refactor: add adm-controller prefix to built container image refs

Update all references to the 3 container images built by this repository
to use the new adm-controller path prefix, matching the images published
by CI with repository-prefix: adm-controller:

  ghcr.io/kubewarden/controller  → ghcr.io/kubewarden/adm-controller/controller
  ghcr.io/kubewarden/audit-scanner → ghcr.io/kubewarden/adm-controller/audit-scanner
  ghcr.io/kubewarden/policy-server → ghcr.io/kubewarden/adm-controller/policy-server

Policy and test images (ghcr.io/kubewarden/policies/*, tests/*) are not
built here and are left unchanged.

Assisted-by: Github Copilot
Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>

Author: jvanz

Makefile

@@ -13,7 +13,7 @@ GO_BUILD_ENV := CGO_ENABLED=0 GOOS=linux GOARCH=amd64
 ENVTEST_DIR ?= $(shell pwd)/.envtest
 
 REGISTRY ?= ghcr.io
-REPO ?= kubewarden
+REPO ?= kubewarden/adm-controller
 TAG ?= dev
 
 # Detect architecture for Rust builds

README.md

@@ -75,7 +75,7 @@ To verify the attestation manifest and its layer signatures:
 ```shell
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:1abc0944378d9f3ee2963123fe84d045248d320d76325f4c2d4eb201304d4c4e
+    ghcr.io/kubewarden/adm-controller/controller@sha256:1abc0944378d9f3ee2963123fe84d045248d320d76325f4c2d4eb201304d4c4e
 ```
 
 > [!NOTE]
@@ -89,7 +89,7 @@ like `crane`. For example, the following command will show you all the
 attestation manifests of the `latest` tag:
 
 ```shell
-crane manifest  ghcr.io/kubewarden/controller:latest | jq '.manifests[] | select(.annotations["vnd.docker.reference.type"]=="attestation-manifest")'
+crane manifest  ghcr.io/kubewarden/adm-controller/controller:latest | jq '.manifests[] | select(.annotations["vnd.docker.reference.type"]=="attestation-manifest")'
 {
   "mediaType": "application/vnd.oci.image.manifest.v1+json",
   "digest": "sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8",
@@ -124,9 +124,9 @@ layers signatures.
 ```shell
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
+    ghcr.io/kubewarden/adm-controller/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
 
-crane manifest  ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
+crane manifest  ghcr.io/kubewarden/adm-controller/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
 {
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.manifest.v1+json",
@@ -181,7 +181,7 @@ crane manifest  ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6
 
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:594da3e8bd8c6ee2682b0db35857933f9558fd98ec092344a6c1e31398082f4d
+    ghcr.io/kubewarden/adm-controller/controller@sha256:594da3e8bd8c6ee2682b0db35857933f9558fd98ec092344a6c1e31398082f4d
 ```
 
 Note that each attestation manifest (for each architecture) has its own layers.
@@ -190,7 +190,7 @@ Buildx during the multi stage build process. You can also use `crane` to
 download the attestation file:
 
