fix(catalog): hygiene -- vale image input, phantom inputs, reference examples relocate (v4.0.0)

Three small catalog-hygiene fixes targeting v4.0.0.

1. vale gains an image input (empty-tag fix)

templates/vale/template.yml hardcoded image: ...ci-tools:$[[ component.version ]]. At a SHA-pinned include component.version is empty, producing ci-tools: -> "invalid reference format" (observed failing in the reference repo's vale job). Added an image input (snake_case, defaults to the catalog ci-tools at the consumer's catalog tag, overridable for a fork or :latest at SHA includes) and switched the job to image: $[[ inputs.image ]]. Same shape container / container-sign / registry-cleanup already use.

2. Removed phantom *-version README rows

README input tables documented inputs that are NOT declared in the corresponding template.yml spec.inputs (versions are pinned in-component, not consumer-overridable). Verified against each template's actual inputs, then removed:

  • container-attest/README.md: cosign-version
  • container-sbom/README.md: syft-version, cosign-version
  • container-manifest/README.md: cosign-version

All confirmed phantom (no *_version input exists in any form). None were real, so none were kept.

3. Relocated reference examples out of templates/

templates/reference/ is not a CI component (no template.yml); it holds Go/Rust reference implementations. git mv templates/reference examples/reference (history preserved as renames). Updated link sites:

  • templates/attest/README.md: ../reference/... -> ../../examples/reference/...
  • top-level README.md: templates/reference/... -> examples/reference/... (all four rows)

Repo-wide grep found one further mention, CHANGELOG.md under released v3.0.0 -- left as-is (historical record of the path at that release, not a live link).

Validation

  • python3 scripts/lint-templates.py: all 18 templates pass.
  • templates/vale/template.yml yaml-loads clean.

🤖 Generated with Claude Code

Merge request reports

Loading