feat(cms): improve catalog, editorial recovery and operations

src/lib/publish-container.test.ts

@@ -0,0 +1,69 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const root = process.cwd();
+const bash =
+	process.platform === "win32"
+		? ((process.env.PATH ?? "")
+				.split(delimiter)
+				.flatMap((dir) => [
+					join(dir, "bash.exe"),
+					join(dirname(dir), "bin", "bash.exe"),
+					join(dirname(dirname(dir)), "bin", "bash.exe"),
+				])
+				.find((path) => existsSync(path)) ?? "bash")
+		: "bash";
+const sha = "a".repeat(40);
+function simulate(scenario: string) {
+	const dir = mkdtempSync(join(tmpdir(), "cms-publish-test-"));
+	try {
+		const result = spawnSync(
+			bash,
+			[resolve(root, "scripts/publish-container.sh")],
+			{
+				cwd: dir,
+				encoding: "utf8",
+				timeout: 10000,
+				env: {
+					...process.env,
+					BASH_ENV: resolve(root, "src/test/publish-container-harness.sh"),
+					TEST_DIR: dir.replaceAll("\\", "/"),
+					TEST_SHA: sha,
+					SCENARIO: scenario,
+					REGISTRY_SERVER: "https://registry.invalid",
+					REGISTRY_REPOSITORY: "owner/cms",
+					REGISTRY_USER: "fixture",
+					REGISTRY_TOKEN: "fixture-only",
+				},
+			},
+		);
+		if (result.error) throw result.error;
+		expect(result.status, result.stdout + result.stderr).toBe(0);
+		return readFileSync(join(dir, "calls"), "utf8");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+}
+describe("verified application image reuse", () => {
+	it("reuses only the exact image digest that passed deployment checks", () => {
+		const calls = simulate("verified");
+		expect(calls).toContain(
+			`docker tag sha256:candidate registry.invalid/owner/cms:${sha}`,
+		);
+		expect(calls).not.toContain("docker build --network=host --build-arg");
+		expect(
+			calls.indexOf("verify scripts/verify-portable-image.mjs"),
+		).toBeLessThan(calls.indexOf("docker push"));
+	});
+	it.each(["missing", "mismatch"])(
+		"builds committed source when verification marker is %s",
+		(scenario) => {
+			const calls = simulate(scenario);
+			expect(calls).toContain("docker build --network=host --build-arg");
+			expect(calls).not.toContain("docker tag sha256:candidate");
+		},
+	);
+});