feat(security): stage local path provisioner image

config/security/runtime-image-mirror-staging-policy.json

@@ -67,6 +67,19 @@
         "name": "metrics-server",
         "container": "metrics-server"
       }
+    },
+    {
+      "asset_id": "runtime-image:local-path-provisioner-0.0.34-canary",
+      "source_index_digest": "sha256:6ff68ebe98bc623b45ad22c28be84f8a08214982710f3247d5862e9bccce73ef",
+      "platform_digest": "sha256:90745b5457d61b84362ea2aeeb06caef4d576c99861eaff4c7bfe9b36e1cf8d7",
+      "source_config_digest": "sha256:acccaf97bcb578daff51c6246e47babbca6e998e4225aa230544684cf147d6c1",
+      "push_ref": "registry.wooo.work/awoooi/runtime-mirror/local-path-provisioner:v0.0.34-linux-amd64",
+      "workload": {
+        "kind": "deployment",
+        "namespace": "kube-system",
+        "name": "local-path-provisioner",
+        "container": "local-path-provisioner"
+      }
     }
   ]
 }

scripts/security/tests/test_runtime_image_mirror_controller.py

@@ -215,12 +215,13 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
 
         self.assertEqual(policy.work_item_id, "AIA-P0-006-02B")
         self.assertEqual(policy.risk_level, "high")
-        self.assertEqual(len(policy.images), 4)
+        self.assertEqual(len(policy.images), 5)
         by_asset = {image.asset_id: image for image in policy.images}
         self.assertEqual(
             set(by_asset),
             {
                 "runtime-image:argocd-v3.3.6-canary",
+                "runtime-image:local-path-provisioner-0.0.34-canary",
                 "runtime-image:metrics-server-0.8.1-canary",
                 "runtime-image:redis-8.2.3-canary",
                 "runtime-image:vpa-recommender-1.6.0-canary",
@@ -289,6 +290,28 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
         self.assertEqual(metrics.workload.name, "metrics-server")
         self.assertEqual(metrics.workload.container, "metrics-server")
         self.assertEqual(metrics.workload.container_kind, "container")
+
+        local_path = by_asset[
+            "runtime-image:local-path-provisioner-0.0.34-canary"
+        ]
+        self.assertEqual(
+            local_path.source_index_digest,
+            "sha256:6ff68ebe98bc623b45ad22c28be84f8a08214982710f3247d5862e9bccce73ef",
+        )
+        self.assertEqual(
+            local_path.platform_digest,
+            "sha256:90745b5457d61b84362ea2aeeb06caef4d576c99861eaff4c7bfe9b36e1cf8d7",
+        )
+        self.assertEqual(
+            local_path.source_config_digest,
+            "sha256:acccaf97bcb578daff51c6246e47babbca6e998e4225aa230544684cf147d6c1",
+        )
+        self.assertEqual(local_path.runtime_repository, "local-path-provisioner")
+        self.assertEqual(local_path.workload.kind, "deployment")
+        self.assertEqual(local_path.workload.namespace, "kube-system")
+        self.assertEqual(local_path.workload.name, "local-path-provisioner")
+        self.assertEqual(local_path.workload.container, "local-path-provisioner")
+        self.assertEqual(local_path.workload.container_kind, "container")
         self.assertNotIn("github.com", raw)
         self.assertNotIn("ghcr.io", raw)
         self.assertIn('"external_pull_allowed": false', raw)