Add image tag command

[chruffins]

summary

Adds hypeman tag SOURCE TARGET for the local image-tag API in kernel/hypeman#453.

• Uses the generated hypeman-go Images.Tag method for the tag request.
• URL-escapes source references so repository paths work correctly.
• Keeps server errors, including missing and not-ready images, visible to callers.
• Bumps hypeman-go to v0.28.0.
• Makes one-argument hypeman push TARGET use a matching local Docker image when present, then fall back to a ready Hypeman image or Docker staging.
• Keeps hypeman push SOURCE TARGET for pushing a cached image to a different remote reference.

new UX

hypeman tag alpine:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1
hypeman push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1

The tag operation does not pull or reconvert image content. It creates a local alias through the server-side API. --format, --transform, and --debug continue to work with the command.

When push TARGET stages a local Docker image, the CLI waits for the server-side image record and readiness. It does not compare the Docker manifest digest with the Hypeman image digest because Hypeman conversion changes the manifest digest.

validation

• go test ./...
• smoke tested both hypeman and docker paths

Depends on the image tag API in kernel/hypeman#453.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 61d1aca. Configure here.}

[chruffins]

note on the raw client.Post in pkg/cmd/tag.go: it's a stopgap — hypeman-go v0.24.0 has no typed Images.Tag yet. once the tag API from kernel/hypeman#453 is generated into hypeman-go, switch handleTag to the typed method and drop the hand-rolled path (tracked with a TODO at the call site). nothing here blocks on that; the wire format won't change.

[sjmiller609]

bug

pkg/cmd/pushcmd.go:88-101 — when the same tag exists in Docker and Hypeman, the CLI can upload the Docker image but immediately reuse Hypeman’s old ready record. Smoke testing confirmed that the queued push used the old Hypeman digest instead of the newer Docker image.

reproduction: tag image A in Hypeman, assign the same tag to different image B in Docker, then run hypeman push --detach TAG. Inspect the push: its digest matches image A rather than image B.

inconsistent behavior

pkg/cmd/tag.go:30-34 — top-level hypeman tag accepts a tagless target and adds :latest, while hypeman image tag rejects the same input. Both commands should share one validation policy and implementation.

[chruffins]

switched it to require explicit tags across the board

[sjmiller609]

digest-staged push hangs

I reproduced this against the updated code:

hypeman tag image-a:latest registry.example.com/app:v1
docker tag image-b:latest registry.example.com/app:v1
hypeman push registry.example.com/app:v1

Expected:

upload image B → wait until ready → retag → push image B

Actual:

Staging local image registry.example.com/app:v1 in Hypeman...

Then the command hangs.

The upload succeeds, and Hypeman lists the temporary digest-named image as ready. However, Images.Get(stagedName) returns 404 Not Found. waitForImageRecord treats that as temporary and retries indefinitely, so the command never retags or pushes image B. My smoke test timed out after 120 seconds.

[chruffins]

steven — re-requesting review for 96b570f.

The edge cases that were failing and are now fixed:

• Docker and Hypeman had the same tag: hypeman push TARGET could reuse Hypeman's older ready record after Docker had been retagged with a newer image. Local images now stage under a content-derived temporary tag, so the wait is tied to the upload from this invocation.
• Digest-staged uploads: the Docker manifest digest used as a Hypeman digest reference could return 404 from Images.Get, leaving waitForImageRecord retrying indefinitely. Staging now uses a temporary tag, waits for that tag to become ready, then retags it to the requested target.
• Temporary state: the staging tag is removed after the final tag is created, while the final image remains available.
• Tagless targets: both hypeman tag and hypeman image tag now reject a target without an explicit tag instead of applying inconsistent :latest behavior.

I reproduced the same-tag update, cached-image fallback, tagless-target validation, and staging cleanup; all passed. go test ./... and CI are green.

[sjmiller609]

Thank you!