[SushaanthSrinivasan]

Description

Why is this change being made?

1. Checks, the way a customer pulls, that every public alias tag serves the tested image after the release moves it. The job has no way to get AWS credentials, so a pass means the aliases really are public.

What is changing?

1. verify-alias-tags job in release.yml (new), after build, publish-version-tags and publish-alias-tags:
   • Has no id-token permission, no environment and no secrets, the same as verify-image. Its only actions are harden-runner and checkout, with persist-credentials: false.
   • Sets AWS_EC2_METADATA_DISABLED: 'true' on the check step.
   • Uses contents: read, a 15 minute timeout, the repo guard, and ubuntu-24.04.
   • The re-run guide in the header now covers this job: it only reads and needs no approval, so re-run it alone, unless it said an alias is on another image.
2. verify-public-image.sh alias-tags (new command):
   • Uses the same anonymous token, credential refusal, pacing and 10 minute limit as version-tags.
   • Checks ALIAS_TAGS is the six alias tags, latest last, with the rehearsal-<run id>- prefix on a practice run.
   • Checks again the list of digests the aliases pointed to before this run (publish-alias-tags' previousDigests output): a JSON list of null or sha256:<64 hex> entries, none of them the tested digest.
   • Reads each alias's digest header until it shows the tested digest. An alias that is not found, or on one of the listed digests, is read again with the same retry budget. Any other digest stops the check at once and names both digests.
3. Tests: the no-credentials test now covers both read-only jobs. New tests check the job's needs, permissions and inputs, and the new command's pass, retry, fail-closed, stop and bad-input paths.

Only the digest header is read for each alias. verify-image already checked the index and every image behind that digest.

The retry budget is the one version-tags uses: up to 8 reads per alias, pausing 2, 4, 8, 16, 30, 30 and 30 seconds.

GitHub settings

1. None. The job uses no environment and no secrets.

Related Links

• Issue #, if available: N/A
• Stacked on ci: test the public image and point the alias tags at it in the release #697.

---

Testing

How was this tested?

1. ShellCheck: clean, including the test fakes.
2. bats-core 1.13.0: all tests pass, including the new verify-public-image.bats and release-yaml.bats tests.
3. zizmor: no findings on release.yml. actionlint: no new complaints.
4. The script also runs under bash 3.2.

When testing locally, provide testing artifact(s):

1. See above.

---

Reviewee Checklist

Update the checklist after submitting the PR

• I have reviewed, tested and understand all changes
  If not, why:
• I have filled out the Description and Testing sections above
  If not, why:
• Build and Unit tests are passing
  If not, why: waiting on CI for this PR
• Unit test coverage check is passing
  If not, why: no Go code changes
• Integration tests pass locally
  If not, why: the new job runs only in the Release workflow; it will be tried with a practice run
• I have updated integration tests (if needed)
  If not, why:
• I have ensured no sensitive information is leaking (i.e., no logging of sensitive fields, or otherwise)
  If not, why:
• I have added explanatory comments for complex logic, new classes/methods and new tests
  If not, why:
• I have updated README/documentation (if needed)
  If not, why: not needed; nothing user facing changes
• I have clearly called out breaking changes (if any)
  If not, why: none

---

Reviewer Checklist

All reviewers please ensure the following are true before reviewing:

• Reviewee checklist has been accurately filled out
• Code changes align with stated purpose in description
• Test coverage adequately validates the changes

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.62%. Comparing base (1780eb5) to head (d76f47f).

Additional details and impacted files

@@                  Coverage Diff                   @@
##           ci/release-alias-tags     #698   +/-   ##
======================================================
  Coverage                  61.62%   61.62%           
======================================================
  Files                         11       11           
  Lines                        740      740           
======================================================
  Hits                         456      456           
  Misses                       265      265           
  Partials                      19       19           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.