refactor(ci): make docker image smoke tests table-driven

[sami-alajrami]

Summary

• Extracts the docker image smoke tests (previously one hand-written CI step pair per test) into scripts/docker-smoke-tests.sh, a table-driven runner where a new check is a test_* function plus one run_case line.
• Adds a smoke test for attest artifact on a directory artifact, alongside the existing list environments connectivity check.
• Kosli attestation reporting (kosli attest generic) stays visible in the workflow YAML, driven off a JSON results file the script writes.

Postmortem follow-up from kosli-dev/server#6508.

Test plan

• make lint
• CI run of .github/workflows/docker.yml on this branch passes, including the new attest artifact dir smoke test
• Confirm smoke-test attestation is reported to Kosli when report_to_kosli != none

🤖 Generated with Claude Code

[claude]

Claude finished @sami-alajrami's task in 4m 26s —— View job

---

Review of docker-smoke-test-refactor (latest push: 14e7b806)

• Gather context (diff, prior review threads)
• Static analysis
• Review scripts/docker-smoke-tests.sh
• Review .github/workflows/docker.yml
• Post findings

---

Static analysis

Check	Result
go build ./...	pass
go vet ./...	pass
go mod tidy diff	n/a — no Go files changed
Script executable bit	100755
shellcheck	not installed on the runner, and not wired into CI — reviewed by hand instead

---

Findings

1. Removing list-environments drops the only check that the shipped image can reach Kosli — inline

Dockerfile:23-25 is FROM scratch plus a single COPY of ca-certificates.crt. A scratch image has no trust store of its own, so if that COPY ever breaks, every TLS call from the released image fails — and nothing left in this suite would notice, because the sole remaining case is --dry-run and never opens a socket. The attestation is still named smoke-test but now attests strictly less than it does on main.

@pbeckham's "don't depend on the production web service" is the right instinct; removing the case is one way to satisfy it, but not the only one. Recording the case's outcome without letting it flip EXIT_CODE, or pointing it at a non-prod host, both keep the CA-bundle coverage without a prod blip failing the release. Your call — flagging it because it's a deliberate coverage trade-off, not an oversight.

2. requests.go:254 is already off by one — inline

The banner is logged at requests.go:255. This is @pbeckham's stale-line-number point demonstrating itself before merge; the surrounding prose works fine without the pointer.

3. The --api-token rationale was trimmed away, and the token now looks redundant — inline

PreRunE validates the token before --dry-run can short-circuit, so -e KOSLI_API_TOKEN is load-bearing. That exact removal broke CI once already (ddd7df3f) and now sits next to --dry-run with no explanation. Suggestion also fixes the missing space after # on line 64.

---

What's good here

The hardening across this PR's review rounds landed well, and the end state is genuinely hard to fool:

• Seed-then-flush (lines 101-112) is the right shape. Writing every case as not-run up front means a partially-executed run produces a file that reads as incomplete rather than as a clean pass — the postmortem's failure mode, closed properly rather than papered over.
• Asserting the dry-run banner is present (line 90) instead of asserting an error string is absent. Fails closed on a reword, a crash, or an early exit; the negative form silently fails open on all three.
• Every jq and every write has an explicit || exit — the correct discipline given set -e is deliberately off so all cases run.
• RESULTS_FILE hoisted to job-level env, removing the rename-desync hazard between the two steps.
• if: ${{ success() || failure() }} on the smoke step so a Snyk finding no longer masks the functional checks as a smoke-test failure.

EXIT_CODE accumulation is correctly done in the parent shell rather than a subshell, and local status=$? is properly split from the local output declaration — the usual exit-status-masking trap is avoided.

Findings 2 and 3 are small. Finding 1 is a scope decision worth a deliberate answer before merge.
· branch docker-smoke-test-refactor