Filter out "-env"-containing tags from CVE remediation (#251)

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Author: antgamdia

.github/scripts/cve-scan-helper-remediation.sh

@@ -187,8 +187,8 @@ find_compatible_upgrade() {
       continue
     fi
 
-    # Skip internal testing tags with -env suffix (e.g., "720-env")
-    if [[ "$tag" =~ -env$ ]]; then
+    # Skip internal testing tags containing -env as a segment (e.g., "720-env", "3501-env-prod")
+    if [[ "$tag" =~ -env($|-) ]]; then
       continue
     fi
 

.github/scripts/tests/cve-scan-helper-remediation.bats

@@ -240,8 +240,8 @@ setup() {
 @test "find_compatible_upgrade: skips internal -env tags" {
   # Current: 2.0.0
   # Available: internal -env tags, valid versions
-  # Should return: 2.1.0 (skips 720-env, 718-env)
-  local tags=("720-env" "2.1.0" "718-env" "2.0.0")
+  # Should return: 2.1.0 (skips 720-env, 718-env, 3501-env-prod)
+  local tags=("720-env" "2.1.0" "718-env" "3501-env-prod" "2.0.0")
   local result
   result=$(find_compatible_upgrade "2.0.0" "${tags[@]}")
 
@@ -250,9 +250,9 @@ setup() {
 
 @test "find_compatible_upgrade: returns empty when only -env tags are newer" {
   # Current: 2.0.0
-  # Available: 720-env, 718-env (newer but -env), 2.0.0 (equal, not an upgrade)
+  # Available: 720-env, 718-env, 3501-env-prod (all -env variants, filtered), 2.0.0 (equal, not an upgrade)
   # Should return: empty (-env tags must never be selected as upgrade target)
-  local tags=("720-env" "718-env" "2.0.0")
+  local tags=("720-env" "718-env" "3501-env-prod" "2.0.0")
   local result
   result=$(find_compatible_upgrade "2.0.0" "${tags[@]}")