Emit ArtifactDeleted graph events on quarantine cleanup (closes #199)

[toddysm]

Completes #199 (part 2 — the emission companion to the merged #201).

What

The quarantine-cleanup path now records every removed artifact (the image and each referrer) in the supply-chain-graph as ArtifactDeleted, closing the loop with ArtifactPromoted on golden. (Schema + cssc_graph ingest for ArtifactDeleted already landed in #201.)

Changes

• delete-image: new deleted-json output — a JSON array of the artifacts actually removed ({digest, tag?} for the image + each referrer), emitted on every exit path (token-skip, version-not-found, success). Resolves the image digest once up front so the image entry is populated even without referrer deletion.
• New stage-deletion-events action: turns deleted-json into one ArtifactDeleted event per artifact (occurrence = the quarantine repo, reason: promoted); skips entries without a digest; content ids match cssc_graph.identity.content_id.
• All three promote workflows: after the delete step, stage deletion events into graph-events-del and upload as graph-events-del*. The generic record-graph-events collector (pattern: graph-events*, merge-multiple) commits them unchanged. (Added id: delete to the override workflow's delete step.)

Validation

• shellcheck clean on both action scripts.
• End-to-end mocked test of delete-image: deleted-json correctly lists the deleted referrer + the tagged image.
• stage-deletion-events mocked run: emits schema-valid ArtifactDeleted events (referrer + tagged image) with matching content ids.
• actionlint clean for the new steps (pre-existing info/style warnings in untouched jobs remain).
• Docs updated (event table + delete-image outputs).

Closes #199

[Copilot]

Pull request overview

This PR completes the “deletion emission” half of #199 by capturing which artifacts were actually removed during quarantine cleanup and emitting one ArtifactDeleted supply-chain-graph event per removed artifact, so the graph can record tombstones for both the promoted image and its referrers.

Changes:

• Extend delete-image to output deleted-json (a JSON array of removed {digest, tag?} entries) for downstream event staging.
• Add a new composite action stage-deletion-events that converts deleted-json into schema-aligned ArtifactDeleted event files (content-id compatible with cssc_graph.identity.content_id).
• Wire deletion event staging + artifact upload into the promote workflows after the quarantine delete step; update docs to reflect the new output/event kind.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/reference/workflow-actions.md	Documents the new delete-image deleted-json output.
docs/architecture/observability/supply-chain-graph.md	Updates the workflow→event mapping to include ArtifactDeleted for promote workflows.
.github/workflows/_promote-override.yml	Adds id: delete, stages deletion events, and uploads graph-events-del.
.github/workflows/_promote-from-quarantine.yml	Stages and uploads deletion events per matrix job (graph-events-del-*).
.github/workflows/_promote-from-quarantine-sbom.yml	Same as above for the SBOM variant.
.github/actions/stage-deletion-events/action.yml	New action to create per-artifact ArtifactDeleted event files from deleted-json.
.github/actions/delete-image/action.yml	Adds deleted-json output and records deleted referrers/image digest for event emission.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.