fix: strip OCI image tag when pushing attestation to registry

[bdehamer]

Summary

When a subject is discovered via $GITHUB_ARTIFACTS_LIST for an OCI image, the
name may include a :tag (e.g. ghcr.io/owner/app:v1). Pushing the
attestation to the registry via @sigstore/oci fails on such names because
parseImageName only accepts a bare registry/repository reference:

Invalid image name: ghcr.io/github/attest-demo:30468266162

Approach

The image tag is preserved in the attestation subject (it's meaningful
provenance) and stripped only at the registry-push boundary in attest.ts.
The subject digest already pins the exact image, so a bare reference is
sufficient for attaching/pushing the attestation.

• parseArtifactsList now records OCI subjects faithfully (tag preserved;
  downcaseOCI still applied for the push flow).
• stripOCITag is applied in createAttestation for getRegistryCredentials,
  attachArtifactToImage, getRegistryURL, and the storage record — so the
  signed attestation keeps …/app:v1 while the push targets …/app.
• Only a colon after the final / is treated as a tag, so a registry port
  (e.g. localhost:5000/repo) is preserved.

Testing

• Unit tests for stripOCITag (tag stripping, port preservation, no-op cases)
  and tag-preservation in parse output.
• Integration tests asserting the attestation subject retains the tag while the
  registry-push path and storage record receive the stripped name.
• Full suite green at 100% coverage; dist/ regenerated.

[Copilot]

Pull request overview

This PR fixes registry-push failures when an OCI subject discovered from $GITHUB_ARTIFACTS_LIST includes a :tag, by preserving the tag in the signed attestation subject while stripping it at the @sigstore/oci push boundary.

Changes:

• Add stripOCITag helper and use it in createAttestation for registry credentials lookup, registry URL derivation, artifact attachment, and storage record naming.
• Keep OCI tags in parseArtifactsList output (still optionally lowercased) so provenance subjects remain faithful.
• Add unit + integration tests and update fixtures; regenerate dist/.

Show a summary per file

File	Description
src/attest.ts	Strips :tag at registry-push/storage-record boundary while keeping the attestation subject unchanged.
src/artifacts.ts	Adds stripOCITag and documents tag preservation behavior for discovered OCI subjects.
tests/unit/artifacts.test.ts	Adds unit coverage for tag preservation and stripOCITag behavior.
tests/integration/attest.test.ts	Ensures tag is preserved in attestation subjects but stripped for registry push and storage record creation.
tests/fixtures/mocks.ts	Adds a tagged OCI subject fixture for integration tests.
dist/index.js	Updates bundled output to reflect source changes.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/6 changed files
• Comments generated: 2
• Review effort level: Low

[Copilot]

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0 new
• Review effort level: Low

[Copilot]

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 0 new
• Review effort level: Low