Image reference and tag always with `latest`

[mathieu-benoit]

I'm using this action like this in PRs:

- uses: docker/scout-action
  with:
    command: compare
    image: local://score-compose:pr-382
    to: local://score-compose:main
    write-comment: true
    organization: my-org-redacted

But I always get this latest tag in there for both Image reference and - tag:

Am I missing something? Is it because local:// is used?

Knowing that both images are built locally as part of this CI pipeline, right before running this action above, docker images is successfully showing this:

IMAGE                           ID             DISK USAGE   CONTENT SIZE   EXTRA
moby/buildkit:buildx-stable-1   de10faf919fc        333MB          104MB   U    
score-compose:main              cfe135566a0a         26MB         7.07MB        
score-compose:pr-382            62c1fc0545ca         26MB         7.06MB

[mathieu-benoit]

Knowing that looking at the logs in the CI, I can see this:

      ...Storing image for indexing
      ✓ Image stored for indexing
      ✓ SBOM obtained from attestation, 53 packages found
      ✓ Provenance obtained from attestation
      ...Storing image for indexing
      ✓ Image stored for indexing
      ✓ SBOM obtained from attestation, 53 packages found
      ✓ Provenance obtained from attestation
      ...Evaluating policies
      ✓ Policy evaluation completed
      ...Evaluating policies
      ✓ Policy evaluation completed
    
    
    ## Overview
    
                        │               Analyzed Image                │              Comparison Image                
    ────────────────────┼─────────────────────────────────────────────┼──────────────────────────────────────────────
      Target            │  local://score-compose:pr-382               │  local://score-compose:main                  
        digest          │  b87d714273e7                               │  6b354a22e9d5                                
        tag             │  latest                                     │  latest                                      
        platform        │ linux/amd64                                 │ linux/amd64                                  
        provenance      │ https://github.com/score-spec/score-compose │ https://github.com/score-spec/score-compose  
                        │  baef40dd7bc6ae58da92c6b3a89e2853a430b04d   │  a6f7bd5e76a5d4cd05555c657025ca059e13b681    
        vulnerabilities │    0C     0H     0M     0L                  │    0C     0H     0M     0L                   
                        │                                             │                                              
        size            │ 6.3 MB (-1 B)                               │ 6.3 MB                                       
        packages        │ 53                                          │ 53                                           
                        │                                             │

Target and digest values are good, but tag values are not.

[mathieu-benoit]

Also, if I try to reproduce locally (Docker Scout version v1.18.4), like this docker scout compare --to local://score-compose:main local://score-compose:local, I'll get a successful result:

    ✓ Image stored for indexing
    ✓ Indexed 54 packages
    ✓ Provenance obtained from attestation
    ✓ Image stored for indexing
    ✓ Indexed 54 packages
    ✓ Provenance obtained from attestation
  
  
  ## Overview
  
                      │               Analyzed Image                │              Comparison Image                
  ────────────────────┼─────────────────────────────────────────────┼──────────────────────────────────────────────
    Target            │  local://score-compose:local                │  local://score-compose:main                  
      digest          │  7c69985ff90d                               │  61053c1f716c                                
      tag             │  local                                      │  main                                        
      platform        │ linux/amd64                                 │ linux/amd64                                  
      provenance      │ https://github.com/score-spec/score-compose │ https://github.com/score-spec/score-compose  
                      │  6754253723cfb45e0a289c49a0c2d7a30bf204dc   │  6754253723cfb45e0a289c49a0c2d7a30bf204dc    
      vulnerabilities │    0C     0H     0M     0L                  │    0C     0H     0M     0L                   
                      │                                             │                                              
      size            │ 6.3 MB (-6 B)                               │ 6.3 MB                                       
      packages        │ 54                                          │ 54

So the issue really seems to be with the tag field/values via the GitHub Action action, wrongly propagated to the associated CLI?