@serve.zone/gitops 3.0.0 → 3.1.0

package/ts/providers/classes.gitlabprovider.ts

@@ -1,6 +1,6 @@
 import * as plugins from '../plugins.js';
 import type * as interfaces from '../../ts_interfaces/index.js';
-import { BaseProvider, type ITestConnectionResult, type IListOptions, type IPipelineListOptions } from './classes.baseprovider.js';
+import { BaseProvider, type IReleaseAssetPayload, type IReleaseAssetTransferOptions, type ITestConnectionResult, type IListOptions, type IPipelineListOptions } from './classes.baseprovider.js';
 
 /**
  * GitLab API v4 provider implementation
@@ -188,8 +188,299 @@ export class GitLabProvider extends BaseProvider {
     }
   }
 
+  // --- Releases / Release Assets ---
+
+  async getReleases(projectFullPath: string): Promise<interfaces.data.IRelease[]> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    try {
+      const releases = await this.requestPaginated<any>(
+        `/api/v4/projects/${encodedProject}/releases?order_by=released_at&sort=desc`,
+      );
+      return releases.map((release) => this.mapRelease(release));
+    } catch (err) {
+      if (this.isNotFoundError(err)) return [];
+      throw err;
+    }
+  }
+
+  async upsertRelease(projectFullPath: string, release: interfaces.data.IRelease): Promise<interfaces.data.IRelease> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    const encodedTag = encodeURIComponent(release.tagName);
+    const body: Record<string, unknown> = {
+      name: release.name || release.tagName,
+      tag_name: release.tagName,
+      description: release.description || '',
+    };
+    if (release.releasedAt) body.released_at = release.releasedAt;
+
+    try {
+      await this.requestJson<any>('GET', `/api/v4/projects/${encodedProject}/releases/${encodedTag}`);
+      const updated = await this.requestJson<any>(
+        'PUT',
+        `/api/v4/projects/${encodedProject}/releases/${encodedTag}`,
+        body,
+      );
+      return this.mapRelease(updated);
+    } catch (err) {
+      if (!this.isNotFoundError(err)) throw err;
+      const created = await this.requestJson<any>(
+        'POST',
+        `/api/v4/projects/${encodedProject}/releases`,
+        body,
+      );
+      return this.mapRelease(created);
+    }
+  }
+
+  async deleteRelease(projectFullPath: string, tagName: string): Promise<void> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    const encodedTag = encodeURIComponent(tagName);
+    try {
+      await this.requestVoid('DELETE', `/api/v4/projects/${encodedProject}/releases/${encodedTag}`);
+    } catch (err) {
+      if (!this.isNotFoundError(err)) throw err;
+    }
+  }
+
+  async deleteReleaseAsset(
+    projectFullPath: string,
+    release: interfaces.data.IRelease,
+    asset: interfaces.data.IReleaseAsset,
+  ): Promise<void> {
+    if (asset.kind !== 'link' || !asset.id) return;
+    const encodedProject = encodeURIComponent(projectFullPath);
+    const encodedTag = encodeURIComponent(release.tagName);
+    await this.requestVoid(
+      'DELETE',
+      `/api/v4/projects/${encodedProject}/releases/${encodedTag}/assets/links/${encodeURIComponent(asset.id)}`,
+    );
+  }
+
+  async downloadReleaseAsset(
+    projectFullPath: string,
+    release: interfaces.data.IRelease,
+    asset: interfaces.data.IReleaseAsset,
+    options?: IReleaseAssetTransferOptions,
+  ): Promise<IReleaseAssetPayload | null> {
+    const baseOrigin = new URL(this.baseUrl).origin;
+    if (asset.url && new URL(asset.url, this.baseUrl).origin !== baseOrigin) {
+      return null;
+    }
+
+    let url: string | undefined;
+    if (asset.directAssetPath) {
+      const encodedProject = encodeURIComponent(projectFullPath);
+      const encodedTag = encodeURIComponent(release.tagName);
+      const encodedDirectPath = asset.directAssetPath
+        .replace(/^\/+/, '')
+        .split('/')
+        .map((segment) => encodeURIComponent(segment))
+        .join('/');
+      url = `${this.baseUrl}/api/v4/projects/${encodedProject}/releases/${encodedTag}/downloads/${encodedDirectPath}`;
+    } else if (asset.downloadUrl || asset.url) {
+      const resolvedUrl = new URL(asset.downloadUrl || asset.url || '', this.baseUrl);
+      if (resolvedUrl.origin !== baseOrigin) {
+        return null;
+      }
+      url = resolvedUrl.toString();
+    }
+    if (!url) return null;
+
+    const response = await fetch(url, {
+      headers: { 'PRIVATE-TOKEN': this.token },
