feat(BA-1843): Separate repository layer from container registry service

[HyeockJinKim]

resolves #5093 (BA-1843)

Checklist: (if applicable)

• Milestone metadata specifying the target backport version
• Mention to the original issue
• Installer updates including:
  • Fixtures for db schema changes
  • New mandatory config options
• Update of end-to-end CLI integration tests in ai.backend.test
• API server-client counterparts (e.g., manager API -> client SDK)
• Test case(s) to:
  • Demonstrate the difference of before/after
  • Demonstrate the flow of abstract/conceptual models with a concrete implementation
• Documentation
  • Contents in the docs directory
  • docstrings in public interfaces and type annotations

[Copilot]

Pull Request Overview

This PR separates the container registry persistence logic into its own repository layer and updates the service and tests to use that new layer instead of working directly with the database engine.

• Introduce ContainerRegistryRepository and AdminContainerRegistryRepository for read and write operations.
• Refactor ContainerRegistryService and the service factory to accept and use these repositories.
• Update test fixtures to provide a repositories fixture and wire it into container registry tests.

Reviewed Changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/manager/services/container_registry/conftest.py	Updated processors fixture to use the new repositories fixture.
tests/manager/conftest.py	Added async repositories fixture and imports for the new layer.
src/ai/backend/manager/services/processors.py	Inject container registry repositories into the service factory.
src/ai/backend/manager/services/container_registry/service.py	Refactored service methods to use the new repository layer.
src/ai/backend/manager/repositories/repositories.py	Registered ContainerRegistryRepositories in the central factory.
src/ai/backend/manager/repositories/container_registry/repository.py	Implemented read-only repository for container registry data.
src/ai/backend/manager/repositories/container_registry/admin_repository.py	Implemented admin repository for clearing images.
src/ai/backend/manager/repositories/container_registry/repositories.py	Defined repository aggregate and RepositoryArgs dataclasses.
src/ai/backend/manager/repositories/container_registry/BUILD	Added BUILD file for the new repository package.

Comments suppressed due to low confidence (2)

src/ai/backend/manager/repositories/container_registry/repository.py:1

• The new repository class introduces several methods but there are no direct unit tests for it. Consider adding tests for get_registry_by_name_and_project, get_all_registries, and get_known_registries to ensure correct behavior.

from typing import Optional

tests/manager/conftest.py:1091

• This async fixture may require the pytest-asyncio plugin. If you’re using pytest-asyncio, annotate this with @pytest_asyncio.fixture to ensure the event loop is available.

@pytest.fixture

[Copilot]

Accessing the private _db attribute on the repository ties the service to implementation details. Consider exposing a session or engine getter on the repository or passing the engine explicitly to the service to avoid using a private property.

Suggested change

	scanner = scanner_cls(self._repository._db, registry_name, registry_row)
	scanner = scanner_cls(self._repository.get_db_session(), registry_name, registry_row)

[jopemachine]

It would be good to add a permission check hook that runs before the method is executed.

[HyeockJinKim]

This action will all be removed when RBAC is applied, so for now, it is being left as is.

[jopemachine]

Suggested change

	Separate repository layer from container registry service
	Separate admin repository layer from container registry service

[HyeockJinKim]

I think the current message is appropriate because the important thing is not separating the admin, but separating the repository layer from the service.

[jopemachine]

Isn't the container repository already separated, and isn't this PR about separating the admin container repository layer?

[HyeockJinKim]

I didn't consider it separated because, although there was a repository class, the actual implementation wasn't separated.