fix(replacetags): stop deleting split-image blocks with no tag source match

[taleodor-claude]

Two bugs in the bitnami / tag-as-digest path of devops replacetags, both reachable from a plain run. Found while pinning image digests in the Dependency-Track 5 helm chart (relizaio/rearm#227), whose subchart expresses a digest through the tag field.

1. Unmatched blocks were deleted

An image written as separate registry / repository / tag keys is claimed by validateAndParseBitnamiLines, which only emits lines when it found a substitution for that image. With no match it returned an empty slice while still reporting the block as handled — so parseBitnamiLines took it at its word and the whole block disappeared from the output, comments, pullPolicy and pullSecrets included.

It fails silently and the file still parses, so it shows up later as the chart quietly falling back to whatever the subchart ships.

Not hypothetical — running replacetags over the ReARM chart's own values with a tag source that happens not to carry the postgres image:

$ rearm devops replacetags --infile deploy/helm/rearm-helm/values.yaml \
    --tagsource unrelated.txt --type text
174,194d173      # 21 lines of postgresql.image gone

Any chart processed with a partial tag source is exposed, not just the one that surfaced it.

Such a block is now handed back unclaimed (return nil, false) so it flows through the normal line-by-line path like any other content — preserved, and still open to property and secret resolution. That seemed better than returning the lines verbatim from the bitnami path, which would have skipped that resolution.

2. Digest-only references produced an invalid tag

A source reference carrying a digest but no tag left replacedSubst.Tag empty and wrote:

tag: @sha256:bbbb...        # renders repo:@sha256:... -- not a valid reference

Charts that take a digest through the tag field accept a bare sha256:... (the Dependency-Track v2 chart documents exactly that), so that is what is written when there is no tag to combine:

tag: sha256:bbbb...

Tests

Two added, both verified to fail without the fix:

• TestReplaceTagsTagAsDigest — tag source covers one of two images; the matched block is rewritten and the unmatched one comes through untouched
• TestReplaceTagsTagAsDigestWithoutTag — digest-only source yields a bare digest

The existing nine still pass, so the full-bitnami and sha-field shapes are unaffected.

Also re-checked end to end with a locally built binary: the ReARM chart values are now preserved byte for byte (bar the trailing newline the CLI always adds), the DT5 chart values are untouched by a non-matching source, and a matching source still replaces every image as before.

🤖 Generated with Claude Code