+      signal: options?.signal,
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`GET release asset ${asset.name}: ${response.status} - ${text}`);
+    }
+    return await this.readReleaseAssetPayload(response, asset.name, asset.contentType, options);
+  }
+
+  async uploadReleaseAsset(
+    projectFullPath: string,
+    release: interfaces.data.IRelease,
+    asset: interfaces.data.IReleaseAsset,
+    payload: IReleaseAssetPayload,
+    options?: IReleaseAssetTransferOptions,
+  ): Promise<interfaces.data.IReleaseAsset> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    const formData = new FormData();
+    const blob = new Blob([this.getPayloadArrayBuffer(payload)], {
+      type: payload.contentType || asset.contentType || 'application/octet-stream',
+    });
+    formData.append('file', blob, asset.name);
+    const uploadResponse = await fetch(`${this.baseUrl}/api/v4/projects/${encodedProject}/uploads`, {
+      method: 'POST',
+      headers: { 'PRIVATE-TOKEN': this.token },
+      body: formData,
+      signal: options?.signal,
+    });
+    if (!uploadResponse.ok) {
+      const text = await uploadResponse.text();
+      throw new Error(`POST project upload ${asset.name}: ${uploadResponse.status} - ${text}`);
+    }
+    const upload = await uploadResponse.json() as { full_path?: string; url?: string };
+    const uploadPath = upload.full_path || upload.url;
+    if (!uploadPath) {
+      throw new Error(`GitLab upload response did not include a path for ${asset.name}`);
+    }
+    const uploadUrl = uploadPath.startsWith('http') ? uploadPath : `${this.baseUrl}${uploadPath}`;
+    return await this.createReleaseAssetLink(projectFullPath, release, {
+      ...asset,
+      kind: 'link',
+      url: uploadUrl,
+      directAssetPath: asset.directAssetPath || `/gitops-mirror-assets/${release.tagName}/${asset.name}`,
+    });
+  }
+
+  async createReleaseAssetLink(
+    projectFullPath: string,
+    release: interfaces.data.IRelease,
+    asset: interfaces.data.IReleaseAsset,
+  ): Promise<interfaces.data.IReleaseAsset> {
+    if (!asset.url) {
+      throw new Error(`Release asset "${asset.name}" has no URL to link`);
+    }
+    const encodedProject = encodeURIComponent(projectFullPath);
+    const encodedTag = encodeURIComponent(release.tagName);
+    const body: Record<string, unknown> = {
+      name: asset.name,
+      url: asset.url,
+      link_type: asset.linkType || 'other',
+    };
+    if (asset.directAssetPath) body.direct_asset_path = asset.directAssetPath;
+    const created = await this.requestJson<any>(
+      'POST',
+      `/api/v4/projects/${encodedProject}/releases/${encodedTag}/assets/links`,
+      body,
+    );
+    return this.mapReleaseLink(created);
+  }
+
+  // --- Container Images ---
+
+  async getContainerImageRepositories(projectFullPath: string): Promise<interfaces.data.IContainerImageRepository[]> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    try {
+      const repositories = await this.requestPaginated<any>(
+        `/api/v4/projects/${encodedProject}/registry/repositories?tags_count=true`,
+      );
+      const result: interfaces.data.IContainerImageRepository[] = [];
+      for (const repo of repositories) {
+        const tags = await this.requestPaginated<any>(
+          `/api/v4/projects/${encodedProject}/registry/repositories/${repo.id}/tags`,
+        );
+        result.push({
+          id: String(repo.id),
+          name: repo.name || '',
+          path: repo.path,
+          location: repo.location,
+          projectFullPath,
+          tags: tags.map((tag) => ({
+            name: tag.name,
+            location: tag.location || `${repo.location}:${tag.name}`,
+          })),
+        });
+      }
+      return result;
+    } catch (err) {
+      if (this.isNotFoundError(err)) return [];
+      throw err;
+    }
+  }
+
+  async deleteContainerImageTag(
+    projectFullPath: string,
+    repositoryId: string,
+    tagName: string,
+  ): Promise<void> {
+    const encodedProject = encodeURIComponent(projectFullPath);
+    try {
+      await this.requestVoid(
+        'DELETE',
+        `/api/v4/projects/${encodedProject}/registry/repositories/${encodeURIComponent(repositoryId)}/tags/${encodeURIComponent(tagName)}`,
+      );
+    } catch (err) {
+      if (!this.isNotFoundError(err)) throw err;
+    }
+  }
+
   // --- Mappers ---
 
