# Test — CI Image Tag Scheme & OCI Labels

**Task**: AZ-481_test_ci_image_labels
**Name**: CI image tag `${branch}-arm` + OCI labels + revision label
**Description**: Implement the 3 blackbox tests pinning the CI-produced image surface: tag scheme is `${branch}-arm` (NFT-RES-LIM-11), required OCI labels are present (NFT-RES-LIM-12), and the `org.opencontainers.image.revision` label equals `$CI_COMMIT_SHA` (NFT-RES-LIM-13).
**Complexity**: 2 points
**Dependencies**: AZ-456_test_infrastructure
**Component**: 00_foundation (CI/CD) (Blackbox Tests)
**Tracker**: AZ-481
**Epic**: AZ-455

## Problem

Without a tag canary, two builds on the same branch can overwrite each other silently (no `-arm` suffix); without OCI labels, the image is not traceable to a source revision. Both regressions are operationally catastrophic and surface only after a deploy.

## Outcome

- 3 scenarios pass.

## Scope

### Included

| Scenario | Profile | Source file |
|----------|---------|-------------|
| NFT-RES-LIM-11 — CI image tag scheme is `${branch}-arm` | static (CI config) + e2e (against pushed image) | resource-limit-tests.md |
| NFT-RES-LIM-12 — OCI labels present on the pushed image | static + e2e | resource-limit-tests.md |
| NFT-RES-LIM-13 — Revision label equals `$CI_COMMIT_SHA` | e2e | resource-limit-tests.md |

### Excluded

- nginx route / image-base assertions (covered in 25_test_prod_image_nginx_ram).

## Acceptance Criteria

**AC-1: Tag scheme**
NFT-RES-LIM-11 — CI config (`.gitlab-ci.yml` / equivalent) builds with tag pattern `${CI_COMMIT_REF_SLUG}-arm`; the static check asserts the pattern is intact. E2e additionally asserts `docker manifest inspect $REGISTRY/$IMAGE:${BRANCH}-arm` succeeds.

**AC-2: OCI labels present**
NFT-RES-LIM-12 — `docker inspect $IMAGE` reports the required OCI labels: `org.opencontainers.image.source`, `org.opencontainers.image.revision`, `org.opencontainers.image.title`, `org.opencontainers.image.created` — all non-empty.

**AC-3: Revision binding**
NFT-RES-LIM-13 — `docker inspect --format='{{index .Config.Labels "org.opencontainers.image.revision"}}'` returns exactly `$CI_COMMIT_SHA`.

## System Under Test Boundary

- System under test: CI config (`.gitlab-ci.yml` / equivalent) + the pushed image's metadata.
- Allowed stubs: a tag fixture for static-mode validation; in e2e the test inspects an actual locally-built image.
- Disallowed: bypassing CI to inject labels for the test.

## Constraints

- E2e tests run only on CI; locally `bun run test:e2e -- --skip-tags @requires-ci` skips them.
- CI environment provides `CI_COMMIT_SHA` and `CI_COMMIT_REF_SLUG`.
