From d5a29840172a53729c5999832534de65b7ba9587 Mon Sep 17 00:00:00 2001
From: "H.E. Pennypacker" <115990865+pennypacker-he@users.noreply.github.com>
Date: Fri, 17 Jul 2026 16:47:46 +0000
Subject: [PATCH] [patch] Validate GAR cleanup repositories

---
 .github/workflows/build-push.yaml     |  2 +-
 ci/github/build_push_contract_test.go | 34 +++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-push.yaml b/.github/workflows/build-push.yaml
index 1ab660b..0619437 100644
--- a/.github/workflows/build-push.yaml
+++ b/.github/workflows/build-push.yaml
@@ -1009,7 +1009,7 @@ jobs:
             *) primary_kind=unsupported ;;
           esac
           if [[ -n "$ADDITIONAL_GAR_REGISTRY" &&
-                ! "$ADDITIONAL_GAR_REGISTRY" =~ ^[A-Za-z0-9-]+-docker\\.pkg\\.dev/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]]; then
+                ! "$ADDITIONAL_GAR_REGISTRY" =~ ^[A-Za-z0-9-]+-docker\.pkg\.dev/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]]; then
             echo "Cleanup additional registry must be a GAR Docker repository prefix" >&2
             exit 1
           fi
diff --git a/ci/github/build_push_contract_test.go b/ci/github/build_push_contract_test.go
index 7e4277c..5bbb308 100644
--- a/ci/github/build_push_contract_test.go
+++ b/ci/github/build_push_contract_test.go
@@ -440,6 +440,40 @@ printf '%s' "${FAKE_CURL_STATUS:-200}"
 	}
 }
 
+func TestCleanupScopeAcceptsGARRepositoryPrefix(t *testing.T) {
+	workflow := workflowSource(t)
+	cleanup := workflow[strings.Index(workflow, "  cleanup:\n"):]
+	scope := stepBlock(t, cleanup, "      - name: Resolve successful publication cleanup scope\n", "      - name: Authenticate GAR for exact tag cleanup\n")
+	testDir := t.TempDir()
+	scriptPath := filepath.Join(testDir, "cleanup-scope.sh")
+	if err := os.WriteFile(scriptPath, []byte(workflowRunScript(t, scope)), 0700); err != nil {
+		t.Fatal(err)
+	}
+	outputPath := filepath.Join(testDir, "github-output")
+	cmd := exec.Command("bash", scriptPath) // #nosec G204 -- fixed repository-owned script.
+	cmd.Env = append(os.Environ(),
+		"ADDITIONAL_GAR_REGISTRY=us-docker.pkg.dev/example-project/public",
+		"ADDITIONAL_IMAGE_NAMES=[]",
+		"DERIVED_TAG=main",
+		"GITHUB_OUTPUT="+outputPath,
+		"GITHUB_REPOSITORY=libops/example",
+		"GITHUB_RUN_ID=12345",
+		"PRIMARY_IMAGE=ghcr.io/libops/example",
+		"PRIMARY_REGISTRY=ghcr.io/libops",
+		"TAG_OVERRIDE=",
+	)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("valid GAR cleanup scope failed: %v\n%s", err, output)
+	}
+	outputs, err := os.ReadFile(outputPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(outputs), "primary-kind=ghcr\n") {
+		t.Fatalf("cleanup scope outputs = %q, want primary-kind=ghcr", outputs)
+	}
+}
+
 func TestAliasesFanOutOneVerifiedBuild(t *testing.T) {
 	workflow := workflowSource(t)
 	inputs := stepBlock(t, workflow, "      additional-image-names:\n", "      scan:\n")