fix: resolve BASE_REPO variable scope issue

[dcolina]

Problem

The BASE_REPO variable was only defined inside the repository allowlist validation block (step 3), but it was being used later in the image existence check (step 5). This caused the variable to be empty when verify_image_existence was enabled, leading to validation failures.

Root Cause

In the image validation loop:

• BASE_REPO extraction logic was inside the if [ -n "$ALLOWED_REPOS" ] block (lines 433-440)
• The image existence check at line 524 used CANONICAL_IMAGE="${BASE_REPO}:${TAG}"
• When ALLOWED_REPOS was set, BASE_REPO was defined and everything worked
• However, the variable was being used outside its scope, which is a logic error

Solution

• Move BASE_REPO extraction logic outside the conditional block (before step 4)
• Now BASE_REPO is always available for both repository validation and image existence check
• Update step numbering in comments: steps 4-7 instead of 3-5
• Add explicit logging of BASE_REPO value for debugging

Changes

# 2. Extract repository and tag
REPO="${image%:*}"
TAG="${image##*:}"

+# 3. Extract base repository name (always, needed for multiple validations)
+BASE_REPO="$REPO"
+if [[ "$REPO" =~ / ]]; then
+  if [[ "$REPO" =~ ^[a-z0-9.-]+\.[a-z]{2,}/ ]] || [[ "$REPO" =~ ^gcr\.io/ ]] || [[ "$REPO" =~ ^.*\.gcr\.io/ ]]; then
+    BASE_REPO="${REPO#*/}"
+  fi
+fi
+echo "   Base repository: $BASE_REPO"
+
-# 3. Check repository is in allowlist (if configured)
+# 4. Check repository is in allowlist (if configured)
if [ -n "$ALLOWED_REPOS" ]; then
-  BASE_REPO="$REPO"  # ← Was only defined here
-  if [[ "$REPO" =~ / ]]; then
-    ...
-  fi
  ...
fi

Testing

This fixes the validation failure in PR #362 where the image existence check was failing due to empty BASE_REPO variable.

After this fix is merged and v1.1.1 tag is recreated, PR #362 should pass all validations.

Related

• Fixes issue discovered in deutschebank-infrastructure PR #362
• Related to fix: resolve subshell issue in image validation loop #15 (subshell fixes)
• Related to fix: resolve second subshell issue in image-only validation #16 (second subshell fix)