feat: add Push and PushImage functions for OCI registry push

[rgarcia]

Summary

Add functions to push images to hypeman's OCI registry, mirroring the functionality of the hypeman push CLI command.

New Functions

lib/push.go

• PushImage(ctx, cfg, img, targetName) - Core function that pushes any v1.Image to hypeman. Works with images from:

  • Kaniko, ko, or buildpacks (CI/CD without Docker)
  • Remote registries via remote.Image()
  • Tarballs via tarball.ImageFromPath()
  • OCI layouts

• Push(ctx, cfg, sourceImage, targetName) - Convenience wrapper that loads from local Docker daemon (for development workflows)

• PushFromURL(ctx, baseURL, apiKey, img, targetName) - Standalone helper for scripts that don't need a full client

• ExtractPushConfig(opts) - Extracts registry host and API key from client options

Example Usage

client := hypeman.NewClient()
cfg, _ := lib.ExtractPushConfig(client.Options)

// Push from local Docker
lib.Push(ctx, cfg, "myapp:latest", "my-custom-name")

// Push image built with ko (no Docker)
img, _ := ko.Build(ctx, "github.com/myorg/myapp")
lib.PushImage(ctx, cfg, img, "myapp:latest")

Why lib/ Package?

The SDK is auto-generated from the OpenAPI spec, but the OCI registry endpoints aren't modeled in OpenAPI. Per CONTRIBUTING.md, manually-maintained code goes in lib/ which the generator won't overwrite.

Dependencies

Added github.com/google/go-containerregistry for OCI image handling.

[mesa-dot-dev]

Mesa Description

Summary

Add functions to push images to hypeman's OCI registry, mirroring the functionality of the hypeman push CLI command.

New Functions

lib/push.go

• PushImage(ctx, cfg, img, targetName) - Core function that pushes any v1.Image to hypeman. Works with images from:

  • Kaniko, ko, or buildpacks (CI/CD without Docker)
  • Remote registries via remote.Image()
  • Tarballs via tarball.ImageFromPath()
  • OCI layouts

• Push(ctx, cfg, sourceImage, targetName) - Convenience wrapper that loads from local Docker daemon (for development workflows)

• PushFromURL(ctx, baseURL, apiKey, img, targetName) - Standalone helper for scripts that don't need a full client

• ExtractPushConfig(opts) - Extracts registry host and API key from client options

Example Usage

client := hypeman.NewClient()
cfg, _ := lib.ExtractPushConfig(client.Options)

// Push from local Docker
lib.Push(ctx, cfg, "myapp:latest", "my-custom-name")

// Push image built with ko (no Docker)
img, _ := ko.Build(ctx, "github.com/myorg/myapp")
lib.PushImage(ctx, cfg, img, "myapp:latest")

Why lib/ Package?

The SDK is auto-generated from the OpenAPI spec, but the OCI registry endpoints aren't modeled in OpenAPI. Per CONTRIBUTING.md, manually-maintained code goes in lib/ which the generator won't overwrite.

Dependencies

Added github.com/google/go-containerregistry for OCI image handling.

^{Description generated by Mesa. Update settings}

[mesa-dot-dev]

Performed full review of 0e8d0f4...a884a3b

Analysis

1. Security Risk - Forced Insecure Communication: Implementation hardcodes name.Insecure option, forcing HTTP for all connections without allowing configuration for secure communication (HTTPS), creating a significant security vulnerability.

2. Authentication Failure Handling: Silent authentication failures occur when API keys are empty, returning empty AuthConfig objects rather than errors, making debugging difficult and potentially masking security issues.

3. Target Name Input Validation Issues: Missing validation allows registry-qualified names to create malformed references, while default name handling may include unwanted prefixes.

4. Excessive Dependencies: Integration adds ~40 transitive dependencies including Docker libraries and OpenTelemetry, increasing attack surface and security risk, alongside a potentially premature Go version bump to 1.24.0.

5. Configuration Coupling: The ExtractPushConfig function directly accesses internal request configuration, creating tight coupling to SDK internals that could break with future changes.

Tip

Help

Slash Commands:

• /review - Request a full code review
• /review latest - Review only changes since the last review
• /describe - Generate PR description. This will update the PR body or issue comment depending on your configuration
• /help - Get help with Mesa commands and configuration options

^{4 files reviewed | 0 comments | Edit Agent Settings • Read Docs}