+  private async requestPaginated<T>(path: string): Promise<T[]> {
+    const items: T[] = [];
+    const perPage = 100;
+    const maxPages = 1000;
+    for (let page = 1; page <= maxPages; page++) {
+      const separator = path.includes('?') ? '&' : '?';
+      const requestPath = `${path}${separator}page=${page}&per_page=${perPage}`;
+      const pageItems = await this.requestJson<T[]>('GET', requestPath);
+      if (!Array.isArray(pageItems) || pageItems.length === 0) break;
+      items.push(...pageItems);
+      if (pageItems.length < perPage) break;
+    }
+    if (items.length >= perPage * maxPages) {
+      throw new Error(`Pagination exceeded ${maxPages} pages for ${path}`);
+    }
+    return items;
+  }
+
+  private async requestJson<T>(method: string, path: string, body?: Record<string, unknown>): Promise<T> {
+    const headers: Record<string, string> = { 'PRIVATE-TOKEN': this.token };
+    if (body) headers['Content-Type'] = 'application/json';
+    return await this.fetchJsonWithTimeout<T>(
+      `${this.baseUrl.replace(/\/+$/, '')}${path}`,
+      {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined,
+      },
+      `GitLab ${method} ${path}`,
+    );
+  }
+
+  private async requestVoid(method: string, path: string): Promise<void> {
+    await this.fetchVoidWithTimeout(
+      `${this.baseUrl.replace(/\/+$/, '')}${path}`,
+      {
+        method,
+        headers: { 'PRIVATE-TOKEN': this.token },
+      },
+      `GitLab ${method} ${path}`,
+    );
+  }
+
+  private isNotFoundError(err: unknown): boolean {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    return errMsg.includes(': 404 ') || errMsg.includes(': 404 -') || errMsg.includes(' 404 Not Found');
+  }
+
+  private mapRelease(raw: any): interfaces.data.IRelease {
+    const links = Array.isArray(raw.assets?.links) ? raw.assets.links : [];
+    return {
+      tagName: raw.tag_name,
+      name: raw.name || raw.tag_name,
+      description: raw.description || '',
+      releasedAt: raw.released_at,
+      createdAt: raw.created_at,
+      targetCommitish: raw.commit?.id,
+      assets: links.map((link: any) => this.mapReleaseLink(link)),
+    };
+  }
+
+  private mapReleaseLink(link: any): interfaces.data.IReleaseAsset {
+    return {
+      id: link.id ? String(link.id) : undefined,
+      name: link.name || '',
+      kind: 'link',
+      url: link.url,
+      downloadUrl: link.direct_asset_url,
+      directAssetPath: link.direct_asset_path,
+      linkType: link.link_type || 'other',
+    };
+  }
+
   private mapProject(p: plugins.gitlabClient.GitLabProject): interfaces.data.IProject {
     return {
       id: String(p.id),

package/ts_interfaces/data/artifact.ts

@@ -0,0 +1,43 @@
+export type TReleaseAssetKind = 'link' | 'attachment' | 'source';
+
+export interface IReleaseAsset {
+  id?: string;
+  name: string;
+  kind: TReleaseAssetKind;
+  url?: string;
+  downloadUrl?: string;
+  directAssetPath?: string;
+  linkType?: 'other' | 'runbook' | 'image' | 'package';
+  contentType?: string;
+  size?: number;
+}
+
+export interface IRelease {
+  id?: string;
+  tagName: string;
+  name: string;
+  description: string;
+  releasedAt?: string;
+  createdAt?: string;
+  draft?: boolean;
+  preRelease?: boolean;
+  targetCommitish?: string;
+  assets: IReleaseAsset[];
+}
+
+export interface IContainerImageTag {
+  name: string;
+  digest?: string;
+  location: string;
+  createdAt?: string;
+  size?: number;
+}
+
+export interface IContainerImageRepository {
+  id: string;
+  name: string;
+  path: string;
+  location: string;
+  projectFullPath: string;
+  tags: IContainerImageTag[];
+}

