fix(ci): restore exact AI release evidence gates

backend/tests/test_rc6_supply_chain.py

@@ -54,9 +54,19 @@ def test_ci_runs_complete_release_and_supply_chain_gates() -> None:
         assert 'scan_container_image.sh "$IMAGE_ID"' in workflow
         assert "generate_container_sbom.sh" in workflow
         assert "scan_container_image.sh" in workflow
-        assert "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" in workflow
+        assert "GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar" in workflow
+        assert "Remove temporary image archive" in workflow
         assert context in workflow
 
+    assert (
+        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+        in read(".github/workflows/release-gates.yml")
+    )
+    assert (
+        "actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de"
+        in read(".gitea/workflows/release-gates.yml")
+    )
+
 
 def test_gitea_production_deploy_depends_on_every_release_gate() -> None:
     release = read(".gitea/workflows/release-gates.yml")
@@ -72,17 +82,25 @@ def test_gitea_production_deploy_depends_on_every_release_gate() -> None:
 
 
 def test_release_workflows_pin_third_party_actions_to_reviewed_commits() -> None:
-    expected = (
+    shared = (
         "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
         "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065",
         "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020",
-        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
     )
     for path in (".gitea/workflows/release-gates.yml", ".github/workflows/release-gates.yml"):
         workflow = read(path)
-        for action in expected:
+        for action in shared:
             assert action in workflow
 
+    assert (
+        "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+        in read(".github/workflows/release-gates.yml")
+    )
+    assert (
+        "actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de"
+        in read(".gitea/workflows/release-gates.yml")
+    )
+
 
 def test_managed_validation_targets_the_actual_backend_and_frontend_projects() -> None:
     workflow = read(".gitea/workflows/managed-validation.yml")
@@ -101,14 +119,23 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     scan = read("scripts/scan_container_image.sh")
 
     assert "anchore/syft:v1.44.0@sha256:" in sbom
+    assert "--user 0:0" in sbom
+    assert 'docker save "$IMAGE_ID"' in sbom
+    assert '"docker-archive:$WORKDIR/$IMAGE_ARCHIVE"' in sbom
+    assert 'SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}' in sbom
+    assert '--volumes-from "$HOSTNAME"' in sbom
+    assert 'ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"' in sbom
+    assert "/var/run/docker.sock" not in sbom
     assert "aquasec/trivy:0.70.0@sha256:" in scan
     assert "--severity HIGH,CRITICAL" in scan
     assert "--ignore-unfixed" in scan
     assert "--timeout 20m" in scan
     assert "--scanners vuln" in scan
-    assert 'ignored_container_ids' in scan
-    assert 'ignore_args=(-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro")' in scan
-    assert 'trivy_ignore_args=(--ignorefile "$CONTAINER_IGNORE_FILE")' in scan
+    assert 'docker save "$IMAGE_ID"' in scan
+    assert '--input "$WORKDIR/$IMAGE_ARCHIVE"' in scan
+    assert '--volumes-from "$HOSTNAME"' in scan
+    assert '--ignorefile "$CONTAINER_IGNORE_FILE"' in scan
+    assert "/var/run/docker.sock" not in scan
     assert "--skip-files /usr/local/bin/gosu" in scan
     assert "final filesystem replaces it with the audited setpriv shell wrapper" in scan
     assert "geointel-container-vulnerabilities.json" in scan

backend/tests/test_sprint233_operational_completion.py

@@ -468,7 +468,9 @@ def test_detection_lab_only_receives_operational_imagery_rasters() -> None:
     assert "department_omgeving_thematic_raster" in capability_source
     assert "digitaal_vlaanderen_dhmv" in capability_source
     assert "vmm_flood_hazard" in capability_source
-    assert "dataset.dataset_type !== 'raster' || dataset.status !== 'ready'" in capability_source
+    assert "dataset.dataset_type !== 'raster'" in capability_source
+    assert "dataset.status !== 'ready'" in capability_source
+    assert "return datasetInferenceBlockReason(dataset) === null" in capability_source
     assert "const detectionRasterDatasets = useMemo(" in app_source
     assert "rasterDatasets: detectionRasterDatasets" in app_source
     assert "rasterDatasets={detectionRasterDatasets}" in app_source