feat: improve API keys and build workflows

tests/server/registry.test.ts

@@ -25,6 +25,59 @@ describe("OCI registry digest resolution", () => {
     ).toThrow("Invalid image reference");
   });
 
+  test("accepts distribution tags and digest-pinned references", () => {
+    for (const tag of [
+      "latest",
+      "v1.2.3",
+      "Release_2026-10",
+      "_build",
+      "a".repeat(128),
+    ]) {
+      expect(parseImageReference(`localhost:5000/team/my_image:${tag}`)).toEqual({
+        registry: "localhost:5000",
+        repository: "team/my_image",
+        reference: tag,
+      });
+    }
+    const digest = `sha256:${"a".repeat(64)}` as const;
+    expect(
+      parseImageReference(`registry.example.com/team/my-image:Release_1@${digest}`),
+    ).toEqual({
+      registry: "registry.example.com",
+      repository: "team/my-image",
+      reference: digest,
+      digest,
+    });
+    expect(
+      parseImageReference(`registry.example.com/team/my-image@${digest}`).digest,
+    ).toBe(digest);
+  });
+
+  test("rejects malformed tags and uppercase repository names", () => {
+    for (const tag of [
+      "bad+tag",
+      ".leading",
+      "-leading",
+      "bad:tag",
+      "bad@tag",
+      "bad/tag",
+      "é",
+      "a".repeat(129),
+      "",
+    ]) {
+      expect(() =>
+        parseImageReference(`registry.example.com/team/image:${tag}`),
+      ).toThrow();
+    }
+    expect(() =>
+      parseImageReference("registry.example.com/Team/image:Release_1"),
+    ).toThrow("Invalid image reference");
+    const digest = `sha256:${"a".repeat(64)}` as const;
+    expect(() =>
+      parseImageReference(`registry.example.com/team/image:bad+tag@${digest}`),
+    ).toThrow("Invalid image reference");
+  });
+
   test("resolves an anonymous manifest using the advertised digest", async () => {
     const expected = `sha256:${"b".repeat(64)}` as const;
     const calls: Array<{ url: string; authorization: string | null }> = [];