package/ts_interfaces/data/connection.ts

@@ -10,4 +10,7 @@ export interface IProviderConnection {
   status: 'connected' | 'disconnected' | 'error' | 'paused';
   groupFilter?: string;      // Restricts which repos this connection can see (e.g. "foss.global")
   groupFilterId?: string;    // Resolved filter group ID (numeric for GitLab, org name for Gitea)
+  registryUrl?: string;      // Optional OCI registry host/base URL when it differs from provider baseUrl
+  registryUsername?: string; // Optional OCI registry username; provider token is used first when omitted
+  registryToken?: string;    // Optional OCI registry token/password; stored in keychain when configured
 }

package/ts_interfaces/data/index.ts

@@ -5,6 +5,7 @@ export * from './group.js';
 export * from './branch.js';
 export * from './secret.js';
 export * from './pipeline.js';
+export * from './artifact.js';
 export * from './actionlog.js';
 export * from './sync.js';
 export * from './managedsecret.js';

package/ts_interfaces/data/sync.ts

@@ -12,8 +12,12 @@ export interface ISyncConfig {
   lastSyncError?: string;
   lastSyncDurationMs?: number;
   reposSynced: number;
+  releasesSynced?: number;
+  imagesSynced?: number;
   enforceDelete: boolean;         // When true, stale target repos are moved to obsolete
   enforceGroupDelete: boolean;    // When true, stale target groups/orgs are moved to obsolete
+  syncReleases?: boolean;         // When true, release metadata and assets are mirrored exactly
+  syncContainerImages?: boolean;  // When true, OCI image tags/manifests are mirrored exactly
   addMirrorHint?: boolean;        // When true, target descriptions get "(This is a mirror of ...)" appended
   useGroupAvatarsForProjects?: boolean; // When true, projects without avatars inherit the group avatar
   createdAt: number;
@@ -26,9 +30,27 @@ export interface ISyncRepoStatus {
   targetFullPath: string;       // e.g. "foss.global/push.rocks/smartstate"
   lastSyncAt: number;
   lastSyncError?: string;
+  sourceProjectId?: string;
+  targetProjectId?: string;
+  releasesSynced?: number;
+  imagesSynced?: number;
+  releaseSyncError?: string;
+  imageSyncError?: string;
   status: 'synced' | 'error' | 'pending';
 }
 
+export interface ISyncProjectMapping {
+  id: string;
+  syncConfigId: string;
+  sourceConnectionId: string;
+  sourceProjectId: string;
+  sourceFullPath: string;
+  targetConnectionId: string;
+  targetFullPath: string;
+  targetProjectId?: string;
+  updatedAt: number;
+}
+
 export interface ISyncLogEntry {
   timestamp: number;
   level: 'info' | 'warn' | 'error' | 'success' | 'debug';

package/ts_interfaces/requests/connections.ts

@@ -26,6 +26,9 @@ export interface IReq_CreateConnection extends plugins.typedrequestInterfaces.im
     baseUrl: string;
     token: string;
     groupFilter?: string;
+    registryUrl?: string;
+    registryUsername?: string;
+    registryToken?: string;
   };
   response: {
     connection: data.IProviderConnection;
@@ -44,6 +47,9 @@ export interface IReq_UpdateConnection extends plugins.typedrequestInterfaces.im
     baseUrl?: string;
     token?: string;
     groupFilter?: string;
+    registryUrl?: string;
+    registryUsername?: string;
+    registryToken?: string;
   };
   response: {
     connection: data.IProviderConnection;

package/ts_interfaces/requests/sync.ts

@@ -28,6 +28,8 @@ export interface IReq_CreateSyncConfig extends plugins.typedrequestInterfaces.im
     intervalMinutes?: number;
     enforceDelete?: boolean;
     enforceGroupDelete?: boolean;
+    syncReleases?: boolean;
+    syncContainerImages?: boolean;
     addMirrorHint?: boolean;
     useGroupAvatarsForProjects?: boolean;
   };
@@ -49,6 +51,8 @@ export interface IReq_UpdateSyncConfig extends plugins.typedrequestInterfaces.im
     intervalMinutes?: number;
     enforceDelete?: boolean;
     enforceGroupDelete?: boolean;
+    syncReleases?: boolean;
+    syncContainerImages?: boolean;
     addMirrorHint?: boolean;
     useGroupAvatarsForProjects?: boolean;
   };

