feat: expose image digest in GraphQL

integration_tests/instance_groups.lua

@@ -18,6 +18,7 @@ Test.gql("Application with instance groups", function(t)
 							image {
 								name
 								tag
+								digest
 							}
 							readyInstances
 							desiredInstances
@@ -45,6 +46,7 @@ Test.gql("Application with instance groups", function(t)
 									image = {
 										name = "ghcr.io/navikt/myapp",
 										tag = "v1.2.3",
+										digest = Null,
 									},
 									readyInstances = 2,
 									desiredInstances = 2,

integration_tests/k8s_resources/vulnerability/dev/slug-1/app.yaml

@@ -1,7 +1,7 @@
+---
 apiVersion: nais.io/v1alpha1
 kind: Application
 metadata:
   name: app-with-vulnerabilities
 spec:
   image: europe-north1-docker.pkg.dev/nais/navikt/app-name:latest@sha256:deadbeef
----

integration_tests/k8s_resources/vulnerability_digest_only/dev/slug-1/app.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: nais.io/v1alpha1
+kind: Application
+metadata:
+  name: app-with-digest-only
+spec:
+  image: europe-north1-docker.pkg.dev/nais/navikt/app-name@sha256:cafebabe

integration_tests/vulnerabilities.lua

@@ -55,6 +55,7 @@ Test.gql("List vulnerability summaries for team", function(t)
 					image{
 					  name
 					  tag
+					  digest
 					  hasSBOM
 				  sbom {
 					status
@@ -84,7 +85,8 @@ Test.gql("List vulnerability summaries for team", function(t)
 						{
 							image = {
 								name = "europe-north1-docker.pkg.dev/nais/navikt/app-name",
-								tag = "latest@sha256:deadbeef",
+								tag = "latest",
+								digest = "sha256:deadbeef",
 								hasSBOM = true,
 								sbom = {
 									status = "READY",

integration_tests/vulnerability_digest_only.lua

@@ -0,0 +1,39 @@
+Helper.readK8sResources("k8s_resources/vulnerability_digest_only")
+
+local team = Team.new("slug-1", "purpose", "#channel")
+local user = User.new("authenticated", "authenticated@example.com", "some-id")
+
+Test.gql("Digest-only image exposes empty tag and populated digest", function(t)
+	t.addHeader("x-user-email", user:email())
+	t.query(string.format([[
+		{
+			team(slug: "%s") {
+				environment(name: "%s") {
+					workload(name: "%s") {
+						image {
+							name
+							tag
+							digest
+						}
+					}
+				}
+			}
+		}
+	]], team:slug(), "dev", "app-with-digest-only"))
+
+	t.check {
+		data = {
+			team = {
+				environment = {
+					workload = {
+						image = {
+							name = "europe-north1-docker.pkg.dev/nais/navikt/app-name",
+							tag = "",
+							digest = "sha256:cafebabe",
+						},
+					},
+				},
+			},
+		},
+	}
+end)

internal/graph/schema/workloads.graphqls

@@ -205,10 +205,16 @@ type ContainerImage implements Node & ActivityLogger {
 	name: String!
 
 	"""
-	Tag of the container image.
+	Tag of the container image. Empty when the image reference has no explicit tag,
+	for example when it is referenced by digest only.
 	"""
 	tag: String!
 
+	"""
+	Digest of the container image, if present.
+	"""
+	digest: String
+
 	"""
 	Activity log associated with the container image.
 	"""

internal/vulnerability/fake/fakedata.go

@@ -75,9 +75,7 @@ func createFakeData(ctx context.Context) *fakeData {
 }
 
 func createWorkloadSummary(env, team, workloadType, name, image string, vulnFactor int32) *vulnerabilities.WorkloadSummary {
-	parsedImage := workload.ParseContainerImage(image)
-	imageName := parsedImage.Name
-	imageTag := parsedImage.Tag
+	imageName, imageTag := workload.FormatImageReferenceForLookup(image)
 	summary := &vulnerabilities.Summary{
 		Critical:    vulnFactor,
 		High:        vulnFactor * 2,

