spectrum-cli 6.0.3 → 6.0.4

package/CHANGELOG.md

@@ -9,6 +9,12 @@ This is the changelog of the `spectrum-cli` npm package. Its version comes from
 `package.json`; the release commands use Git tags and `CHANGELOG.md` in the
 **target project** and do not update that project's `package.json`.
 
+## 🚀 [6.0.4] - 2026-10-29
+
+### Fixed
+
+- В Skopeo передаётся ссылка repository@digest без tag: устранена ошибка Docker references with both a tag and digest. Исходный tag сохраняется в отчёте для поиска обновлений runtime; порт registry не изменяется.
+
 ## 🚀 [6.0.3] - 2026-10-29
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spectrum-cli",
-  "version": "6.0.3",
+  "version": "6.0.4",
   "description": "🚀 Modern CLI for development workflow automation - release management, versioning, and changelog generation",
   "main": "index.js",
   "bin": {

package/src/security/scan.js

@@ -59,6 +59,17 @@ function runtimeFromDockerfile(text) {
   ensure(last, "No runtime FROM found");
   return last;
 }
+function skopeoImageReference(image) {
+  const at = image.indexOf("@");
+  if (at === -1) return image;
+  const name = image.slice(0, at),
+    digest = image.slice(at + 1);
+  ensure(DIGEST.test(digest), "Invalid runtime image digest");
+  const colon = name.lastIndexOf(":"),
+    slash = name.lastIndexOf("/");
+  // Strip the tag, never the registry port. Keep the original tag in report metadata.
+  return (colon > slash ? name.slice(0, colon) : name) + "@" + digest;
+}
 class Scanner {
   constructor(env = process.env, deps = {}) {
     this.env = env;
@@ -121,7 +132,7 @@ class Scanner {
       "inspect",
       "--format",
       "{{.Digest}}",
-      "docker://" + image,
+      "docker://" + skopeoImageReference(image),
     ]).stdout.trim();
     ensure(DIGEST.test(digest), "Registry did not return an image digest");
     return image.split("@")[0] + "@" + digest;
@@ -143,7 +154,7 @@ class Scanner {
         "--override-arch",
         platform.split("/")[1],
         "copy",
-        "docker://" + image,
+        "docker://" + skopeoImageReference(image),
         "oci:" + imagePath + ":runtime",
       ]);
       this.run([