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/gitops',
-  version: '3.0.0',
+  version: '3.1.0',
   description: 'GitOps management app for Gitea and GitLab - manage secrets, browse projects, view CI pipelines, and stream build logs'
 }

package/ts_web/appstate.ts

@@ -180,6 +180,9 @@ export const createConnectionAction = connectionsStatePart.createAction<{
   baseUrl: string;
   token: string;
   groupFilter?: string;
+  registryUrl?: string;
+  registryUsername?: string;
+  registryToken?: string;
 }>(async (statePartArg, dataArg) => {
   const context = getActionContext();
   try {
@@ -281,6 +284,9 @@ export const updateConnectionAction = connectionsStatePart.createAction<{
   baseUrl?: string;
   token?: string;
   groupFilter?: string;
+  registryUrl?: string;
+  registryUsername?: string;
+  registryToken?: string;
 }>(async (statePartArg, dataArg) => {
   const context = getActionContext();
   try {
@@ -887,6 +893,8 @@ export const createSyncConfigAction = syncStatePart.createAction<{
   intervalMinutes?: number;
   enforceDelete?: boolean;
   enforceGroupDelete?: boolean;
+  syncReleases?: boolean;
+  syncContainerImages?: boolean;
   addMirrorHint?: boolean;
   useGroupAvatarsForProjects?: boolean;
 }>(async (statePartArg, dataArg) => {
@@ -915,6 +923,8 @@ export const updateSyncConfigAction = syncStatePart.createAction<{
   intervalMinutes?: number;
   enforceDelete?: boolean;
   enforceGroupDelete?: boolean;
+  syncReleases?: boolean;
+  syncContainerImages?: boolean;
   addMirrorHint?: boolean;
   useGroupAvatarsForProjects?: boolean;
 }>(async (statePartArg, dataArg) => {

package/ts_web/elements/views/connections/index.ts

@@ -63,6 +63,8 @@ export class GitopsViewConnections extends DeesElement {
           Type: item.providerType,
           URL: item.baseUrl,
           'Group Filter': item.groupFilter || '-',
+          Registry: item.registryUrl || '-',
+          'Registry User': item.registryUsername || '-',
           Status: item.status,
           Created: new Date(item.createdAt).toLocaleDateString(),
         })}
@@ -168,6 +170,15 @@ export class GitopsViewConnections extends DeesElement {
         <div class="form-row">
           <dees-input-text .label=${'Group Filter (optional)'} .key=${'groupFilter'} .value=${item.groupFilter || ''} .description=${'Restricts which repos this connection can see (e.g. an org name or GitLab group path). Does not affect where synced repos are placed.'}></dees-input-text>
         </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry URL (optional)'} .key=${'registryUrl'} .value=${item.registryUrl || ''} .description=${'OCI registry host/base URL when it differs from the provider base URL, for example registry.example.com:5050.'}></dees-input-text>
+        </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry Username (optional)'} .key=${'registryUsername'} .value=${item.registryUsername || ''} .description=${'Optional OCI registry username. GitLab defaults to oauth2 with the API token when omitted.'}></dees-input-text>
+        </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry Token (leave empty to keep current)'} .key=${'registryToken'} type="password" .description=${'Optional OCI registry token/password. When omitted, the provider API token is tried first.'}></dees-input-text>
+        </div>
       `,
       menuOptions: [
         { name: 'Cancel', action: async (modal: any) => { modal.destroy(); } },
@@ -186,7 +197,10 @@ export class GitopsViewConnections extends DeesElement {
                 name: data.name,
                 baseUrl: data.baseUrl,
                 groupFilter: data.groupFilter,
+                registryUrl: data.registryUrl,
+                registryUsername: data.registryUsername,
                 ...(data.token ? { token: data.token } : {}),
+                ...(data.registryToken ? { registryToken: data.registryToken } : {}),
               },
             );
             modal.destroy();
@@ -226,6 +240,15 @@ export class GitopsViewConnections extends DeesElement {
         <div class="form-row">
           <dees-input-text .label=${'Group Filter (optional)'} .key=${'groupFilter'} .description=${'Restricts which repos this connection can see (e.g. an org name or GitLab group path). Does not affect where synced repos are placed.'}></dees-input-text>
         </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry URL (optional)'} .key=${'registryUrl'} .description=${'OCI registry host/base URL when it differs from the provider base URL, for example registry.example.com:5050.'}></dees-input-text>
+        </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry Username (optional)'} .key=${'registryUsername'} .description=${'Optional OCI registry username. GitLab defaults to oauth2 with the API token when omitted.'}></dees-input-text>
+        </div>
+        <div class="form-row">
+          <dees-input-text .label=${'Registry Token (optional)'} .key=${'registryToken'} type="password" .description=${'Optional OCI registry token/password. When omitted, the provider API token is tried first.'}></dees-input-text>
+        </div>
       `,
       menuOptions: [
         { name: 'Cancel', action: async (modal: any) => { modal.destroy(); } },
@@ -249,6 +272,9 @@ export class GitopsViewConnections extends DeesElement {
                 baseUrl: data.baseUrl,
                 token: data.token,
                 groupFilter: data.groupFilter || undefined,
+                registryUrl: data.registryUrl || undefined,
+                registryUsername: data.registryUsername || undefined,
+                registryToken: data.registryToken || undefined,
               },
             );
             modal.destroy();

