Confine publish archive reads

internal/manifest/store.go

@@ -149,18 +149,35 @@ func (s *LocalStore) LoadRun(ctx context.Context, path string) (*RunManifest, er
 		return nil, fmt.Errorf("load run manifest: path is required")
 	}
 
-	data, err := os.ReadFile(path)
+	file, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("load run manifest %q: %w", path, err)
 	}
+	defer file.Close()
+	return s.LoadRunReader(ctx, file)
+}
+
+// LoadRunReader reads and validates a run manifest from a caller-owned reader.
+func (s *LocalStore) LoadRunReader(ctx context.Context, source io.Reader) (*RunManifest, error) {
+	if err := checkContext(ctx); err != nil {
+		return nil, err
+	}
+	if source == nil {
+		return nil, fmt.Errorf("load run manifest: source is required")
+	}
+
+	data, err := io.ReadAll(source)
+	if err != nil {
+		return nil, fmt.Errorf("read run manifest: %w", err)
+	}
 
 	var m RunManifest
 	if err := json.Unmarshal(data, &m); err != nil {
-		return nil, fmt.Errorf("decode run manifest %q: %w", path, err)
+		return nil, fmt.Errorf("decode run manifest: %w", err)
 	}
 
 	if err := validateLoadedRunManifest(&m); err != nil {
-		return nil, fmt.Errorf("run manifest %q invalid: %w", path, err)
+		return nil, fmt.Errorf("run manifest invalid: %w", err)
 	}
 	normalizeRunManifest(&m)