1. Where the broken images were: The broken scorecard images with empty io.backstage.dynamic-packages annotations were downstream Konflux builds in Quay (quay.io/rhdh/..., from RHDHBUGS-3834), caused by an empty pipeline parameter. The upstream scorecard artifacts that export-dynamic publishes to GHCR were never broken and have always had valid annotations.
2. Image Indexes vs Manifests: Quay/Konflux builds are multi-architecture OCI image indexes (application/vnd.oci.image.index.v1+json). On an image index, the io.backstage.dynamic-packages annotation is stamped on the child platform manifests rather than the root index.

Updates in this PR

We updated the verification check (export-dynamic/verify-registry-artifacts.sh) so that when skopeo inspect --raw returns an image index / manifest list without root annotations, it resolves .manifests[0].digest and inspects the child platform manifest.

Test Results

Tested against both Quay multi-arch images and GHCR single manifests:

1. Broken Quay scorecard image (:2.0.0--1.1.1 from RHDHBUGS-3834):
   • Inspects index $\rightarrow$ resolves child manifest $\rightarrow$ catches empty annotation "" $\rightarrow$ Correctly rejected (skipWorkspace=false, workspace cannot be skipped).
2. Fixed Quay scorecard image (:2.0.0--1.1.2):
   • Inspects index $\rightarrow$ resolves child manifest $\rightarrow$ verifies valid base64 annotation $\rightarrow$ Correctly accepted.
3. Valid GHCR image (bs_1.54.9__1.4.0):
   • Single manifest with annotation $\rightarrow$ Correctly accepted.
4. Non-existent tag / missing annotation:
   • Correctly rejected.

We have also added an automated test suite (export-dynamic/verify-registry-artifacts.test.sh) covering offline mock fixtures (valid manifests, empty annotations, missing annotations, empty arrays, index dereferencing) and live registry checks, wired directly into .github/workflows/test-pack-dist-dynamic.yaml so CI validates this on every PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud