test: make test cases unique and test de-duplication

.gitea/workflows/ci.yaml

@@ -49,13 +49,16 @@ jobs:
         run: |
           images="${{ steps.giff.outputs.images }}"
           echo "Extracted: $images"
-          # Registry with tag
-          echo "$images" | grep -q 'example.com/library/nginx:latest'
-          echo "$images" | grep -q 'example.com/library/redis:7-alpine'
-          echo "$images" | grep -q 'example.com/library/app:1.25-alpine'
-          # Registry path with tag
+          # Dockerfile-only: registry with tag, registry with digest
+          echo "$images" | grep -q 'example.com/library/nginx:v1'
+          echo "$images" | grep -q 'example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+          # K8s-only: registry with tag, registry with digest
+          echo "$images" | grep -q 'example.com/library/app:v2'
+          echo "$images" | grep -q 'example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+          # Shared ref (in both Dockerfile and K8s) — must appear exactly once
           echo "$images" | grep -q 'example.com/distroless/static:nonroot'
-          # Registry with digest
-          echo "$images" | grep -q 'example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd'
-          echo "$images" | grep -q 'example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'
-          echo "$images" | grep -q 'example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd'
+          count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
+          [ "$count" -eq 1 ] || { echo "expected shared ref once, got: $count"; exit 1; }
+          # Total unique refs: 5
+          total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
+          [ "$total" -eq 5 ] || { echo "expected 5 unique refs, got: $total"; exit 1; }

get-images-from-files/test-deployment.yaml

@@ -1,4 +1,4 @@
-# Used by CI to test get-images-from-files action (K8s manifest, registry refs only)
+# Used by CI to test get-images-from-files action (K8s, distinct from Dockerfile)
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -9,12 +9,11 @@ spec:
     spec:
       containers:
         - name: app
-          image: example.com/library/app:1.25-alpine
-        - name: sidecar
-          image: example.com/library/redis:7-alpine
-        - name: distroless
+          # Registry with tag (K8s)
+          image: example.com/library/app:v2
+        - name: shared
+          # Same ref as in test.Dockerfile — tests deduplication
           image: example.com/distroless/static:nonroot
         - name: by-digest
-          image: example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
-        - name: fqdn-digest
-          image: example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd
+          # Registry with digest (K8s)
+          image: example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

get-images-from-files/test.Dockerfile

@@ -1,11 +1,13 @@
-# Used by CI to test get-images-from-files action (varied image formats, registry refs only)
-# Short repo:tag (ignored by design; only registry refs are extracted)
-FROM nginx:3.19
-# Fully qualified with host and tag
-FROM example.com/library/nginx:latest
-# Registry path with tag
+# Used by CI to test get-images-from-files action (registry refs only, distinct from K8s)
+# Registry with tag (Dockerfile)
+FROM example.com/library/nginx:v1
+# Registry path with tag — shared with K8s to test deduplication
 FROM example.com/distroless/static:nonroot
-# With digest only but no registry (ignored)
+# Registry with digest (Dockerfile)
+FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+# Ignored tags
+## Short repo:tag (ignored by design; only registry refs are extracted)
+FROM nginx:3.19
+## With digest only but no registry (ignored)
 FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
-# Fully qualified with digest
-FROM example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd