Include component dependencies in OCI artifact

[itowlson]

Fixes #2891.

@fibonacci1729 @vdice this is rather "works on my machine" at the moment; do you have any thoughts on how to rassle it into a test harness?

[fibonacci1729]

This looks good to me! I'm also not sure about how to add a test harness or how best to test this. Nonetheless, manually tested so it at least works on 2 machines! 🪅

[vdice]

Re: testing, we did have a unit test around assemble_layers which is now commented-out from some iteration of factors re-factoring. Adding a case for component deps there could've made sense -- but we'd need to uncomment/update that test first.

Meanwhile, I don't yet see equivalent unit tests for loader.

Do we think we're at a state where we also might want some sort of integration test with a local registry, etc?

All of which is to say, if @fibonacci1729 agrees, I'd say we're fine to get this in and then address some tech/testing debt in follow-up(s).

[itowlson]

@vdice Integration tests with a local registry sound like a good longer terms plan. It gets gnarly for e2e though because a real test requires you to reference a component from Registry A, push the application to Registry B, and then turn off Registry A...

In the meantime I've fixed the existing assemble_layers test and added a case for a dependency (not very visible because of the comment diff, sorry). Thanks for highlighting this.

[vdice]

In the meantime I've fixed the existing assemble_layers test and added a case for a dependency

🎉 Thank you!