diff --git a/docs/modules/ROOT/pages/ec_oci_image_referrers.adoc b/docs/modules/ROOT/pages/ec_oci_image_referrers.adoc index 9be69da05..d5088f3db 100644 --- a/docs/modules/ROOT/pages/ec_oci_image_referrers.adoc +++ b/docs/modules/ROOT/pages/ec_oci_image_referrers.adoc @@ -12,4 +12,4 @@ Discover artifacts attached to an image via OCI Referrers API. == Return -`referrers` (`array>`): list of referrer descriptors discovered via OCI Referrers API +`referrers` (`array>`): list of referrer descriptors discovered via OCI Referrers API diff --git a/internal/rego/oci/oci.go b/internal/rego/oci/oci.go index 17c54b8d1..482bb2ddc 100644 --- a/internal/rego/oci/oci.go +++ b/internal/rego/oci/oci.go @@ -446,6 +446,7 @@ func registerOCIImageTagRefs() { } func registerOCIImageReferrers() { + annotations := types.NewObject(nil, types.NewDynamicProperty(types.S, types.S)) descriptor := types.NewObject( []*types.StaticProperty{ {Key: "mediaType", Value: types.S}, @@ -453,6 +454,7 @@ func registerOCIImageReferrers() { {Key: "digest", Value: types.S}, {Key: "artifactType", Value: types.S}, {Key: "ref", Value: types.S}, + {Key: "annotations", Value: annotations}, }, nil, ) @@ -1511,6 +1513,7 @@ func ociImageReferrers(bctx rego.BuiltinContext, a *ast.Term) (*ast.Term, error) ast.Item(ast.StringTerm("digest"), ast.StringTerm(descriptor.Digest.String())), ast.Item(ast.StringTerm("artifactType"), ast.StringTerm(descriptor.ArtifactType)), ast.Item(ast.StringTerm("ref"), ast.StringTerm(referrerRef)), + ast.Item(ast.StringTerm("annotations"), newAnnotationsTerm(descriptor.Annotations)), ) referrerDescriptors = append(referrerDescriptors, descriptorTerm) diff --git a/internal/rego/oci/oci_test.go b/internal/rego/oci/oci_test.go index 8156b4d97..f0951d1bc 100644 --- a/internal/rego/oci/oci_test.go +++ b/internal/rego/oci/oci_test.go @@ -1771,6 +1771,7 @@ func TestOCIImageReferrers(t *testing.T) { require.NotNil(t, obj.Get(ast.StringTerm("mediaType")), "descriptor should have mediaType") require.NotNil(t, obj.Get(ast.StringTerm("size")), "descriptor should have size") require.NotNil(t, obj.Get(ast.StringTerm("artifactType")), "descriptor should have artifactType") + require.NotNil(t, obj.Get(ast.StringTerm("annotations")), "descriptor should have annotations") } // Verify the referrers match (order-independent) @@ -1778,4 +1779,29 @@ func TestOCIImageReferrers(t *testing.T) { } }) } + + // Verify annotations field is present as an object on every referrer descriptor + t.Run("annotations field is an object", func(t *testing.T) { + ClearCaches() + + bctx := rego.BuiltinContext{Context: context.Background()} + got, err := ociImageReferrers(bctx, ast.StringTerm(digestRef)) + require.NoError(t, err) + require.NotNil(t, got) + + arr, ok := got.Value.(*ast.Array) + require.True(t, ok) + require.Greater(t, arr.Len(), 0) + + for i := 0; i < arr.Len(); i++ { + obj, ok := arr.Elem(i).Value.(ast.Object) + require.True(t, ok) + + annTerm := obj.Get(ast.StringTerm("annotations")) + require.NotNil(t, annTerm, "descriptor %d should have annotations field", i) + + _, ok = annTerm.Value.(ast.Object) + require.True(t, ok, "descriptor %d annotations should be an object", i) + } + }) }