fix: repoint component images and consumer paths to this project

Andrew Dunnrequested to merge
fix/registry-repoint into master

What does this MR do?

Every hard-coded image reference for the analyzer and deployer containers, and every README example of how to include this component, pointed at gl-demo-ultimate-britchie2/uncle-sam/stig-analyzer -- the maintainer's original demo namespace, not this project.

The images are publicly pullable -- that's the actual defect, not a 404. An anonymous registry JWT (pull scope, no login) gets HTTP 200 on that namespace's stig-analyzer manifest; a negative control (a nonexistent repository path under the same namespace) returns 404, confirming the method. So consumers were never erroring on the container pull -- they were silently running images this project does not own, cannot rebuild, and controls no retention or cleanup policy for. The two projects build their images independently (separate .gitlab-ci.yml, separate pipelines), so nothing guarantees the demo namespace's images track this project's code. The byte-size delta between the two templates is only indirect evidence of that: the repository-files API shows the demo namespace's templates/stig-compliance-analysis.yml at 40504 bytes versus this project's 27019 bytes -- a template that has already materially diverged.

Separately, and by a different resolution mechanism (git ref, not registry pull), every README include: component: snippet used $CI_SERVER_FQDN/$CI_PROJECT_PATH/stig-compliance-analysis@1.0.7. $CI_PROJECT_PATH resolves to the consuming project at include time, not this one, so the snippet is "content not found" for any consumer copying it as-is. @1.0.7 also matches no ref here (tags are v-prefixed, v1.0.0-v1.0.6 only), and the Versioning section's @~1 example is a CI/CD Catalog-only ref format this project can't serve (cicd_catalog_enabled is false, zero Releases). The GKG smoke-test snippet hard-coded the demo namespace directly instead.

Two smaller residuals of the same class: the README's "Specific version" example set image_tag: v1.0.7 (a git tag from the upstream demo project, never an image tag here -- 404-verified against this registry), and both the README's Inputs table and the component template's own image_tag input description listed v1.0.0 as an example value, which is equally nonexistent as an image tag.

Fixes

  • Container images -- repointed to this project's own registry (confirmed present via the registry API):
    • templates/stig-compliance-analysis.yml -- all six image: lines.
    • stig_tools/generate_batch_pipeline.py -- the two images baked into the dynamically generated child pipeline used by the default parallel_mode.
    • README.md -- the documented "Image Path" under Technical Details.
  • Component-include paths -- repointed every snippet to the literal path (gitlab-com/public-sector/stig-analyzer) pinned at @master, since no tag yet carries this fix. Rewrote the Versioning section into one coherent note and called out tagging a new release as explicit follow-up work (recommending any existing tag today would point consumers back at the demo-namespace images).
  • Non-existent example image tags -- README "Specific version" example now uses a commit-sha tag (8a58c74b) with a note that the registry carries latest plus commit-sha tags only, until a release is cut. The README Inputs table and the template's image_tag input description both now read latest/commit-sha (dropped the v1.0.0 example).
  • STIGMAN_DEPLOYMENT.md -- the IAM trust-policy example hard-coded the demo namespace's project path in the OIDC sub condition. That value must be the consumer's own project path (their pipeline is what requests the token), not this project's, so it is now a placeholder (<YOUR_GROUP>/<YOUR_PROJECT>).
  • CHANGELOG.md -- corrected a pre-existing ### Documentation note in the same [Unreleased] section that still described the old @1.0.3/@~1/@main scheme this MR removes; left as-is it would have shipped self-contradicting release notes (release_to_catalog publishes CHANGELOG.md verbatim).

Verification

  • Registry API (GET /projects/:id/registry/repositories?tags=1 for gitlab-com/public-sector/stig-analyzer) confirms both stig-analyzer and stig-analyzer-deployer exist with latest plus two commit-sha tags (8a58c74b, f767e70b) -- matching every corrected reference.
  • Anonymous-JWT pull check against the old demo-namespace path (with a nonexistent-repo negative control) confirms those images are public, which is why this went unnoticed rather than erroring.
  • Direct manifest probe of image_tag: v1.0.7 and v1.0.0 against this project's registry returns 404 -- confirming those were never valid image tags here.
  • Template byte-size comparison (repository-files API) confirms the demo namespace's template has diverged from this project's (40504 vs 27019 bytes); the two projects' independent build pipelines mean no image-level guarantee follows from that number, only the direction of the risk.
  • No CI job in this pipeline exercises the template's image: references directly -- the test jobs build and run $CI_REGISTRY_IMAGE images, not the component template's hard-coded paths -- so this verification was done via the registry API rather than a pipeline run; a template lint/self-include job is future work.

Related issues

None filed yet -- follow-ups named here: tag a release from this project; add CI coverage that exercises the template's image references.

Documentation updates

  • README.md: "Image Path" (Technical Details), the GKG smoke-test include: snippet, all Quick Start / Usage Example include: snippets, the "Specific version" example's image_tag, the Inputs table, and the Versioning section (rewritten into one example plus one merged note on why no tag or @~1 is usable yet).
  • templates/stig-compliance-analysis.yml: the image_tag input description dropped the nonexistent v1.0.0 example.
  • STIGMAN_DEPLOYMENT.md: IAM trust-policy sub condition is now a consumer placeholder instead of this project's own path.

CHANGELOG.md updated

Yes -- new ### Fixed - Registry namespace mismatch entry added under [Unreleased], and the pre-existing ### Documentation note in the same section was corrected to match (it described a versioning scheme this MR removes).

  • README.md updated (if applicable)
  • CHANGELOG.md updated
  • Security documentation updated (if applicable) -- STIGMAN_DEPLOYMENT.md's IAM trust-policy example corrected
  • Usage examples added (for new features) -- N/A, no new features; existing examples fixed, not added
  • Pipeline passes -- not yet run (branch not pushed)

Merge request reports