fix: align testing channel metadata

Make the build tag authoritative for image branch and version metadata.
Avoid hard-coded stable image tags and add regression coverage.

3 files changed, 34 insertions, 4 deletions

diff --git a/Justfile b/Justfile
index 0d8772c..96b988f 100644
--- a/Justfile
+++ b/Justfile
@@ -130,7 +130,17 @@ build $target_image=image_name $tag=default_tag:
 
     BUILD_ARGS=()
     LABELS=()
-    for arg in BASE_IMAGE IMAGE_BRANCH VERSION_TAG VERSION_PRETTY FLATPAK_REMOTE_URL HOMEBREW_BOTTLE_DOMAIN HOMEBREW_API_DOMAIN OSTREE_IMAGE_REF INSTRUMENTS_ENABLED INSTRUMENTS_RELEASE_REPOSITORY INSTRUMENTS_VERSION INSTRUMENTS_RELEASE_API_BASE; do
+    # The recipe tag is the channel selected by commands such as
+    # `just build localhost/aerocore-os testing`. Keep the image's internal
+    # channel/version metadata aligned with that tag instead of allowing a
+    # stale dotenv value (for example, `stable`) to leak into the image.
+    BUILD_CHANNEL_ARGS=(
+        "--build-arg" "IMAGE_BRANCH={{ tag }}"
+        "--build-arg" "VERSION_TAG={{ tag }}"
+        "--build-arg" "VERSION_PRETTY={{ tag }}"
+    )
+
+    for arg in BASE_IMAGE FLATPAK_REMOTE_URL HOMEBREW_BOTTLE_DOMAIN HOMEBREW_API_DOMAIN OSTREE_IMAGE_REF INSTRUMENTS_ENABLED INSTRUMENTS_RELEASE_REPOSITORY INSTRUMENTS_VERSION INSTRUMENTS_RELEASE_API_BASE; do
         if [[ -n "${!arg:-}" ]]; then
             BUILD_ARGS+=("--build-arg" "${arg}=${!arg}")
         fi
@@ -142,7 +152,7 @@ build $target_image=image_name $tag=default_tag:
         LABELS+=("--label" "org.opencontainers.image.documentation=https://raw.githubusercontent.com/{{ repo_organization }}/{{ image_name }}/${GIT_SHA}/README.md")
         LABELS+=("--label" "org.opencontainers.image.source=https://github.com/{{ repo_organization }}/{{ image_name }}/blob/${GIT_SHA}/Containerfile")
         LABELS+=("--label" "org.opencontainers.image.url=https://github.com/{{ repo_organization }}/{{ image_name }}/tree/${GIT_SHA}")
-        LABELS+=("--label" "org.opencontainers.image.version={{ VERSION_TAG }}-${GIT_SHA}")
+        LABELS+=("--label" "org.opencontainers.image.version={{ tag }}-${GIT_SHA}")
     fi
 
     # Image metadata for https://artifacthub.io/ - This is optional but is highly recommended so we all can get a index of all the custom images
@@ -158,7 +168,7 @@ build $target_image=image_name $tag=default_tag:
     LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}")
 
     # This actually builds the image!
-    PODMAN_BUILD_ARGS=("${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile)
+    PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile)
 
     podman build "${PODMAN_BUILD_ARGS[@]}" .
 
diff --git a/build_files/image-info b/build_files/image-info
index ae4406a..46d4326 100755
--- a/build_files/image-info
+++ b/build_files/image-info
@@ -31,7 +31,7 @@ cat > "$IMAGE_INFO" <<EOF
   "image-name": "$IMAGE_NAME",
   "image-vendor": "$IMAGE_VENDOR",
   "image-ref": "$IMAGE_REF",
-  "image-tag": "stable",
+  "image-tag": "$IMAGE_BRANCH_NORMALIZED",
   "image-branch": "$IMAGE_BRANCH_NORMALIZED",
   "base-image-name": "$BASE_IMAGE_NAME",
   "fedora-version": "$FEDORA_VERSION",
diff --git a/tests/test-build-channel-metadata.sh b/tests/test-build-channel-metadata.sh
new file mode 100644
index 0000000..75a2827
--- /dev/null
+++ b/tests/test-build-channel-metadata.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# The build recipe's positional tag must be authoritative for channel
+# metadata. This protects `just build ... testing` from stale dotenv values.
+grep -Fqx '        "--build-arg" "IMAGE_BRANCH={{ tag }}"' "${repo_root}/Justfile"
+grep -Fqx '        "--build-arg" "VERSION_TAG={{ tag }}"' "${repo_root}/Justfile"
+grep -Fqx '        "--build-arg" "VERSION_PRETTY={{ tag }}"' "${repo_root}/Justfile"
+grep -Fqx '        LABELS+=("--label" "org.opencontainers.image.version={{ tag }}-${GIT_SHA}")' "${repo_root}/Justfile"
+grep -Fqx '  "image-tag": "$IMAGE_BRANCH_NORMALIZED",' "${repo_root}/build_files/image-info"
+
+if grep -Fq '  "image-tag": "stable",' "${repo_root}/build_files/image-info"; then
+  echo 'image-info must not hard-code stable as the image tag' >&2
+  exit 1
+fi
+
+echo 'Build channel metadata checks passed'