fix: tag CEL Function return correct tag when tag and digest are present

Author: lukeelten

cel/libs/image/impl.go

@@ -1,6 +1,8 @@
 package image
 
 import (
+	"strings"
+
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/go-containerregistry/pkg/name"
@@ -67,6 +69,16 @@ func imageTag(arg ref.Val) ref.Val {
 	if !ok {
 		return types.MaybeNoSuchOverloadErr(arg)
 	}
+
+	// Workaround for upstream not detecting the tag correctly when tag and digest are both present.
+	// See https://github.com/google/go-containerregistry/issues/2069
+	original := v.String()
+	if strings.Contains(original, "@") {
+		parts := strings.Split(original, "@")
+		tagWithoutDigest := parts[0]
+		v, _ = name.NewTag(tagWithoutDigest, name.StrictValidation)
+	}
+
 	var tag string
 	if v, ok := v.(name.Tag); ok {
 		tag = v.TagStr()

cel/libs/image/lib_test.go

@@ -186,6 +186,11 @@ func TestImage(t *testing.T) {
 			expr:        `parseImageReference("registry.k8s.io/kube-apiserver-arm64:testtag").tag()`,
 			expectValue: types.String("testtag"),
 		},
+		{
+			name:        "tag_with_digest",
+			expr:        `parseImageReference("registry.k8s.io/kube-apiserver-arm64:testtag@sha256:6aefddb645ee6963afd681b1845c661d0ea4c3b20ab9db86d9e753b203d385f2").tag()`,
+			expectValue: types.String("testtag"),
+		},
 		{
 			name:        "default_tag",
 			expr:        `parseImageReference("registry.k8s.io/kube-apiserver-arm64").tag()`,

core/resulters/transformer_test.go

@@ -78,16 +78,20 @@ func TestTransformer_ImplementsResulter(t *testing.T) {
 		P string
 		I int
 		O bool
-	} { return struct {
-		P string
-		I int
-		O bool
-	}{policy, in, out} }
+	} {
+		return struct {
+			P string
+			I int
+			O bool
+		}{policy, in, out}
+	}
 	result := func(s []struct {
 		P string
 		I int
 		O bool
-	}) int { return len(s) }
+	}) int {
+		return len(s)
+	}
 	inner := NewAppender[string, int, struct {
 		P string
 		I int

extensions/policy/engine_test.go

@@ -60,7 +60,8 @@ func TestNewEngine_Handle_PropagatesEvaluationError(t *testing.T) {
 }
 
 // ensureEngineResultType compiles only if the engine has the expected result type.
-func ensureEngineResultType(_ core.Engine[map[string]bool, string, defaults.Result[accessPolicy, map[string]bool, string, Evaluation[bool]]]) {}
+func ensureEngineResultType(_ core.Engine[map[string]bool, string, defaults.Result[accessPolicy, map[string]bool, string, Evaluation[bool]]]) {
+}
 
 func TestNewEngine_ResultTypeMatchesDefaults(t *testing.T) {
 	src := core.MakeSource(accessPolicy{})