Refuse prune apply when requested image inventories are unavailable
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 02:00:50 +02:00
parent 0349a08e1b
commit f637989a69
4 changed files with 58 additions and 4 deletions

View file

@ -82,6 +82,11 @@ merges complete, nonempty exports with the prior inventory under a writer lock,
then atomically publishes sorted image references and a count/hash receipt.
Set `LIVE_IMAGES_OUTPUT` when publishing for a different host user.
Missing, empty, or malformed input fails without replacing the previous file.
The prune CLI also refuses `--apply` before credential retrieval if any
explicit `--live-images-file` is missing, unreadable, empty, or comment-only.
Dry-run keeps reporting those files as warnings. This guard supplements the
activity-core worker guard; it does not require exports for callers that have
not configured any.
Refresh only adds protection: removal of obsolete tags requires a separate
review of every production cluster and rollback requirement.