Fix Windows path handling for non-local storage drivers

[Copilot]

On Windows with S3 storage, filepath.Rel() fails when computing relative paths because S3 driver returns forward-slash paths (/) while filepath.Rel expects backslashes (\). This causes infinite loops in GetRepositories(), leading to memory exhaustion and CPU spikes during startup.

Changes

Added pathRel() helper method to ImageStore:

• Detects storage driver type at runtime
• Non-local drivers (S3, etc.): uses path package for consistent forward-slash handling
• Local storage: delegates to filepath.Rel for platform-native behavior

Updated 4 call sites in repository enumeration methods:

• GetNextRepositories()
• GetRepositories()
• GetNextRepository()
• GetAllDedupeReposCandidates()

Edge case handling:

• Equal paths return "."
• Basepath normalized with trailing slash to prevent false prefix matches (/foo vs /foobar)
• Invalid paths logged and skipped in dedupe operations

func (is *ImageStore) pathRel(basepath, targpath string) (string, error) {
    if is.storeDriver.Name() != storageConstants.LocalStorageDriverName {
        // S3, remote storage: use path package (forward slashes)
        basepath = path.Clean(basepath)
        targpath = path.Clean(targpath)
        
        if basepath == targpath {
            return ".", nil
        }
        
        if !strings.HasSuffix(basepath, "/") {
            basepath += "/"
        }
        
        if !strings.HasPrefix(targpath, basepath) {
            return "", fmt.Errorf("%w: path not under base", zerr.ErrBadConfig)
        }
        
        return strings.TrimPrefix(targpath, basepath), nil
    }
    
    // Local storage: platform-native
    return filepath.Rel(basepath, targpath)
}

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cel.dev
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

• cloud.google.com
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

• cuelabs.dev
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

• cuelang.org
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

• cyphar.com
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

• dario.cat
  • Triggering command: `/update-job-proxy /update-job-proxy e/spiffe.go t rg/toolchain@v0./home/REDACTED/go/pkg/mod/github.com/!data!dog/[email protected] -ato�� namodb.test t portcfg.link -errorsas -ifaceassert t gOrP8R2GzsKPP0hW-D -ato�� -bool posCandidates

I-D_FORTIFY_SOURCE=3 0.1-go1.25.0.lin-quiet -errorsas -ifaceassert t pkg/mod/golang.o_x031.c` (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.55%. Comparing base (0cac8a7) to head (b6f4793).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/storage/imagestore/imagestore.go	66.66%	5 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3709      +/-   ##
==========================================
- Coverage   91.60%   91.55%   -0.05%     
==========================================
  Files         186      186              
  Lines       26486    26509      +23     
==========================================
+ Hits        24262    24271       +9     
- Misses       1440     1448       +8     
- Partials      784      790       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.