Approval based image copy?

[prein]

Hi, security team would like to use only images we signed and/or approved. Would it be feasible to make the swapper, in addition to copying mage, either:

• open a pull request
• trigger a GHA workflow
• (least effort I guess) call a webhook
• check against a list in git
  ?

[estahn]

You might be able to use the filter config 🤔

Maybe some sort of opposite of filter?

[prein]

#633 and #751 are IMO related or could be if there's a way to generalize both ideas