internal/vulnerability/queries.go

@@ -886,36 +886,19 @@ func normalizeWorkloadTypeForVulnerabilityIdent(workloadType string) string {
 // splitImage splits an image reference into name, tag, and sha components.
 // Tag defaults to "latest" if not specified. SHA is optional and will be empty if not present.
 func splitImage(image string) (name, tag, sha string, hasExplicitTag bool) {
-	before, after, ok := strings.Cut(image, "@")
-	if ok {
-		image = before
-		sha = after
-	}
-	// Only look for a tag colon in the final path segment to avoid splitting
-	// on a registry port (e.g. "myregistry.io:5000/myimage").
-	lastSlash := strings.LastIndex(image, "/")
-	segment := image[lastSlash+1:]
-	if before, after, ok := strings.Cut(segment, ":"); ok {
-		name = image[:lastSlash+1] + before
-		tag = after
-		hasExplicitTag = true
-	} else {
-		name = image
+	parsed := workload.ParseImageReference(image)
+	name = parsed.Name
+	tag = parsed.Tag
+	sha = parsed.Digest
+	hasExplicitTag = parsed.HasExplicitTag
+	if tag == "" {
 		tag = "latest"
 	}
 	return name, tag, sha, hasExplicitTag
 }
 
 func splitImageRefForLookup(image string) (name, tag string) {
-	name, tag, sha, hasExplicitTag := splitImage(image)
-	if sha != "" {
-		if hasExplicitTag && tag != "" {
-			return name, tag + "@" + sha
-		}
-		return name, sha
-	}
-
-	return name, tag
+	return workload.FormatImageReferenceForLookup(image)
 }
 
 func GetSbomStatus(ctx context.Context, ref string) (SBOMStatus, error) {

internal/vulnerability/queries_test.go

@@ -59,6 +59,13 @@ func TestSplitImage(t *testing.T) {
 			wantTag:  "v2.0.0",
 			wantSha:  "sha256:deadbeef",
 		},
+		{
+			name:     "image with nested path sha and no tag",
+			image:    "europe-north1-docker.pkg.dev/my-project/my-repo/my-app@sha256:deadbeef",
+			wantName: "europe-north1-docker.pkg.dev/my-project/my-repo/my-app",
+			wantTag:  "latest",
+			wantSha:  "sha256:deadbeef",
+		},
 		{
 			name:     "simple image name only",
 			image:    "nginx",
@@ -122,6 +129,13 @@ func TestSplitImage(t *testing.T) {
 			wantTag:  "latest",
 			wantSha:  "sha256:abc123",
 		},
+		{
+			name:     "registry with port nested path tag and sha",
+			image:    "myregistry.io:5000/org/repo/myimage:v2.0.0@sha256:abc123",
+			wantName: "myregistry.io:5000/org/repo/myimage",
+			wantTag:  "v2.0.0",
+			wantSha:  "sha256:abc123",
+		},
 	}
 
 	for _, tt := range tests {
@@ -183,6 +197,24 @@ func TestSplitImageRefForLookup(t *testing.T) {
 			wantName: "myregistry.io/myimage",
 			wantTag:  "v1.2.3@sha256:abc123",
 		},
+		{
+			name:     "image with nested path and no tag defaults to latest",
+			image:    "europe-north1-docker.pkg.dev/my-project/my-repo/my-app",
+			wantName: "europe-north1-docker.pkg.dev/my-project/my-repo/my-app",
+			wantTag:  "latest",
+		},
+		{
+			name:     "image with nested path sha and no tag",
+			image:    "europe-north1-docker.pkg.dev/my-project/my-repo/my-app@sha256:deadbeef",
+			wantName: "europe-north1-docker.pkg.dev/my-project/my-repo/my-app",
+			wantTag:  "sha256:deadbeef",
+		},
+		{
+			name:     "image with nested path tag and sha",
+			image:    "europe-north1-docker.pkg.dev/my-project/my-repo/my-app:v2.0.0@sha256:deadbeef",
+			wantName: "europe-north1-docker.pkg.dev/my-project/my-repo/my-app",
+			wantTag:  "v2.0.0@sha256:deadbeef",
+		},
 		{
 			name:     "registry with port and tag",
 			image:    "myregistry.io:5000/myimage:v1",
@@ -201,6 +233,18 @@ func TestSplitImageRefForLookup(t *testing.T) {
 			wantName: "myregistry.io:5000/myimage",
 			wantTag:  "v1@sha256:abc123",
 		},
+		{
+			name:     "registry with port nested path and tag",
+			image:    "myregistry.io:5000/org/repo/myimage:v2.0.0",
+			wantName: "myregistry.io:5000/org/repo/myimage",
+			wantTag:  "v2.0.0",
+		},
+		{
+			name:     "registry with port nested path tag and sha",
+			image:    "myregistry.io:5000/org/repo/myimage:v2.0.0@sha256:abc123",
+			wantName: "myregistry.io:5000/org/repo/myimage",
+			wantTag:  "v2.0.0@sha256:abc123",
+		},
 	}
 
 	for _, tt := range tests {