fix: exit early on invalid image architecture

[dobrac]

Note

Add platform verification for pulled images and standardize platform handling, updating telemetry and tests accordingly.

• OCI image pulling:
  • Introduce platform := DefaultPlatform and use it consistently in GetPublicImage and GetImage.
  • Add verifyImagePlatform(img, platform) to validate image architecture after pull (both remote and artifact registry paths).
  • Update telemetry message when using DockerHub proxy.
• New helper:
  • Add verifyImagePlatform(img, platform) in packages/orchestrator/internal/template/build/core/oci/oci.go to enforce architecture match.
• Tests:
  • In oci_test.go, set image config Architecture and OS to match expected platform before testing.

^{Written by Cursor Bugbot for commit 66c32bb. This will update automatically on new commits. Configure here.}

[cursor]

Bug: Architecture Validation Inconsistency

The early return path in GetPublicImage when using dockerhubRepository.GetImage() bypasses the new verifyImagePlatform check, allowing images with incorrect architectures to be returned. This inconsistency means images from the default registry without auth won't have their architecture validated, while all other images will.

packages/orchestrator/internal/template/build/core/oci/oci.go#L52-L60

infra/packages/orchestrator/internal/template/build/core/oci/oci.go

Lines 52 to 60 in 7f99e82

	if authProvider == nil && ref.Context().RegistryStr() == name.DefaultRegistry {
	img, err := dockerhubRepository.GetImage(ctx, tag, DefaultPlatform)
	if err != nil {
	return nil, fmt.Errorf("error getting image: %w", err)
	}
	telemetry.ReportEvent(ctx, "pulled public image")
	return img, nil

 

---

[chatgpt-codex-connector]

💡 Codex Review

infra/packages/orchestrator/internal/template/build/core/oci/oci.go

Lines 82 to 86 in 7f99e82

	telemetry.ReportEvent(ctx, "pulled public image")
	err = verifyImagePlatform(img)
	if err != nil {
	return nil, err

Enforce architecture check for DockerHub proxy path

The newly added verifyImagePlatform call only executes when the image is pulled via remote.Image, but when the function takes the default path through the DockerHub proxy (no auth provider and default registry) it still returns immediately without verification. If the cache serves a manifest for the wrong architecture—exactly what this change aims to detect—callers will continue with an incompatible image. Consider invoking verifyImagePlatform in the early return branch as well so all code paths enforce the same validation.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".