Filter out SHA OCI versions from CVE remediation (#237)

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Author: antgamdia

.github/scripts/cve-scan-helper-remediation.sh

@@ -182,6 +182,11 @@ find_compatible_upgrade() {
   local target_tag=""
 
   for tag in "${tag_array[@]}"; do
+    # Filter hex strings (7+ chars) containing at least one hex letter.
+    if [[ "$tag" =~ ^[A-Fa-f0-9]{7,}$ ]] && [[ "$tag" =~ [A-Fa-f] ]]; then
+      continue
+    fi
+
     parse_output=$(parse_version "$tag" 2>/dev/null) || continue
 
     local tag_version="${parse_output%|*}"

.github/scripts/tests/cve-scan-helper-remediation.bats

@@ -198,6 +198,45 @@ setup() {
   [ "$result" = "2.0.0" ]
 }
 
+@test "find_compatible_upgrade: skips Git SHAs of all lengths" {
+  # Current: 3.1.2
+  # Available: SHAs (7-char, 40-char SHA-1, 64-char SHA-256), valid versions
+  # Should return: 3.2.0 (all SHAs filtered, selects highest valid)
+  local tags=(
+    "abcdef7"  # 7-char short SHA
+    "7012366806370b50d3a915116d31ed373a1e8e70"  # 40-char SHA-1
+    "abc1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab"  # 64-char SHA-256
+    "3.2.0"
+    "3.1.3"
+  )
+  local result
+  result=$(find_compatible_upgrade "3.1.2" "${tags[@]}")
+
+  [ "$result" = "3.2.0" ]
+}
+
+@test "find_compatible_upgrade: returns empty when only SHAs available" {
+  # Current: 3.1.2
+  # Available: only SHAs (no valid versions)
+  # Should return: empty
+  local tags=("abc1234" "7012366806370b50d3a915116d31ed373a1e8e70")
+  local result
+  result=$(find_compatible_upgrade "3.1.2" "${tags[@]}")
+
+  [ -z "$result" ]
+}
+
+@test "find_compatible_upgrade: allows numeric-only tags" {
+  # Current: 20240101
+  # Available: numeric date tags (no letters), SHA (has letters)
+  # Should return: 20240707 (numeric tags allowed, SHAs filtered)
+  local tags=("20240707" "abc1234" "20240101" "1234567")
+  local result
+  result=$(find_compatible_upgrade "20240101" "${tags[@]}")
+
+  [ "$result" = "20240707" ]
+}
+
 # ============================================================================
 # verify-image step Tests
 # ============================================================================