Merge active ECR manifest capture fix (#117)

Author: alexeygrigorev

core/tests/test_deployment_workflow.py

@@ -5775,6 +5775,141 @@ def test_active_image_proof_binds_full_sha_tag_to_exact_digest(self) -> None:
         with self.assertRaisesMessage(ReleaseContractError, "source SHA tag"):
             gateway.verify_image_digest_exists(identity)
 
+    def test_active_image_proof_uses_exact_sha_fallback_for_manifest_lookup(self) -> None:
+        gateway = self.gateway(FakeMigrationEcs({}, {}))
+        gateway.ecr = Mock()
+        source_sha = "a" * 40
+        image_digest = f"sha256:{'a' * 64}"
+        identity = ReleaseIdentity(
+            source_sha,
+            image_digest,
+            ECR_REPOSITORY_URI,
+            f"20260809-143205-{source_sha[:7]}",
+        )
+        gateway.ecr.describe_images.side_effect = [
+            {"imageDetails": [{"imageDigest": image_digest}]},
+            {"imageDetails": [{"imageDigest": image_digest}]},
+            {"imageDetails": [{"imageDigest": image_digest}]},
+        ]
+        gateway.ecr.batch_get_image.side_effect = [
+            {
+                "failures": [{"failureCode": "ImageNotFound"}],
+                "images": [],
+            },
+            {
+                "failures": [],
+                "images": [
+                    {
+                        "imageId": {
+                            "imageDigest": image_digest,
+                            "imageTag": source_sha,
+                        },
+                        "imageManifest": "{}",
+                    }
+                ],
+            },
+        ]
+
+        gateway.verify_image_digest_exists(identity)
+
+        self.assertEqual(
+            [call.kwargs["imageIds"] for call in gateway.ecr.batch_get_image.call_args_list],
+            [
+                [{"imageDigest": image_digest}],
+                [{"imageTag": source_sha}],
+            ],
+        )
+
+    def test_active_image_manifest_fallback_remains_fail_closed(self) -> None:
+        source_sha = "a" * 40
+        image_digest = f"sha256:{'a' * 64}"
+        identity = ReleaseIdentity(
+            source_sha,
+            image_digest,
+            ECR_REPOSITORY_URI,
+            f"20260809-143205-{source_sha[:7]}",
+        )
+        malformed_failure_values: tuple[object, ...] = ({}, None, "", 0, False)
+        invalid_fallbacks = (
+            *(
+                {
+                    "failures": malformed_failures,
+                    "images": [
+                        {
+                            "imageId": {"imageDigest": image_digest},
+                            "imageManifest": "{}",
+                        }
+                    ],
+                }
+                for malformed_failures in malformed_failure_values
+            ),
+            {
+                "failures": [],
+                "images": [
+                    {
+                        "imageId": {"imageDigest": f"sha256:{'b' * 64}"},
+                        "imageManifest": "{}",
+                    }
+                ],
+            },
+            {
+                "failures": [{"failureCode": "ImageNotFound"}],
+                "images": [],
+            },
+            {
+                "failures": [],
+                "images": [{"imageId": {"imageDigest": image_digest}}],
+            },
+            {
+                "failures": [],
+                "images": [
+                    {
+                        "imageId": {"imageDigest": image_digest},
+                        "imageManifest": "   ",
+                    }
+                ],
+            },
+            {
+                "failures": [],
+                "images": [
+                    {
+                        "imageId": {"imageDigest": image_digest},
+                        "imageManifest": "{}",
+                    },
+                    {
+                        "imageId": {"imageDigest": image_digest},
+                        "imageManifest": "{}",
+                    },
+                ],
+            },
+        )
+        unusable_digest_lookup = {
+            "failures": [{"failureCode": "ImageNotFound"}],
+            "images": [],
+        }
+
+        for fallback in invalid_fallbacks:
+            gateway = self.gateway(FakeMigrationEcs({}, {}))
+            gateway.ecr = Mock()
+            gateway.ecr.describe_images.side_effect = [
+                {"imageDetails": [{"imageDigest": image_digest}]},
+                {"imageDetails": [{"imageDigest": image_digest}]},
+                {"imageDetails": [{"imageDigest": image_digest}]},
+            ]
+            gateway.ecr.batch_get_image.side_effect = [
+                unusable_digest_lookup,
+                fallback,
+            ]
+
+            with (
+                self.subTest(fallback=fallback),
+                self.assertRaisesMessage(
+                    ReleaseContractError,
+                    "active image manifest is missing",
+                ),
+            ):
+                gateway.verify_image_digest_exists(identity)
+
     def test_public_health_polls_until_exact_readiness_or_timeout(self) -> None:
         gateway = self.gateway(FakeMigrationEcs({}, {}))
         source_sha = "a" * 40

deploy/aws_gateway.py

@@ -500,15 +500,39 @@ def verify_image_digest_exists(self, identity: ReleaseIdentity) -> None:
             repositoryName=ECR_REPOSITORY_NAME,
             imageIds=[{"imageDigest": identity.image_digest}],
         )
-        images = manifest.get("images", [])
-        if (
-            manifest.get("failures")
-            or len(images) != 1
-            or images[0].get("imageId", {}).get("imageDigest") != identity.image_digest
-            or not images[0].get("imageManifest")
-        ):
+        if not self._contains_exact_image_manifest(manifest, identity.image_digest):
+            # ECR can describe an exact digest while declining that digest form in
+            # BatchGetImage. The already-proven immutable full-SHA tag is an equivalent
+            # lookup key only when the returned image still binds to the same digest.
+            manifest = self.ecr.batch_get_image(
+                repositoryName=ECR_REPOSITORY_NAME,
+                imageIds=[{"imageTag": identity.source_sha}],
+            )
+        if not self._contains_exact_image_manifest(manifest, identity.image_digest):
             raise ReleaseContractError("active image manifest is missing from development ECR")
 
+    @staticmethod
+    def _contains_exact_image_manifest(response: Any, expected_digest: str) -> bool:
+        if not isinstance(response, dict):
+            return False
+        failures = response.get("failures")
+        if not isinstance(failures, list) or failures:
+            return False
+        images = response.get("images")
+        if not isinstance(images, list) or len(images) != 1:
+            return False
+        image = images[0]
+        if not isinstance(image, dict):
+            return False
+        image_id = image.get("imageId")
+        manifest = image.get("imageManifest")
+        return bool(
+            isinstance(image_id, dict)
+            and image_id.get("imageDigest") == expected_digest
+            and isinstance(manifest, str)
+            and manifest.strip()
+        )
+
     def _stop_migration_and_prove_terminal(self, task_arn: str, reason: str) -> None:
         stop_error: Exception | None = None
         try: