fix(sdk): return a single version tag when a commit has multiple tags

[Jiri Appl (jiria)]

Problem

Build acl-pr.20260817.1184334 failed the Build ACL Base Image task on every RPM image leg (amd64 + aarch64, Azure + QEMU) with:

###### Writing versionfile 'sdk_container/.repo/manifests/version.txt' to SDK '4459.0.0', OS '3.0.20260706
3.0.20260809+3.0-1153684
3.0-1179296'. ######

###### Creating a new container 'flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684
3.0.20260809-3.0-1179296' ######

Error response from daemon: Invalid container name
(flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684
3.0.20260809-3.0-1179296), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed

Root cause

acl/build_rpm_image.sh invokes run_sdk_container without -v, so the OS version falls back to get_git_version():

local tag="$(git tag --points-at HEAD)"

git tag --points-at prints one line per tag. Two ACL releases were cut from the same aclmain commit:

$ git tag --points-at origin/aclmain
3.0.20260706-3.0-1153684
3.0.20260809-3.0-1179296

So os_version became a two-line string. strip_version_prefix() then amplified it — vernum_from_version() and build_id_from_version() use sed -n ...p, which also emits one line per match — yielding the exact three-line value seen in the log. run_sdk_container interpolates that into the container name, and Docker rejects it.

Nothing in the PR under test caused this: the build broke the moment a second release tag landed on the already-tagged aclmain commit.

Fix

• get_git_version() picks the highest version tag deterministically via git for-each-ref --count=1 --sort=-v:refname, with no pipeline, so a git failure is never masked by a trailing tail/head; the git describe fallback is left unpiped so its exit status still propagates.
• Defense in depth: vernum_from_version() and build_id_from_version() are clamped with head -n 1, so no caller-supplied version (e.g. via -v) can reintroduce a multi-line container name.

Single-tag behaviour is unchanged.

Validation

Exercised the version helpers against the real failing tag set:

=== failing case: commit carrying two release tags ===
strip_version_prefix -> [3.0.20260706+3.0-1153684]
container name       -> [flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684]
RESULT: VALID docker container name

=== regression: single-line inputs unchanged ===
3.0.20260809-3.0-1179296   vernum=[3.0.20260809] build=[3.0-1179296] strip=[3.0.20260809+3.0-1179296]
alpha-3244.0.1-nightly2    vernum=[3244.0.1]     build=[nightly2]    strip=[3244.0.1+nightly2]
3244.0.1                   vernum=[3244.0.1]     build=[]            strip=[3244.0.1]
3244.0.1+build7            vernum=[3244.0.1]     build=[build7]      strip=[3244.0.1+build7]

=== get_git_version() on the real multi-tag commit ===
get_git_version picks: [3.0.20260809-3.0-1179296]

bash -n sdk_lib/sdk_container_common.sh passes.

[Copilot]

Pull request overview

This PR hardens SDK/OS version derivation in sdk_lib/sdk_container_common.sh to prevent multi-line version strings (e.g., when a commit is annotated with multiple release tags) from propagating into the versionfile and Docker container names, which can break container creation.

Changes:

• Update get_git_version() to deterministically select a single tag when HEAD has multiple tags.
• Clamp version parsing helpers (vernum_from_version(), build_id_from_version()) to a single output line to prevent multi-line fragments from propagating.
• Clamp the git describe fallback output to one line.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.