From 678c68e29475379b9a92dc2cd67459bf581ee712 Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Tue, 31 Mar 2026 21:31:34 -0300
Subject: [PATCH] service: publish relative harbor artifact paths

---
 cmd/metis/remote_cmd.go      | 25 +++++++++++++++++--------
 cmd/metis/remote_cmd_test.go | 29 ++++++++++++++++-------------
 2 files changed, 33 insertions(+), 21 deletions(-)

diff --git a/cmd/metis/remote_cmd.go b/cmd/metis/remote_cmd.go
index f56d318..2824157 100644
--- a/cmd/metis/remote_cmd.go
+++ b/cmd/metis/remote_cmd.go
@@ -293,21 +293,30 @@ func orasLogin(registry, username, password string) error {
 }
 
 func orasPush(ref, imagePath, metadataPath string) error {
-	cmd := exec.Command("oras", orasPushArgs(ref, imagePath, metadataPath)...)
+	dir, args, err := orasPushInvocation(ref, imagePath, metadataPath)
+	if err != nil {
+		return err
+	}
+	cmd := exec.Command("oras", args...)
+	cmd.Dir = dir
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
 	}
 	return nil
 }
 
-func orasPushArgs(ref, imagePath, metadataPath string) []string {
-	return []string{
-		"push",
-		"--disable-path-validation",
-		ref,
-		fmt.Sprintf("%s:application/x-raw-disk-image", imagePath),
-		fmt.Sprintf("%s:application/json", metadataPath),
+func orasPushInvocation(ref, imagePath, metadataPath string) (string, []string, error) {
+	imageDir := filepath.Dir(imagePath)
+	metadataDir := filepath.Dir(metadataPath)
+	if imageDir != metadataDir {
+		return "", nil, fmt.Errorf("oras push requires artifacts in one directory: %s vs %s", imageDir, metadataDir)
 	}
+	return imageDir, []string{
+		"push",
+		ref,
+		fmt.Sprintf("%s:application/x-raw-disk-image", filepath.Base(imagePath)),
+		fmt.Sprintf("%s:application/json", filepath.Base(metadataPath)),
+	}, nil
 }
 
 func orasTag(ref string, tags ...string) error {
diff --git a/cmd/metis/remote_cmd_test.go b/cmd/metis/remote_cmd_test.go
index 1316050..1c40d85 100644
--- a/cmd/metis/remote_cmd_test.go
+++ b/cmd/metis/remote_cmd_test.go
@@ -2,24 +2,27 @@ package main
 
 import "testing"
 
-func TestOrasPushArgsAllowAbsoluteWorkspacePaths(t *testing.T) {
-	args := orasPushArgs("registry.bstein.dev/metis/titan-13:20260331t235724z", "/workspace/build/titan-13.img.xz", "/workspace/build/metadata.json")
-	if len(args) != 5 {
-		t.Fatalf("expected 5 args, got %d", len(args))
+func TestOrasPushInvocationUsesRelativeWorkspacePaths(t *testing.T) {
+	dir, args, err := orasPushInvocation("registry.bstein.dev/metis/titan-13:20260331t235724z", "/workspace/build/titan-13.img.xz", "/workspace/build/metadata.json")
+	if err != nil {
+		t.Fatalf("orasPushInvocation returned error: %v", err)
+	}
+	if dir != "/workspace/build" {
+		t.Fatalf("expected work dir /workspace/build, got %q", dir)
+	}
+	if len(args) != 4 {
+		t.Fatalf("expected 4 args, got %d", len(args))
 	}
 	if args[0] != "push" {
 		t.Fatalf("expected push verb, got %q", args[0])
 	}
-	if args[1] != "--disable-path-validation" {
-		t.Fatalf("expected --disable-path-validation, got %q", args[1])
+	if args[1] != "registry.bstein.dev/metis/titan-13:20260331t235724z" {
+		t.Fatalf("unexpected ref: %q", args[1])
 	}
-	if args[2] != "registry.bstein.dev/metis/titan-13:20260331t235724z" {
-		t.Fatalf("unexpected ref: %q", args[2])
+	if args[2] != "titan-13.img.xz:application/x-raw-disk-image" {
+		t.Fatalf("unexpected image arg: %q", args[2])
 	}
-	if args[3] != "/workspace/build/titan-13.img.xz:application/x-raw-disk-image" {
-		t.Fatalf("unexpected image arg: %q", args[3])
-	}
-	if args[4] != "/workspace/build/metadata.json:application/json" {
-		t.Fatalf("unexpected metadata arg: %q", args[4])
+	if args[3] != "metadata.json:application/json" {
+		t.Fatalf("unexpected metadata arg: %q", args[3])
 	}
 }