fix: fail closed on incomplete weekly image and CVE surveys

cc-ci-plan/test-resolve-images.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Offline regressions for the weekly image survey's false-current cases."""
+
+import importlib.util
+import pathlib
+import unittest
+from unittest import mock
+
+HERE = pathlib.Path(__file__).resolve().parent
+spec = importlib.util.spec_from_file_location("resolve_images", HERE / "resolve-images.py")
+resolver = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(resolver)
+
+
+class TestResolverCoverage(unittest.TestCase):
+    def test_cryptpad_calver_tag_is_found_independently_of_abra(self):
+        with mock.patch.object(resolver, "list_tags", return_value=(
+            ["version-2026.5.1", "version-2026.10.0", "opendesk-2026.08.04"], None)):
+            row = resolver.resolve("cryptpad/cryptpad:version-2026.5.1")
+        self.assertTrue(row["upgrade_available"])
+        self.assertEqual(row["newest_same_shape"], "version-2026.10.0")
+
+    def test_floating_and_templated_tags_cannot_prove_current(self):
+        with mock.patch.object(resolver, "list_tags", return_value=(["alpine", "1.2.3"], None)):
+            floating = resolver.resolve("atmoz/sftp:alpine")
+        templated = resolver.resolve("ghost:${IMAGE_VERSION}-alpine")
+        self.assertTrue(floating["status"].startswith("unverifiable:"))
+        self.assertTrue(templated["status"].startswith("skipped:"))
+
+    def test_truncated_registry_listing_cannot_prove_current(self):
+        with mock.patch.object(resolver, "list_tags", return_value=(["1.2.3"], None)):
+            with mock.patch.object(resolver, "_HUB_TRUNCATED", {"library/example"}):
+                row = resolver.resolve("example:1.2.3")
+        self.assertTrue(row["status"].startswith("unverifiable:"))
+
+
+if __name__ == "__main__":
+    unittest.main()