 ```shell
-crane blob ghcr.io/kubewarden/controller@sha256:7738d8d506c6482aaaef1d22ed920468ffaf4975afd28f49bb50dba2c20bf2ca
+crane blob ghcr.io/kubewarden/adm-controller/controller@sha256:7738d8d506c6482aaaef1d22ed920468ffaf4975afd28f49bb50dba2c20bf2ca
 ```
 
 ## Security disclosure

api/policies/v1/factories.go

@@ -15,7 +15,7 @@ import (
 
 const (
 	integrationTestsFinalizer          = "kubewarden.io/integration-tests-safety-net-finalizer"
-	defaultKubewardenRepository        = "ghcr.io/kubewarden/policy-server"
+	defaultKubewardenRepository        = "ghcr.io/kubewarden/adm-controller/policy-server"
 	maxNameSuffixLength                = 8
 	defaultPolicyGroupRejectionMessage = "policy group default rejection message"
 )

charts/hauler_manifest.yaml

@@ -12,11 +12,11 @@ metadata:
     hauler.dev/certificate-oidc-issuer: https://token.actions.githubusercontent.com
 spec:
   images:
-    - name: ghcr.io/kubewarden/audit-scanner:v1.35.0
+    - name: ghcr.io/kubewarden/adm-controller/audit-scanner:v1.35.0
       certificate-identity-regexp: https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags/v1.35.0
-    - name: ghcr.io/kubewarden/controller:v1.35.0
+    - name: ghcr.io/kubewarden/adm-controller/controller:v1.35.0
       certificate-identity-regexp: https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags/v1.35.0
-    - name: ghcr.io/kubewarden/policy-server:v1.35.0
+    - name: ghcr.io/kubewarden/adm-controller/policy-server:v1.35.0
       certificate-identity-regexp: https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags/v1.35.0
 ---
 # The policies are in a separated definition just to allow a better keyless validation

charts/kubewarden-controller/README.md

@@ -75,7 +75,7 @@ To verify the attestation manifest and its layer signatures:
 ```shell
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:1abc0944378d9f3ee2963123fe84d045248d320d76325f4c2d4eb201304d4c4e
+    ghcr.io/kubewarden/adm-controller/controller@sha256:1abc0944378d9f3ee2963123fe84d045248d320d76325f4c2d4eb201304d4c4e
 ```
 
 > [!NOTE]
@@ -89,7 +89,7 @@ like `crane`. For example, the following command will show you all the
 attestation manifests of the `latest` tag:
 
 ```shell
-crane manifest  ghcr.io/kubewarden/controller:latest | jq '.manifests[] | select(.annotations["vnd.docker.reference.type"]=="attestation-manifest")'
+crane manifest  ghcr.io/kubewarden/adm-controller/controller:latest | jq '.manifests[] | select(.annotations["vnd.docker.reference.type"]=="attestation-manifest")'
 {
   "mediaType": "application/vnd.oci.image.manifest.v1+json",
   "digest": "sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8",
@@ -124,9 +124,9 @@ layers signatures.
 ```shell
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
+    ghcr.io/kubewarden/adm-controller/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
 
-crane manifest  ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
+crane manifest  ghcr.io/kubewarden/adm-controller/controller@sha256:fc01fa6c82cffeffd23b737c7e6b153357d1e499295818dad0c7d207f64e6ee8
 {
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.manifest.v1+json",
@@ -181,7 +181,7 @@ crane manifest  ghcr.io/kubewarden/controller@sha256:fc01fa6c82cffeffd23b737c7e6
 
 cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
     --certificate-identity="https://github.com/kubewarden/adm-controller/.github/workflows/attestation.yml@<TAG TO VERIFY>" \
-    ghcr.io/kubewarden/controller@sha256:594da3e8bd8c6ee2682b0db35857933f9558fd98ec092344a6c1e31398082f4d
+    ghcr.io/kubewarden/adm-controller/controller@sha256:594da3e8bd8c6ee2682b0db35857933f9558fd98ec092344a6c1e31398082f4d
 ```
 
 Note that each attestation manifest (for each architecture) has its own layers.
@@ -190,7 +190,7 @@ Buildx during the multi stage build process. You can also use `crane` to
 download the attestation file:
 
 ```shell
-crane blob ghcr.io/kubewarden/controller@sha256:7738d8d506c6482aaaef1d22ed920468ffaf4975afd28f49bb50dba2c20bf2ca
+crane blob ghcr.io/kubewarden/adm-controller/controller@sha256:7738d8d506c6482aaaef1d22ed920468ffaf4975afd28f49bb50dba2c20bf2ca
 ```
 
