Make configured artifacts manifest authoritative

internal/stage/publish.go

@@ -839,51 +839,11 @@ func buildPublishRuntimeArtifactCatalog(
 	if notariusCfg != nil && notariusCfg.Enabled {
 		catalog.HydrateExtractionArtifacts(paths, m, extractionDefinitions)
 	}
-
-	for _, entry := range catalog.ListConfigured() {
-		if strings.TrimSpace(entry.CanonicalRelPath) == "" {
-			continue
-		}
-		localPath, err := resolveConfiguredArtifactLocalPath(paths, entry.CanonicalRelPath)
-		if err != nil {
-			continue
-		}
-		info, statErr := os.Stat(localPath)
-		if statErr != nil {
-			if os.IsNotExist(statErr) {
-				continue
-			}
-			return nil, fmt.Errorf("stat configured artifact %q: %w", entry.SourceID, statErr)
-		}
-		if info.IsDir() {
-			continue
-		}
-		if err := catalog.MarkAvailableFromDisk(entry.SourceID, localPath); err != nil {
-			return nil, err
-		}
-	}
+	catalog.HydrateAnalyzeArtifacts(paths, m, configured)
 
 	return catalog, nil
 }
 
-func resolveConfiguredArtifactLocalPath(paths artifacts.SessionPaths, configured string) (string, error) {
-	outputPath := strings.TrimSpace(configured)
-	if outputPath == "" {
-		return "", fmt.Errorf("configured artifact output path is required")
-	}
-	if filepath.IsAbs(outputPath) {
-		return filepath.Clean(outputPath), nil
-	}
-	rel := filepath.Clean(outputPath)
-	if rel == "." || rel == "" {
-		return "", fmt.Errorf("relative output path is required")
-	}
-	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-		return "", fmt.Errorf("relative output path escapes session root: %q", configured)
-	}
-	return filepath.Join(paths.Root, rel), nil
-}
-
 func collectPublishRunFiles(runRoot string, runManifest *manifest.RunManifest) ([]publishUploadFile, error) {
 	if runManifest == nil {
 		return nil, fmt.Errorf("run manifest is required")