collect_refs scraped every @sha256 ref from the package values.yaml, including
third-party images (docker.io/clastix/kubectl, ghcr.io/kvaps/...), bare upstream
tags (kube-ovn/keycloak/kilo) and a "--migrate-image=..." arg string. The first
skopeo copy to a registry CI cannot push to aborted the whole promotion under
set -e, so stable promotion could not complete. Filter the canonical refs to
those under $REGISTRY (default ghcr.io/cozystack/cozystack, matching
common-envs.mk; overridable for forks). Also require skopeo only when not
--dry-run, so the selection is testable without it.
Add hack/promote-retag_test.bats: a --dry-run over the real packages tree must
emit only cozystack-owned refs (zero third-party), and a REGISTRY override that
matches nothing must fail rather than promote the wrong set.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Myasnikov Daniil
31ea4d4552