fix(release): declare the inventory schema version the release gate requires (#1685)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

scripts/check-release-image-inventory.test.ts

@@ -9,6 +9,12 @@ await test("repository release builds are covered by the evidence inventory", ()
 	assert.deepEqual(validateInventory(inventory, workflow), []);
 });
 
+await test("the shipped inventory declares the schema version the release validator requires", () => {
+	const inventory: unknown = JSON.parse(readFileSync("security/release-images.json", "utf8"));
+	assert.ok(typeof inventory === "object" && inventory !== null && "schemaVersion" in inventory);
+	assert.equal(inventory.schemaVersion, 1);
+});
+
 await test("rejects missing and duplicate inventory entries", () => {
 	assert.deepEqual(
 		validateInventory({ images: ["server"], upstream: [] }, 'image-name: "hephaestus-build/new"'),

scripts/check-release-image-inventory.ts

@@ -58,6 +58,11 @@ if (import.meta.main) {
 		!Array.isArray(inventory.upstream)
 	)
 		throw new Error("malformed upstream image inventory");
+	// The release-time validator in verify-release-evidence.ts rejects an inventory
+	// without schemaVersion 1. Assert it here too, where every pull request runs:
+	// otherwise the mismatch only surfaces mid-release, after the tag is cut.
+	if (!("schemaVersion" in inventory) || inventory.schemaVersion !== 1)
+		throw new Error("release image inventory must declare schemaVersion 1");
 	const compose = [
 		"docker/compose.app.yaml",
 		"docker/compose.core.yaml",

security/release-images.json

@@ -1,5 +1,11 @@
 {
-	"images": ["webapp", "application-server", "agent-pi", "postgres"],
+	"schemaVersion": 1,
+	"images": [
+		"webapp",
+		"application-server",
+		"agent-pi",
+		"postgres"
+	],
 	"upstream": [
 		{
 			"name": "alpine",