Artifact Registry跨云来源治理（GCR-ECR-ACR-白名单）最佳实践

实现示例type Ref = { host: string; namespace: string; name: string; tag: string } const allowHosts = new Set<string>(['gcr.io','us-docker.pkg.dev','*.ecr.amazonaws.com','azurecr.io']) function hostAllowed(h: string): boolean { if (allowHosts.has(h)) return true; if (/\.ecr\.amazonaws\.com$/.test(h)) return true; return false } function validRef(r: Ref): boolean { return hostAllowed(r.host) && !!r.namespace && !!r.name && !!r.tag } 审计与运行治理审计来源主机与命名空间；异常阻断并输出修复建议。白名单变更需审批与归档。