[Pages] Hold for missing public product records

Author: brandonpayton

abi/staging/request-policy.generated.json

@@ -1,6 +1,6 @@
 schema = 1
 kind = "kandelo-abi-staging-request-policy"
-version = 28
+version = 29
 issuer_repository = "Automattic/kandelo"
 issuer_workflow = ".github/workflows/abi-staging-request-feed.yml"
 automatic_same_repository = true

abi/staging/request-policy.toml

@@ -31,7 +31,7 @@ import {
   discoverCandidateProductAuthority,
   heldPagesReadinessRecord,
   immutableRecordReferencesFromTags,
-  isAbsentPublicAdmissionTagInventory,
+  isAbsentPublicPagesRecordTagInventory,
   isExpectedCurrentInputUnavailable,
   producePagesArtifacts,
   readCandidateProductAuthority,
@@ -55,11 +55,11 @@ const source = {
 };
 const targetAbi = { version: 18, snapshot_sha256: "3".repeat(64) };
 
-test("treats only an anonymously absent canonical admission repository as empty", () => {
+test("treats only anonymously absent Pages record repositories as empty", () => {
   const repository =
     "ghcr.io/kandelo-dev/homebrew-tap-core-abi-43/dash/admissions";
   assert.equal(
-    isAbsentPublicAdmissionTagInventory(
+    isAbsentPublicPagesRecordTagInventory(
       repository,
       new Error(
         "OCI tag inventory anonymous read failed: Error response from registry: " +
@@ -69,7 +69,17 @@ test("treats only an anonymously absent canonical admission repository as empty"
     true,
   );
   assert.equal(
-    isAbsentPublicAdmissionTagInventory(
+    isAbsentPublicPagesRecordTagInventory(
+      "ghcr.io/kandelo-dev/homebrew-tap-core-abi-43-candidates/products/browser-main-shell",
+      new Error(
+        "OCI tag inventory anonymous read failed: Error response from registry: " +
+        "denied: requested access to the resource is denied\n",
+      ),
+    ),
+    true,
+  );
+  assert.equal(
+    isAbsentPublicPagesRecordTagInventory(
       "ghcr.io/kandelo-dev/homebrew-tap-core-abi-43-candidates/dash",
       new Error(
         "OCI tag inventory anonymous read failed: Error response from registry: " +
@@ -79,7 +89,7 @@ test("treats only an anonymously absent canonical admission repository as empty"
     false,
   );
   assert.equal(
-    isAbsentPublicAdmissionTagInventory(
+    isAbsentPublicPagesRecordTagInventory(
       repository,
       new Error("OCI tag inventory anonymous read failed: request timed out"),
     ),

scripts/abi-staging-pages-producer.test.ts

@@ -1705,11 +1705,11 @@ function createAnonymousOciAuthority(): ProductionOciAuthority {
         ], MAX_DOCUMENT_BYTES, "OCI tag inventory");
       } catch (error) {
         // GHCR reports an as-yet-uncreated public nested package as `denied`,
-        // not as an empty tag inventory. For an exact admission repository,
+        // not as an empty tag inventory. For an exact Pages record repository,
         // anonymous inaccessibility means there is no publicly consumable
-        // admission. Preserve that as the normal hold-only state; manifest
-        // and blob reads remain exact and fail closed.
-        if (isAbsentPublicAdmissionTagInventory(repository, error)) return [];
+        // candidate or admission. Preserve that as the normal hold-only state;
+        // manifest and blob reads remain exact and fail closed.
+        if (isAbsentPublicPagesRecordTagInventory(repository, error)) return [];
         throw error;
       }
       const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(output));
@@ -1788,13 +1788,17 @@ function createAnonymousOciAuthority(): ProductionOciAuthority {
   };
 }
 
-export function isAbsentPublicAdmissionTagInventory(
+export function isAbsentPublicPagesRecordTagInventory(
   repository: string,
   error: unknown,
 ): boolean {
   return (
-    /^ghcr\.io\/kandelo-dev\/homebrew-tap-core-abi-[1-9][0-9]*\/[a-z0-9._-]+\/admissions$/u
-      .test(repository) &&
+    (
+      /^ghcr\.io\/kandelo-dev\/homebrew-tap-core-abi-[1-9][0-9]*\/[a-z0-9._-]+\/admissions$/u
+        .test(repository) ||
+      /^ghcr\.io\/kandelo-dev\/homebrew-tap-core-abi-[1-9][0-9]*-candidates\/products\/[a-z0-9._-]+$/u
+        .test(repository)
+    ) &&
     error instanceof Error &&
     /^OCI tag inventory anonymous read failed: Error response from registry: denied: requested access to the resource is denied\s*$/u
       .test(error.message)