Filter out "-env" suffixed tags from CVE remediation (#245)

Signed-off-by: Antonio Gamez Diaz <antonio.gamez@suse.com>

Author: antgamdia

.github/scripts/cve-scan-helper-remediation.sh

@@ -187,6 +187,11 @@ find_compatible_upgrade() {
       continue
     fi
 
+    # Skip internal testing tags with -env suffix (e.g., "720-env")
+    if [[ "$tag" =~ -env$ ]]; then
+      continue
+    fi
+
     parse_output=$(parse_version "$tag" 2>/dev/null) || continue
 
     local tag_version="${parse_output%|*}"

.github/scripts/tests/cve-scan-helper-remediation.bats

@@ -237,6 +237,28 @@ setup() {
   [ "$result" = "20240707" ]
 }
 
+@test "find_compatible_upgrade: skips internal -env tags" {
+  # Current: 2.0.0
+  # Available: internal -env tags, valid versions
+  # Should return: 2.1.0 (skips 720-env, 718-env)
+  local tags=("720-env" "2.1.0" "718-env" "2.0.0")
+  local result
+  result=$(find_compatible_upgrade "2.0.0" "${tags[@]}")
+
+  [ "$result" = "2.1.0" ]
+}
+
+@test "find_compatible_upgrade: returns empty when only -env tags are newer" {
+  # Current: 2.0.0
+  # Available: 720-env, 718-env (newer but -env), 2.0.0 (equal, not an upgrade)
+  # Should return: empty (-env tags must never be selected as upgrade target)
+  local tags=("720-env" "718-env" "2.0.0")
+  local result
+  result=$(find_compatible_upgrade "2.0.0" "${tags[@]}")
+
+  [ -z "$result" ]
+}
+
 # ============================================================================
 # verify-image step Tests
 # ============================================================================