test: cover registry k8s fallback path derivation

internal/hubmodule/docker/hooks.go

@@ -69,6 +69,24 @@ func isDockerHubHost(host string) bool {
 	}
 }
 
+func isRegistryK8sHost(host string) bool {
+	if parsedHost, _, err := net.SplitHostPort(host); err == nil {
+		host = parsedHost
+	}
+	return strings.EqualFold(host, "registry.k8s.io")
+}
+
+func manifestFallbackPath(ctx *hooks.RequestContext, clean string) (string, bool) {
+	if ctx == nil || !isRegistryK8sHost(ctx.UpstreamHost) {
+		return "", false
+	}
+	repo, rest, ok := splitDockerRepoPath(clean)
+	if !ok || strings.Contains(repo, "/") || !strings.HasPrefix(rest, "/manifests/") {
+		return "", false
+	}
+	return "/v2/" + repo + "/" + repo + rest, true
+}
+
 func splitDockerRepoPath(path string) (string, string, bool) {
 	if !strings.HasPrefix(path, "/v2/") {
 		return "", "", false

internal/hubmodule/docker/hooks_test.go

@@ -27,6 +27,44 @@ func TestNormalizePathSkipsLibraryForNonDockerHub(t *testing.T) {
 	}
 }
 
+func TestIsRegistryK8sHost(t *testing.T) {
+	if !isRegistryK8sHost("registry.k8s.io") {
+		t.Fatalf("expected registry.k8s.io to match")
+	}
+	if isRegistryK8sHost("example.com") {
+		t.Fatalf("expected non-registry.k8s.io host to be ignored")
+	}
+}
+
+func TestRegistryK8sManifestFallbackPath(t *testing.T) {
+	ctx := &hooks.RequestContext{UpstreamHost: "registry.k8s.io"}
+	path, ok := manifestFallbackPath(ctx, "/v2/coredns/manifests/v1.13.1")
+	if !ok || path != "/v2/coredns/coredns/manifests/v1.13.1" {
+		t.Fatalf("expected fallback path, got %q ok=%v", path, ok)
+	}
+}
+
+func TestRegistryK8sManifestFallbackPathRejectsMultiSegmentRepo(t *testing.T) {
+	ctx := &hooks.RequestContext{UpstreamHost: "registry.k8s.io"}
+	if _, ok := manifestFallbackPath(ctx, "/v2/coredns/coredns/manifests/v1.13.1"); ok {
+		t.Fatalf("expected multi-segment repo to be ignored")
+	}
+}
+
+func TestRegistryK8sManifestFallbackPathRejectsNonManifest(t *testing.T) {
+	ctx := &hooks.RequestContext{UpstreamHost: "registry.k8s.io"}
+	if _, ok := manifestFallbackPath(ctx, "/v2/coredns/blobs/sha256:deadbeef"); ok {
+		t.Fatalf("expected non-manifest path to be ignored")
+	}
+}
+
+func TestRegistryK8sManifestFallbackPathRejectsNonRegistryHost(t *testing.T) {
+	ctx := &hooks.RequestContext{UpstreamHost: "mirror.gcr.io"}
+	if _, ok := manifestFallbackPath(ctx, "/v2/coredns/manifests/v1.13.1"); ok {
+		t.Fatalf("expected non-registry.k8s.io host to be ignored")
+	}
+}
+
 func TestSplitDockerRepoPath(t *testing.T) {
 	repo, rest, ok := splitDockerRepoPath("/v2/library/nginx/manifests/latest")
 	if !ok || repo != "library/nginx" || rest != "/manifests/latest" {