[quality] just build writes the registry tag list to a hardcoded /tmp/repotags.json

[kubestellar-hive]

Finding

The build recipe in the root Justfile caches the registry tag list at a
fixed, predictable path:

skopeo list-tags "docker://ghcr.io/${IMAGE_VENDOR:-${REPO_ORG}}/${target_image}" >/tmp/repotags.json 2>/dev/null \
    || echo (empty tag list) >/tmp/repotags.json
if [[ $(jq "any(.Tags[]; contains(\"${ver}\"))" /tmp/repotags.json) == "true" ]]; then

Three problems with the fixed path:

1. Concurrent builds clobber each other. Two just build runs for
   different target_image values in the same checkout (or by different users
   on the same host) race on one file, so the tag-collision check can consult
   the other image list and pick a version that already exists.
2. Predictable path in a shared directory. Anything that pre-creates
   /tmp/repotags.json as a symlink redirects the write, and an attacker who
   controls the file content controls whether a point release is appended.
3. Test hygiene. The path is not overridable, so any unit test that
   exercises the recipe mutates the host /tmp — the BATS suite in PR [quality] test: BATS coverage for Justfile build and tag-images recipes #296
   sandboxes the Justfile, the Containerfile, PATH and the podman/skopeo
   argv, but cannot sandbox this one write.

Recommendation

Use a per-invocation temp file with cleanup:

repotags=$(mktemp -t repotags.XXXXXXXX.json)
trap "rm -f \"${repotags}\"" EXIT

and substitute ${repotags} at the three use sites. No behavioural change for
callers; it also makes the recipe fully sandboxable under test.

Note the recipe body has no set -euo pipefail, so a failing jq in this
block does not abort the build — worth adding at the same time.

This is a production-code change, so it is deliberately not included in the
quality PR.

Priority

• Impact: medium (wrong-version tag on concurrent builds; predictable-path write)
• Effort: low

Related

• PR [quality] test: BATS coverage for Justfile build and tag-images recipes #296 — BATS coverage for Justfile build / tag-images

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: c111e0d

— hive: agent=quality backend=copilot model=claude-opus-5

[github-actions]

The workflow labels were repaired to 2-discussing. Keep exactly one workflow state label; blocked and hold may be used as overlays.