package/ts_web/elements/views/sync/index.ts

@@ -103,10 +103,14 @@ export class GitopsViewSync extends DeesElement {
             Status: item.status,
             'Enforce Delete': item.enforceDelete ? 'Yes' : 'No',
             'Enforce Group Delete': item.enforceGroupDelete ? 'Yes' : 'No',
+            'Sync Releases': item.syncReleases ? 'Yes' : 'No',
+            'Sync Images': item.syncContainerImages ? 'Yes' : 'No',
             'Mirror Hint': item.addMirrorHint ? 'Yes' : 'No',
             'Group Avatars': item.useGroupAvatarsForProjects ? 'Yes' : 'No',
             'Last Sync': item.lastSyncAt ? new Date(item.lastSyncAt).toLocaleString() : 'Never',
             Repos: String(item.reposSynced),
+            Releases: String(item.releasesSynced || 0),
+            Images: String(item.imagesSynced || 0),
           };
         }}
         .dataActions=${[
@@ -286,6 +290,12 @@ export class GitopsViewSync extends DeesElement {
         <div class="form-row">
           <dees-input-checkbox .label=${'Enforce Group Deletion'} .key=${'enforceGroupDelete'} .value=${false} .description=${'When enabled, groups/orgs on the target not present on the source will be moved to obsolete.'}></dees-input-checkbox>
         </div>
+        <div class="form-row">
+          <dees-input-checkbox .label=${'Sync Releases'} .key=${'syncReleases'} .value=${false} .description=${'When enabled, releases and release assets are mirrored to the target.'}></dees-input-checkbox>
+        </div>
+        <div class="form-row">
+          <dees-input-checkbox .label=${'Sync Container Images'} .key=${'syncContainerImages'} .value=${false} .description=${'When enabled, OCI container image tags are mirrored to the target registry.'}></dees-input-checkbox>
+        </div>
         <div class="form-row">
           <dees-input-checkbox .label=${'Add Mirror Hint'} .key=${'addMirrorHint'} .value=${false} .description=${'When enabled, target descriptions get "(This is a mirror of ...)" appended.'}></dees-input-checkbox>
         </div>
@@ -303,7 +313,7 @@ export class GitopsViewSync extends DeesElement {
             for (const input of inputs) {
               if (input.key === 'sourceConnectionId' || input.key === 'targetConnectionId') {
                 data[input.key] = input.selectedOption?.key || '';
-              } else if (input.key === 'enforceDelete' || input.key === 'enforceGroupDelete' || input.key === 'addMirrorHint' || input.key === 'useGroupAvatarsForProjects') {
+              } else if (input.key === 'enforceDelete' || input.key === 'enforceGroupDelete' || input.key === 'syncReleases' || input.key === 'syncContainerImages' || input.key === 'addMirrorHint' || input.key === 'useGroupAvatarsForProjects') {
                 data[input.key] = input.getValue();
               } else {
                 data[input.key] = input.value || '';
@@ -313,10 +323,12 @@ export class GitopsViewSync extends DeesElement {
               name: data.name,
               sourceConnectionId: data.sourceConnectionId,
               targetConnectionId: data.targetConnectionId,
-              targetGroupOffset: data.targetGroupOffset || undefined,
+              targetGroupOffset: data.targetGroupOffset,
               intervalMinutes: parseInt(data.intervalMinutes) || 5,
               enforceDelete: !!data.enforceDelete,
               enforceGroupDelete: !!data.enforceGroupDelete,
+              syncReleases: !!data.syncReleases,
+              syncContainerImages: !!data.syncContainerImages,
               addMirrorHint: !!data.addMirrorHint,
