feat(template): versioned OCI template registry — push/add/update/diff/verify (spec 19)

[gustavobertoi]

What

Implements spec 19 — a versioned OCI template registry — turning the embedded template pile into digest-pinned, shareable team infrastructure.

New: internal/registry

Pure-Go (oras.land/oras-go/v2, CGO-free) OCI seam behind a small TargetResolver interface so the CLI never touches oras directly and tests round-trip through an in-memory oras store (no network):

• reference.go — parse oci://host/repo:tag / @sha256:… (+ ParseRepository for the bare lockfile source:), reject floating :latest.
• bundle.go — deterministic tar packaging of a template dir (sorted paths, zeroed mtime/uid/gid, fixed modes) so the artifact digest is a pure function of content; atomic, traversal-safe, size-capped unpack.
• registry.go / pull.go / target.go — Push / ResolveDigest / Pull, custom artifactType + layer media type, docker/ORAS credential store + GITHUB_TOKEN for ghcr.io (no devstack token store), auth-error remediation. Mandatory digest verification on pull (a re-pushed/tampered manifest is refused; nothing is unpacked).
• verify.go — cosign Verifier/Signer seam (keyless + keyed VerifyPolicy), mock-able; a zero policy = digest-pinned-but-unsigned notice.

Graduated template verbs (were stubs)

push, add (tag→digest pin + optional signature verify + digest-keyed cache + lockfile entry, all under lock.WithLock), update (re-resolve, --dry-run, --to), diff (render-diff pinned vs remote tag), verify (re-pull + re-check digest/signature), ls.

Wiring

• internal/store gains a digest-pinned templates: lockfile block + a digest-keyed cache under XDG_CACHE_HOME/devstack/templates/<algo>/<hex> (never keyed by tag → no cache poisoning).
• Remote templates are chained into the generate/lint/test source: embedded < store < remote, digest-pinned and offline-first. With no remote templates registered the source chain is byte-identical to before, so generation stays deterministic.

Why

Multiple repos can now render byte-identical compose/Dockerfiles from a committed, digest-pinned lockfile; a moving tag never reaches the hot path.

How tested

• internal/registry: push+pull round-trip through an oras memory store; PackBundle determinism (metadata-independent); digest-mismatch refusal; reference-parse table; verify good vs tampered (fake verifier); unavailable-cosign abort.
• internal/cli: full add/update/diff/verify/ls flow through a memory-backed client seam — digest pinned into the store lockfile, bundle cached under the digest key and resolvable by name; drift detected + --dry-run writes nothing + real update moves the pin; newer-schemaVersion bundle rejected with an upgrade message; floating-tag refusal; signature policy accept/reject.
• Gates green: CGO_ENABLED=0 go build ./..., CGO_ENABLED=1 go test ./internal/..., gofmt -l clean, go vet ./..., make determinism.

Scoped out (flagged in code)

• git+https/ssh template scheme (spec lists it; this milestone is OCI-first).
• workspace.yaml templates:/verify.cosign lockfile + generate wiring — this slice keeps the registry lockfile in the store config (~/.devstack/config.yaml); the RemoteTemplate shape is identical to the spec's workspace block so migration is a move, not a redesign.
• Pure-Go sigstore-go verification — the real Verifier/Signer shell cosign, consistent with internal/selfupdate's documented CGO-free decision; the seam makes a sigstore-go swap drop-in.
• Cache GC/TTL integration and multi-template sub-path bundles (one template per tag).

🤖 Generated with Claude Code