 ## Security disclosure

charts/kubewarden-controller/values.yaml

@@ -217,7 +217,7 @@ telemetry:
 image:
   # The registry is defined in the global.cattle.systemDefaultRegistry value
   # controller image to be used
-  repository: "kubewarden/controller"
+  repository: "kubewarden/adm-controller/controller"
   # image tag
   tag: v1.35.0
   pullPolicy: IfNotPresent
@@ -295,7 +295,7 @@ auditScanner:
   image:
     # The registry is defined in the common.cattle.systemDefaultRegistry value
     # kubectl image to be used in the pre-delete helm hook
-    repository: "kubewarden/audit-scanner"
+    repository: "kubewarden/adm-controller/audit-scanner"
     tag: v1.35.0
     pullPolicy: IfNotPresent
   cronJob:

e2e/main_test.go

@@ -24,9 +24,9 @@ var (
 	testenv           env.Environment
 	kindClusterName   string
 	namespace         = "kubewarden"
-	controllerImage   = "ghcr.io/kubewarden/controller:dev"
-	auditScannerImage = "ghcr.io/kubewarden/audit-scanner:dev"
-	policyServerImage = "ghcr.io/kubewarden/policy-server:dev"
+	controllerImage   = "ghcr.io/kubewarden/adm-controller/controller:dev"
+	auditScannerImage = "ghcr.io/kubewarden/adm-controller/audit-scanner:dev"
+	policyServerImage = "ghcr.io/kubewarden/adm-controller/policy-server:dev"
 )
 
 func TestMain(m *testing.M) {

scripts/test-sigstore-e2e.sh

@@ -29,7 +29,7 @@
 #                         configuration. Skips policy deployment and webhook evaluation.
 #   --policy-server-image Full image reference (repository:tag) for the policy-server.
 #                         Overrides the default image in charts/kubewarden-defaults.
-#                         Example: --policy-server-image ghcr.io/kubewarden/policy-server:dev
+#                         Example: --policy-server-image ghcr.io/kubewarden/adm-controller/policy-server:dev
 #
 # Tools required (per stage):
 #   All stages:  kubectl, jq

updatecli/values/artifacts.yaml

@@ -13,17 +13,17 @@ ociArtifacts:
   # image defined in the release process
   - file: "charts/kubewarden-controller/values.yaml"
     key: "$.image.tag"
-    image: "ghcr.io/kubewarden/controller"
+    image: "ghcr.io/kubewarden/adm-controller/controller"
     workflowUrl: "https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags"
     skipVersionFromRegistry: true
   - file: "charts/kubewarden-controller/values.yaml"
     key: "$.auditScanner.image.tag"
-    image: "ghcr.io/kubewarden/audit-scanner"
+    image: "ghcr.io/kubewarden/adm-controller/audit-scanner"
     workflowUrl: "https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags"
     skipVersionFromRegistry: true
   - file: "charts/kubewarden-defaults/values.yaml"
     key: "$.policyServer.image.tag"
-    image: "ghcr.io/kubewarden/policy-server"
+    image: "ghcr.io/kubewarden/adm-controller/policy-server"
     workflowUrl: "https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags"
     skipVersionFromRegistry: true
   # Policies
@@ -75,15 +75,15 @@ kubewardenContainerImage:
   - name: "controller"
     file: "charts/kubewarden-controller/values.yaml"
     key: "$.image.tag"
-    image: "ghcr.io/kubewarden/controller"
+    image: "ghcr.io/kubewarden/adm-controller/controller"
     workflowUrl: "https://github.com/kubewarden/adm-controller/.github/workflows/release.yml@refs/tags"
   - name: "auditScanner"
     file: "charts/kubewarden-controller/values.yaml"
     key: "$.auditScanner.image.tag"
-    image: "ghcr.io/kubewarden/audit-scanner"
+    image: "ghcr.io/kubewarden/adm-controller/audit-scanner"
     workflowUrl: "https://github.com/kubewarden/audit-scanner/.github/workflows/release.yml@refs/tags"
   - name: "policyServer"
     file: "charts/kubewarden-defaults/values.yaml"
     key: "$.policyServer.image.tag"
-    image: "ghcr.io/kubewarden/policy-server"
+    image: "ghcr.io/kubewarden/adm-controller/policy-server"
     workflowUrl: "https://github.com/kubewarden/policy-server/.github/workflows/release.yml@refs/tags"