               useGroupAvatarsForProjects: !!data.useGroupAvatarsForProjects,
             });
@@ -347,6 +359,12 @@ export class GitopsViewSync extends DeesElement {
         <div class="form-row">
           <dees-input-checkbox .label=${'Enforce Group Deletion'} .key=${'enforceGroupDelete'} .value=${!!item.enforceGroupDelete} .description=${'When enabled, groups/orgs on the target not present on the source will be moved to obsolete.'}></dees-input-checkbox>
         </div>
+        <div class="form-row">
+          <dees-input-checkbox .label=${'Sync Releases'} .key=${'syncReleases'} .value=${!!item.syncReleases} .description=${'When enabled, releases and release assets are mirrored to the target.'}></dees-input-checkbox>
+        </div>
+        <div class="form-row">
+          <dees-input-checkbox .label=${'Sync Container Images'} .key=${'syncContainerImages'} .value=${!!item.syncContainerImages} .description=${'When enabled, OCI container image tags are mirrored to the target registry.'}></dees-input-checkbox>
+        </div>
         <div class="form-row">
           <dees-input-checkbox .label=${'Add Mirror Hint'} .key=${'addMirrorHint'} .value=${!!item.addMirrorHint} .description=${'When enabled, target descriptions get "(This is a mirror of ...)" appended.'}></dees-input-checkbox>
         </div>
@@ -362,7 +380,7 @@ export class GitopsViewSync extends DeesElement {
             const inputs = modal.shadowRoot.querySelectorAll('dees-input-text, dees-input-checkbox');
             const data: any = {};
             for (const input of inputs) {
-              if (input.key === 'enforceDelete' || input.key === 'enforceGroupDelete' || input.key === 'addMirrorHint' || input.key === 'useGroupAvatarsForProjects') {
+              if (input.key === 'enforceDelete' || input.key === 'enforceGroupDelete' || input.key === 'syncReleases' || input.key === 'syncContainerImages' || input.key === 'addMirrorHint' || input.key === 'useGroupAvatarsForProjects') {
                 data[input.key] = input.getValue();
               } else {
                 data[input.key] = input.value || '';
@@ -371,10 +389,12 @@ export class GitopsViewSync extends DeesElement {
             await appstate.syncStatePart.dispatchAction(appstate.updateSyncConfigAction, {
               syncConfigId: item.id,
               name: data.name,
-              targetGroupOffset: data.targetGroupOffset || undefined,
+              targetGroupOffset: data.targetGroupOffset,
               intervalMinutes: parseInt(data.intervalMinutes) || 5,
               enforceDelete: !!data.enforceDelete,
               enforceGroupDelete: !!data.enforceGroupDelete,
+              syncReleases: !!data.syncReleases,
+              syncContainerImages: !!data.syncContainerImages,
               addMirrorHint: !!data.addMirrorHint,
               useGroupAvatarsForProjects: !!data.useGroupAvatarsForProjects,
             });
@@ -494,6 +514,8 @@ export class GitopsViewSync extends DeesElement {
               <div>
                 <div class="repo-path">${s.sourceFullPath}</div>
                 ${s.lastSyncError ? html`<div class="repo-error">${s.lastSyncError}</div>` : ''}
+                ${s.releaseSyncError ? html`<div class="repo-error">Release sync: ${s.releaseSyncError}</div>` : ''}
+                ${s.imageSyncError ? html`<div class="repo-error">Image sync: ${s.imageSyncError}</div>` : ''}
               </div>
               <div>
                 <span class="repo-status ${s.status}">${s.status}</span>