test: pull image from opencode

Author: jan-abel-inwt

.github/workflows/test-opencode.yml

@@ -6,7 +6,42 @@ on:
 jobs:
   probe:
     runs-on: ubuntu-latest
+    env:
+      REGISTRY: registry.opencode.de
+      GITLAB: https://gitlab.opencode.de
+      IMG: bundesdruckerei-gmbh/plain-images/alpine
+      TAG: "3.23"
+
     steps:
-      - run: curl -s https://ifconfig.co/json | jq '{country,asn,org}'   # wirklich US?
-      - run: dig +short registry.opencode.de                            # welche IP? (nach 23.06 = neue)
-      - run: docker pull registry.opencode.de/bundesdruckerei-gmbh/plain-images/alpine:3.23
+      - name: Egress-Standort bestätigen
+        continue-on-error: true
+        run: |
+          out=$(curl -fsS https://ipinfo.io/json) || { echo "ipinfo nicht erreichbar"; exit 0; }
+          echo "$out" | jq '{country, region, org}' || echo "$out"
+
+      - name: DNS-Auflösung der Registry
+        continue-on-error: true
+        run: |
+          getent hosts "$REGISTRY" || echo "Keine Auflösung für $REGISTRY"
+
+      - name: Registry erreichbar? (erwartet HTTP 401)
+        continue-on-error: true
+        run: |
+          code=$(curl -s -o /dev/null -w "%{http_code}" "https://$REGISTRY/v2/")
+          echo "GET /v2/ -> HTTP $code   (401 = erreichbar + Auth-Realm aktiv)"
+
+      - name: Manifest anonym prüfen (public + Tag vorhanden?)
+        continue-on-error: true
+        run: |
+          TOKEN=$(curl -fsS "$GITLAB/jwt/auth?service=container_registry&scope=repository:${IMG}:pull" | jq -r .token)
+          code=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: Bearer $TOKEN" \
+            -H "Accept: application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json" \
+            "https://$REGISTRY/v2/${IMG}/manifests/${TAG}")
+          echo "Manifest ${IMG}:${TAG} -> HTTP $code   (200 = anonym ziehbar)"
+
+      - name: Pull-Test (der eigentliche Beweis)
+        run: |
+          docker pull "$REGISTRY/$IMG:$TAG"
+          docker image inspect "$REGISTRY/$IMG:$TAG" \
+            --format 'OK: {{.Id}} ({{.Os}}/{{.Architecture}})'