Promote and delete referrers with the image (OCI 1.0 + 1.1)

[toddysm]

Implements the registry side of #198 (companion observability issue: #199).

Problem

• Standard promote used plain crane copy (no copy-referrers), so OCI referrers (acquisition provenance, SBOM, VEX, signatures) were not carried to golden.
• delete-image removed only the image tag's package version, leaving referrer manifests (OCI 1.1 untagged + OCI 1.0 sha256-* fallback) dangling in quarantine.

Changes

Copy — all three promote paths now copy referrers (oras cp -r, already in mirror-image, carries the index + child manifests + their referrers, preserving digests so subject links stay valid):

• _promote-from-quarantine.yml: copy-referrers: "true" on the promote step.
• _promote-override.yml: always copy referrers (was sbom-method-only).
• _promote-from-quarantine-sbom.yml: already true (unchanged).

Delete — delete-image removes the referrer closure before the image:

• Resolves the subject digest, enumerates the image index + each child manifest, and oras discovers referrers recursively (referrers-of-referrers, e.g. a signature on an SBOM).
• Deletes each OCI 1.1 referrer (untagged package version, matched by .name digest) and each OCI 1.0 sha256-<subject-digest> fallback index.
• Then deletes the image tag (unchanged last-tag→package fallback).
• New delete-referrers input (default true) and referrers-deleted output. Best-effort/idempotent; degrades to image-only when crane/oras aren't logged in (the promote jobs are).

Validation

• shellcheck clean on the delete-image script.
• Closure algorithm unit-tested with mocked crane/oras/versions: correctly collects index+child referrers and a referrer-of-referrer, resolves version ids, and computes fallback tags.
• actionlint clean for the edited steps (pre-existing info/style warnings in untouched jobs remain).
• Docs (workflow-actions.md) updated.

Not in this PR

• Per-artifact + deletion graph events (Emit supply-chain-graph events for all artifacts (image + referrers) and deletions #199) — separate slice.
• One-off GC of referrers left dangling by past promotions.

Refs #198

[Copilot]

Pull request overview

Extends the promotion and cleanup workflows so OCI referrers (OCI 1.0 + 1.1) move with promoted images and are cleaned up from quarantine when deleting an image tag, aligning registry behavior with #198.

Changes:

• Enable referrer-aware promotion in quarantine→golden paths by always copying referrers during image promotion.
• Enhance delete-image composite action to (optionally) delete the full referrer closure (including referrers-of-referrers) before deleting the image tag.
• Update workflow action reference docs to describe the new delete-referrers input and referrers-deleted output.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docs/reference/workflow-actions.md	Documents referrer-closure deletion behavior, new input, and new output.
.github/workflows/_promote-override.yml	Always sets copy-referrers=true so manual overrides also promote referrers.
.github/workflows/_promote-from-quarantine.yml	Passes copy-referrers: "true" to ensure referrers are copied during promotion.
.github/actions/delete-image/action.yml	Adds delete-referrers behavior and emits referrers-deleted output.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.