fix: write only tag when field path ends in .tag

When callers use the staffbase-application Helm chart, the image field
is split into image.repository and image.tag. Writing the full URI
(registry/image:tag) as a scalar to spec.values.workload.container.image
replaces the mapping and causes the chart to render 'image: :'.

If the field path ends in .tag, write only INPUT_TAG (e.g. dev-abc123)
instead of the full IMAGE URI. The repository stays in the base
HelmRelease untouched.

Backwards compatible: no existing Apperator-style caller uses a field
path ending in .tag. All existing callers receive the full URI as before.

Callers migrating to staffbase-application chart use:
  spec.values.workload.container.image.tag

instead of:
  spec.values.workload.container.image

Assisted-by: pi:claude-sonnet-4-5

Author: asadk23

scripts/lib/gitops-functions.sh

@@ -36,7 +36,11 @@ update_file() {
   echo "Check if path ${file} ${field} exists and get old current version"
   yq -e ."${field}" "${file}"
   echo "Run update ${file} ${field} ${image}"
-  yq -i ."${field}"=\""${image}"\" "${file}"
+  if [[ "${field}" == *.tag ]]; then
+    yq -i ."${field}"=\"${INPUT_TAG}\" "${file}"
+  else
+    yq -i ."${field}"=\""${image}"\" "${file}"
+  fi
 
   echo "Writing deployment annotations to ${file}"
   yq -i '.metadata.annotations["deploy.staffbase.com/repositoryFullName"] = "'"${GITHUB_REPOSITORY}"'"' "${file}"

tests/lib-gitops-functions.bats

@@ -51,6 +51,22 @@ teardown() {
 
 # --- update_file ---
 
+@test "update_file writes full image URI for non-.tag field paths" {
+  update_file "deployment.yaml" "spec.template.spec.containers.app.image" "$IMAGE"
+  grep -q "${IMAGE}" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
+@test "update_file writes only tag portion for field paths ending in .tag" {
+  update_file "helmrelease.yaml" "spec.values.workload.container.image.tag" "$IMAGE"
+  grep -q ".spec.values.workload.container.image.tag=\"${INPUT_TAG}\"" "${TEST_TEMP_DIR}/yq_calls.log"
+  ! grep -q "registry.staffbase.com" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
+@test "update_file does not write full URI to .tag field" {
+  update_file "helmrelease.yaml" "spec.values.workload.container.image.tag" "$IMAGE"
+  ! grep -q "${IMAGE}" "${TEST_TEMP_DIR}/yq_calls.log"
+}
+
 @test "update_file calls yq to check and update field" {
   update_file "deployment.yaml" "spec.image" "$IMAGE"
   assert [ -f "${TEST_TEMP_DIR}/yq_calls.log" ]