service: allow oras pushes from runner workspaces

cmd/metis/remote_cmd.go

@@ -293,16 +293,23 @@ func orasLogin(registry, username, password string) error {
 }
 
 func orasPush(ref, imagePath, metadataPath string) error {
-	cmd := exec.Command("oras", "push", ref,
+	cmd := exec.Command("oras", orasPushArgs(ref, imagePath, metadataPath)...)
-		fmt.Sprintf("%s:application/x-raw-disk-image", imagePath),
-		fmt.Sprintf("%s:application/json", metadataPath),
-	)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
 	}
 	return nil
 }
 
+func orasPushArgs(ref, imagePath, metadataPath string) []string {
+	return []string{
+		"push",
+		"--disable-path-validation",
+		ref,
+		fmt.Sprintf("%s:application/x-raw-disk-image", imagePath),
+		fmt.Sprintf("%s:application/json", metadataPath),
+	}
+}
+
 func orasTag(ref string, tags ...string) error {
 	args := append([]string{"tag", ref}, tags...)
 	cmd := exec.Command("oras", args...)

cmd/metis/remote_cmd_test.go

@@ -0,0 +1,25 @@
+package main
+
+import "testing"
+
+func TestOrasPushArgsAllowAbsoluteWorkspacePaths(t *testing.T) {
+	args := orasPushArgs("registry.bstein.dev/metis/titan-13:20260331t235724z", "/workspace/build/titan-13.img.xz", "/workspace/build/metadata.json")
+	if len(args) != 5 {
+		t.Fatalf("expected 5 args, got %d", len(args))
+	}
+	if args[0] != "push" {
+		t.Fatalf("expected push verb, got %q", args[0])
+	}
+	if args[1] != "--disable-path-validation" {
+		t.Fatalf("expected --disable-path-validation, got %q", args[1])
+	}
+	if args[2] != "registry.bstein.dev/metis/titan-13:20260331t235724z" {
+		t.Fatalf("unexpected ref: %q", args[2])
+	}
+	if args[3] != "/workspace/build/titan-13.img.xz:application/x-raw-disk-image" {
+		t.Fatalf("unexpected image arg: %q", args[3])
+	}
+	if args[4] != "/workspace/build/metadata.json:application/json" {
+		t.Fatalf("unexpected metadata arg: %q", args[4])
+	}
+}