Merge remote-tracking branch 'origin/master' into feat/1923-cicd-otel-observability

scripts/native/cicd/pac-status-evaluator.cjs

@@ -567,6 +567,11 @@ function extractPacArtifactEvidence(recordsInput, logText) {
 
 function evaluatePacStatus(inputValue) {
   const input = record(inputValue);
+  const registryApplicability = input.registryApplicability === "not-configured"
+    ? "not-configured"
+    : input.registryApplicability === "configured" || stringOrNull(input.imageRepository) !== null
+      ? "configured"
+      : "not-configured";
   const artifact = record(input.artifact);
   const argo = record(input.argo);
   const runtime = record(input.runtime);
@@ -704,7 +709,7 @@ function evaluatePacStatus(inputValue) {
     code = "pac-artifact-catalog-digest-missing";
     phase = "artifact-catalog-digest-missing";
     hint = "the HWLAB artifact catalog did not expose any sha256 digest";
-  } else if (stringOrNull(input.imageRepository) !== null && !registryEvidenceReady) {
+  } else if (registryApplicability === "configured" && stringOrNull(input.imageRepository) !== null && !registryEvidenceReady) {
     ok = false;
     code = "pac-registry-missing";
     phase = "source-ready-registry-missing";
@@ -779,7 +784,9 @@ function evaluatePacStatus(inputValue) {
     registryProbeBase: stringOrNull(input.registryProbeBase),
     imageTag: stringOrNull(input.imageTag),
     registry: {
-      present: registryEvidenceReady,
+      applicability: registryApplicability,
+      status: registryApplicability === "configured" ? (registryEvidenceReady ? "present" : "missing") : "not-configured",
+      present: registryApplicability === "configured" ? registryEvidenceReady : null,
       probePresent: input.registryPresent === true,
       catalogVerified: catalogDeliveryEvidence,
       digest: registryDigest,
@@ -915,6 +922,18 @@ function runPacStatusFixtureChecks() {
       expectedCode: "pac-ready-gitops-exact",
       input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
     },
+    {
+      id: "gitops-only-registry-not-configured",
+      expectedOk: true,
+      expectedCode: "pac-ready-gitops-exact",
+      input: fixtureInput({ registryApplicability: "not-configured", imageRepository: "registry/shared-repository-image", artifact: { gitopsCommit: revision }, argo: exactArgo }),
+    },
+    {
+      id: "image-registry-missing-fails-closed",
+      expectedOk: false,
+      expectedCode: "pac-registry-missing",
+      input: fixtureInput({ registryApplicability: "configured", imageRepository: "registry/service", artifact: { imageStatus: "built", digest: digestA, gitopsCommit: revision }, argo: exactArgo }),
+    },
     {
       id: "delivery-ready-descendant",
       expectedOk: true,