From 69898922befad54015ba9e05f2849e690d8648ca Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Tue, 13 Oct 2026 17:05:34 -0500
Subject: [PATCH] fix: push supplemental images on release builds again

CircleCI renders the boolean push parameter as 1/0 in the step
environment, but build_push_supplemental.sh only pushed when
PUSH_IMAGES was the string "true". Since 0.3.5 every release build
built and scanned supplemental images and never pushed them, so
deployments referencing them hit ImagePullBackOff (kof22 0.1.75).

PUSH_IMAGES now accepts true/1/yes/on and false/0/no/off/empty; unset
still means push, and an unrecognised value fails before any build.
Tests cover release-mode pushes (1, true, TRUE) of every supplemental
image, PR-mode non-pushes (0, false, empty), and the invalid value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
---
 src/scripts/build_push_supplemental.sh | 11 +++++++-
 tests/test_docker_scan.sh              | 37 ++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/src/scripts/build_push_supplemental.sh b/src/scripts/build_push_supplemental.sh
index 6c42bfc..22670ce 100644
--- a/src/scripts/build_push_supplemental.sh
+++ b/src/scripts/build_push_supplemental.sh
@@ -27,7 +27,16 @@ IMAGE="${IMAGE_NAME:?IMAGE_NAME not set}"
 REGISTRY="${REGISTRY:-ghcr.io/KofTwentyTwo}"
 VERSION="${PROJECT_VERSION:?PROJECT_VERSION not set -- run export_version_vars first}"
 ENV_TAG="${DOCKER_ENV_TAG:-}"
-PUSH_IMAGES="${PUSH_IMAGES:-true}"
+# CircleCI renders a boolean orb parameter as "1"/"0" in a step environment, not
+# "true"/"false", so accept both spellings. Unset means push (release builds).
+case "$(echo "${PUSH_IMAGES-true}" | tr '[:upper:]' '[:lower:]')" in
+  true | 1 | yes | on) PUSH_IMAGES=true ;;
+  false | 0 | no | off | "") PUSH_IMAGES=false ;;
+  *)
+    echo "ERROR: PUSH_IMAGES must be true/false (or 1/0), got '${PUSH_IMAGES}'" >&2
+    exit 1
+    ;;
+esac
 # run_trivy_image installs here in a previous CircleCI step.
 export PATH="${HOME}/bin:${PATH}"
 mkdir -p /tmp/trivy-supplemental-results
diff --git a/tests/test_docker_scan.sh b/tests/test_docker_scan.sh
index 3ebf7b4..ab20f3d 100644
--- a/tests/test_docker_scan.sh
+++ b/tests/test_docker_scan.sh
@@ -80,6 +80,43 @@ else
   fail
 fi
 
+# Regression (0.3.5): CircleCI renders the boolean "push" parameter as "1"/"0" in
+# the step environment, and release builds silently skipped the push.
+for push in 1 true TRUE; do
+  echo -n "  TEST: push=${push} (release builds) publishes every supplemental image... "
+  : > "${CALL_LOG}"
+  if PUSH_IMAGES="${push}" bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
+    [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]] &&
+    grep -q '^docker push ghcr.io/example/app-migrations:' "${CALL_LOG}" &&
+    grep -q '^docker push ghcr.io/example/app-worker:' "${CALL_LOG}" &&
+    grep -q 'push=true' "${WORK}/supplemental.log"; then
+    pass
+  else
+    fail
+  fi
+done
+
+for push in 0 false ""; do
+  echo -n "  TEST: push='${push}' (PR scans) publishes nothing... "
+  : > "${CALL_LOG}"
+  if PUSH_IMAGES="${push}" bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
+    ! grep -Eq '^docker (push|tag) ' "${CALL_LOG}"; then
+    pass
+  else
+    fail
+  fi
+done
+
+echo -n "  TEST: an unrecognised push value fails instead of guessing... "
+: > "${CALL_LOG}"
+if PUSH_IMAGES=maybe bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" 2>&1; then
+  fail
+elif ! grep -Eq '^docker (build|tag|push) ' "${CALL_LOG}" && grep -q "must be true/false" "${WORK}/supplemental.log"; then
+  pass
+else
+  fail
+fi
+
 for push in false true; do
   echo -n "  TEST: push=${push} fails on HIGH/CRITICAL findings before any push... "
   : > "${CALL_LOG}"
-- 
2.54.0