feat(security): mirror Argo CD Redis

config/security/runtime-image-mirror-policy.json

@@ -144,6 +144,20 @@
         "container_kind": "init_container"
       }
     },
+    {
+      "asset_id": "runtime-image:argocd-redis",
+      "source_index_digest": "sha256:08ad0b1d280850169a790dba1393ff7a90aef951fc19632cf4d3ce4f78e679ba",
+      "platform_digest": "sha256:e499175dfb27569cd40010c2eee346113db95fdd0efc88ab9fd70a9e807f4542",
+      "target_registry_digest": "sha256:1e1de310669186e8a85a676ed5352f6078b09658ee578508f7608fe7beff78f0",
+      "push_ref": "registry.wooo.work/awoooi/runtime-mirror/redis:8.2.3-alpine-linux-amd64",
+      "runtime_ref": "192.168.0.110:5000/awoooi/runtime-mirror/redis@sha256:1e1de310669186e8a85a676ed5352f6078b09658ee578508f7608fe7beff78f0",
+      "workload": {
+        "kind": "deployment",
+        "namespace": "argocd",
+        "name": "argocd-redis",
+        "container": "redis"
+      }
+    },
     {
       "asset_id": "runtime-image:kured",
       "source_index_digest": "sha256:2c5d73bb4517a269def38a6cd54d34d82be81793bea9ff1bb35c6533515ad209",

scripts/security/tests/test_runtime_image_mirror_controller.py

@@ -52,7 +52,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
 
         self.assertEqual(policy.work_item_id, "AIA-P0-006-02A")
         self.assertEqual(policy.risk_level, "high")
-        self.assertEqual(len(policy.images), 13)
+        self.assertEqual(len(policy.images), 14)
         self.assertNotIn("github.com", raw)
         self.assertNotIn("ghcr.io", raw)
         self.assertIn('"external_pull_allowed": false', raw)
@@ -77,7 +77,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
             )
         )
         container_kinds = [image.workload.container_kind for image in policy.images]
-        self.assertEqual(container_kinds.count("container"), 10)
+        self.assertEqual(container_kinds.count("container"), 11)
         self.assertEqual(container_kinds.count("init_container"), 3)
 
     def test_policy_loads_and_validates_init_container_kind(self) -> None:
@@ -358,6 +358,33 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
         )
         self.assertTrue(image.runtime_ref.endswith("@" + image.target_registry_digest))
 
+    def test_argocd_redis_main_reuses_verified_staging_artifact(self) -> None:
+        policy = controller.load_policy(POLICY_PATH)
+        staging = next(
+            image
+            for image in controller.load_staging_policy(STAGING_POLICY_PATH).images
+            if image.asset_id == "runtime-image:redis-8.2.3-canary"
+        )
+        image = next(
+            image
+            for image in policy.images
+            if image.asset_id == "runtime-image:argocd-redis"
+        )
+
+        self.assertEqual(image.source_index_digest, staging.source_index_digest)
+        self.assertEqual(image.platform_digest, staging.platform_digest)
+        self.assertEqual(image.push_ref, staging.push_ref)
+        self.assertEqual(image.workload.kind, "deployment")
+        self.assertEqual(image.workload.namespace, "argocd")
+        self.assertEqual(image.workload.name, "argocd-redis")
+        self.assertEqual(image.workload.container, "redis")
+        self.assertEqual(image.workload.container_kind, "container")
+        self.assertEqual(
+            image.target_registry_digest,
+            "sha256:1e1de310669186e8a85a676ed5352f6078b09658ee578508f7608fe7beff78f0",
+        )
+        self.assertTrue(image.runtime_ref.endswith("@" + image.target_registry_digest))
+
     def test_policy_rejects_external_pull_and_mutable_runtime_ref(self) -> None:
         payload = json.loads(POLICY_PATH.read_text(encoding="utf-8"))
         with tempfile.TemporaryDirectory() as temp: