Merge branch 'main' into renovate/github.com-mark3labs-mcp-go-0.x

Author: rdimitrov

go.mod

@@ -36,6 +36,7 @@ require (
 	github.com/docker/cli v29.3.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.1 // indirect

go.sum

@@ -109,8 +109,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z
 github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
 github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4=
 github.com/go-chi/chi/v5 v5.2.4/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

oci/skills/store.go

@@ -10,6 +10,8 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
+	"os"
 	"path/filepath"
 
 	"github.com/adrg/xdg"
@@ -18,6 +20,8 @@ import (
 	"oras.land/oras-go/v2"
 	"oras.land/oras-go/v2/content/oci"
 	"oras.land/oras-go/v2/errdef"
+
+	"github.com/stacklok/toolhive-core/httperr"
 )
 
 // Store provides local OCI artifact storage backed by an OCI Image Layout.
@@ -129,6 +133,47 @@ func (s *Store) Tag(ctx context.Context, d digest.Digest, tag string) error {
 	return nil
 }
 
+// DeleteTag removes a tag from the store index without deleting the underlying blobs.
+func (s *Store) DeleteTag(ctx context.Context, tag string) error {
+	if err := s.inner.Untag(ctx, tag); err != nil {
+		if errors.Is(err, errdef.ErrNotFound) {
+			return httperr.WithCode(
+				fmt.Errorf("tag not found: %s: %w", tag, err),
+				http.StatusNotFound,
+			)
+		}
+		return fmt.Errorf("removing tag: %w", err)
+	}
+	return nil
+}
+
+// DeleteBuild removes a tag and, if no other tag shares the same digest,
+// deletes all associated blobs (config, layers, manifest, and index if applicable).
+// Use DeleteTag when tag-only removal is desired and blob cleanup is not needed.
+func (s *Store) DeleteBuild(ctx context.Context, tag string) error {
+	d, err := s.Resolve(ctx, tag)
+	if err != nil {
+		return httperr.WithCode(
+			fmt.Errorf("tag not found: %s: %w", tag, err),
+			http.StatusNotFound,
+		)
+	}
+
+	if err := s.DeleteTag(ctx, tag); err != nil {
+		return err
+	}
+
+	shared, err := s.isDigestReferenced(ctx, d)
+	if err != nil {
+		return fmt.Errorf("checking remaining references: %w", err)
+	}
+	if shared {
+		return nil
+	}
+
+	return s.deleteOrphanedBlobs(ctx, d)
+}
+
 // Resolve resolves a tag to a manifest digest.
 func (s *Store) Resolve(ctx context.Context, tag string) (digest.Digest, error) {
 	desc, err := s.inner.Resolve(ctx, tag)
@@ -208,3 +253,84 @@ func (s *Store) fetchContent(ctx context.Context, d digest.Digest) ([]byte, erro
 
 	return data, nil
 }
+
+// isDigestReferenced checks whether any remaining tag still resolves to d.
+func (s *Store) isDigestReferenced(ctx context.Context, d digest.Digest) (bool, error) {
+	tags, err := s.ListTags(ctx)
+	if err != nil {
+		return false, err
+	}
+	for _, tag := range tags {
+		resolved, err := s.Resolve(ctx, tag)
+		if err != nil {
+			continue
+		}
+		if resolved == d {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// deleteOrphanedBlobs removes all blobs reachable from d (index or manifest),
+// including d itself. Callers must ensure no remaining tag references d.
+func (s *Store) deleteOrphanedBlobs(ctx context.Context, d digest.Digest) error {
+	isIdx, err := s.IsIndex(ctx, d)
+	if err != nil {
+		return fmt.Errorf("inspecting orphaned digest: %w", err)
+	}
+
+	if isIdx {
+		idx, err := s.GetIndex(ctx, d)
+		if err != nil {
+			return fmt.Errorf("fetching orphaned index: %w", err)
+		}
+		for _, m := range idx.Manifests {
+			if err := s.deleteManifestBlobs(ctx, m.Digest); err != nil {
+				return err
+			}
+		}
+	} else {
+		if err := s.deleteManifestBlobs(ctx, d); err != nil {
+			return err
+		}
+		// deleteManifestBlobs already deletes d when it's a plain manifest.
+		return nil
+	}
+
+	return s.deleteBlob(d)
+}
+
+// deleteManifestBlobs fetches the manifest at d, deletes its config and layer
+// blobs, then deletes the manifest blob itself.
+func (s *Store) deleteManifestBlobs(ctx context.Context, d digest.Digest) error {
+	data, err := s.fetchContent(ctx, d)
+	if err != nil {
+		return fmt.Errorf("fetching manifest %s: %w", d, err)
+	}
+
+	var m ocispec.Manifest
+	if err := json.Unmarshal(data, &m); err != nil {
+		return fmt.Errorf("parsing manifest %s: %w", d, err)
+	}
+
+	if err := s.deleteBlob(m.Config.Digest); err != nil {
+		return err
+	}
+	for _, layer := range m.Layers {
+		if err := s.deleteBlob(layer.Digest); err != nil {
+			return err
+		}
+	}
+	return s.deleteBlob(d)
+}
+
+// deleteBlob removes the blob file for d from the local OCI layout.
+// A missing file is treated as success (idempotent).
+func (s *Store) deleteBlob(d digest.Digest) error {
+	path := filepath.Join(s.root, "blobs", d.Algorithm().String(), d.Encoded())
+	if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("deleting blob %s: %w", d, err)
+	}
+	return nil
+}