fix: do not panic on an invalid image name regexp

IsImageMatched interpolates the image name from kustomization images[].name
straight into a regexp and discarded the compile error. When the name is not
a valid regexp (for example "["), regexp.Compile returns a nil *Regexp and
the following MatchString call dereferences it, so kustomize build crashes with
a SIGSEGV.

Capture the compile error and return false when it is set. A name that can't
compile matches no image, which leaves the resource untouched (the same result
you get for any name that doesn't match). Adds a unit test for the invalid name
and a krusty end-to-end case that builds without panicking.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

api/internal/image/image.go

@@ -21,7 +21,14 @@ func IsImageMatched(s, t string) bool {
 	// using any OCI-valid digest algorithm match consistently with Split,
 	// which accepts any algorithm.
 	// See https://github.com/opencontainers/image-spec/blob/main/descriptor.md#digests
-	pattern, _ := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@[a-zA-Z0-9]+([.+_-][a-zA-Z0-9]+)*:[a-zA-Z0-9_.{}-]*)?$")
+	// The name t comes from kustomization images[].name and is interpolated
+	// into the pattern directly, so it can be an invalid regexp (for example
+	// "["). When it fails to compile, treat it as matching nothing rather than
+	// dereferencing a nil *Regexp, which would panic during the build.
+	pattern, err := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@[a-zA-Z0-9]+([.+_-][a-zA-Z0-9]+)*:[a-zA-Z0-9_.{}-]*)?$")
+	if err != nil {
+		return false
+	}
 	return pattern.MatchString(s)
 }
 

api/internal/image/image_test.go

@@ -75,6 +75,14 @@ func TestIsImageMatched(t *testing.T) {
 			name:      "nginx",
 			isMatched: false,
 		},
+		{
+			// A name that is not a valid regexp must not panic. It can't
+			// compile, so it should simply match nothing.
+			testName:  "name is an invalid regexp",
+			value:     "nginx",
+			name:      "[",
+			isMatched: false,
+		},
 	}
 
 	for _, tc := range testCases {