fix(pikaoa): 稳健解析 BuildKit 镜像摘要

scripts/src/pikaoa-test-delivery-renderer.test.ts

@@ -63,6 +63,9 @@ describe("PikaOA test PaC renderer", () => {
         expect(JSON.stringify(task)).toContain("buildctl-daemonless.sh build");
         expect(JSON.stringify(task)).toContain("$(params.revision)");
         expect(JSON.stringify(task)).not.toContain("source-token");
+        const buildScript = (((task?.taskSpec as Record<string, unknown>).steps as Array<Record<string, unknown>>)[0]?.script) as string;
+        expect(buildScript).toContain('"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)"');
+        expect(buildScript).toContain("Docker-Content-Digest:");
       }
       const sourceTask = tasks.find((item) => item.name === "source");
       expect(JSON.stringify(sourceTask)).toContain("source-token");

scripts/src/pikaoa-test-delivery-renderer.ts

@@ -178,8 +178,15 @@ buildctl-daemonless.sh build \\
   --opt network=${shellSingleQuote(target.build.networkMode)} \\
   --output "type=image,name=$tag,push=true" \\
   --metadata-file "$metadata"
-digest=$(grep -o '"containerimage.digest":"sha256:[0-9a-f]*"' "$metadata" | head -n1 | cut -d'"' -f4)
-case "$digest" in sha256:[0-9a-f]*) ;; *) echo 'build digest missing' >&2; exit 3;; esac
+metadata_compact=$(tr -d '\\n\\r' < "$metadata")
+digest=$(printf '%s' "$metadata_compact" | sed -n 's/.*"containerimage.digest"[[:space:]]*:[[:space:]]*"\\(sha256:[0-9a-f]\\{64\\}\\)".*/\\1/p' | head -n1)
+if ! printf '%s' "$digest" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+  registry_host=${shellSingleQuote(imageRepository.split("/")[0] ?? "")}
+  registry_path=${shellSingleQuote(imageRepository.split("/").slice(1).join("/"))}
+  headers=$(wget --server-response --spider --header='Accept: application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' "http://$registry_host/v2/$registry_path/manifests/$revision" 2>&1 || true)
+  digest=$(printf '%s\\n' "$headers" | awk 'BEGIN{IGNORECASE=1} /^[[:space:]]*Docker-Content-Digest:/ {gsub(/\\r/, "", $2); print $2; exit}')
+fi
+case "$digest" in sha256:[0-9a-f][0-9a-f]*) test "\${#digest}" -eq 71 ;; *) echo 'build digest missing from metadata and registry manifest' >&2; exit 3;; esac
 printf '%s' "$digest" > "$(results.digest.path)"
 printf '%s@%s' ${shellSingleQuote(imageRepository)} "$digest" > "$(results.image.path)"
 printf '{"ok":true,"phase":"${taskName}","sourceCommit":"%s","imageTag":"%s","digest":"%s","valuesPrinted":false}\n' "$revision" "$tag" "$digest"