`versionfilter: latest` Selects Older Image from AWS ECR Despite imagePushedAt Timestamp

[eMe-404]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The versionfilter of kind: latest is not correctly identifying the most recently published artifact when targeting a Helm chart in an AWS ECR repository.

When multiple image tags exist, the filter selects a version with an older imagePushedAt timestamp instead of the one with the newest timestamp, which contradicts the expected behavior of the latest filter.

Expected Behavior

Expected Behavior

UpdateCLI should select 2.3.0-Test-Promotion.1 as the result because its imagePushedAt timestamp is the most recent.

Actual Behavior

UpdateCLI incorrectly selects 1.5.0-Test-Promotion-troubleshooting-v5.2, which has an older imagePushedAt timestamp.

Supporting Evidence

The aws ecr describe-images command confirms the imagePushedAt timestamp for the incorrectly selected version is older:

{
  "imageDetails": [
    {
      "repositoryName": "atlas-helm/prometheus-agent",
      "imageTags": [ "1.5.0-Test-Promotion-troubleshooting-v5.2" ],
      "imagePushedAt": "2025-03-25T15:58:14.235000+08:00"
    }
  ]
}

This suggests the filter might not be correctly parsing or sorting by the imagePushedAt field from the ECR API response.

Steps To Reproduce

Steps to Reproduce

1. Configure an UpdateCLI source for an OCI Helm chart in AWS ECR using versionfilter: latest.

   sources:
     my-chart:
       kind: helmchart
       spec:
         url: "oci://<aws_account_id>.dkr.ecr.<region>.amazonaws.com/my-repo"
         name: "my-chart"
         auth:
           helm:
             username: "AWS"
             password: '{{ requiredEnv "ECR_TOKEN" }}'
         versionfilter:
           kind: latest

2. Ensure the repository contains at least two versions with different imagePushedAt timestamps, for example:
   • Version A: 2.3.0-Test-Promotion.1 (Pushed at: 2025-07-29)
   • Version B: 1.5.0-Test-Promotion-troubleshooting-v5.2 (Pushed at: 2025-03-25)
3. Run updatecli apply.

Environment

- OS:  Ubuntu 24.04.2
- updatecli: updatecli/updatecli-action@v2
Set default value for version to v0.104.0
VERSION

Application:	0.104.0
Golang     :	1.24.5 linux/amd64
Build Time :	2025-07-13T07:48:55Z

Pipeline Graph

Anything else?

No response

[olblak]

The challenge with the "latest" version is that it means different things depending on the OCI registry and not all of them provid "publishedat" information as it's not standard OCI.

Maybe you could use another versionfilter rule https://www.updatecli.io/docs/core/versionfilter/ such as regex/semver

[olblak]

Maybe something like

versionfilter:
    kind: regex/semver
    regex: '^(\d*\.\d*\.\d*)-Test-Promotion-*'

[eMe-404]

Thanks for the quick response and the suggestion.

The challenge with using a regex/semver filter is that our pre-release version names do not reliably sort in chronological order. Our workflow generates pre-release tags based on branch names, which can vary.

For example, we could have two pre-releases for the same base version:

• Version A: 2.3.0-A-Branch-Created-Version.1 (Pushed at: 2025-07-29)

• Version B: 2.3.0-B-Branch-Created-Version.1 (Pushed at: 2025-07-28)

In this scenario, a filter based on SemVer's alphabetical sorting would incorrectly identify Version B as "greater". However, our goal is to find Version A because it's the most recently published artifact.

This is why we believe versionfilter: latest is the correct tool for our use case, as it's designed to sort by publication timestamp. The issue we're facing is that it doesn't appear to be using the imagePushedAt timestamp from AWS ECR as expected.

[olblak]

I took a look and we leverage this library github.com/google/go-containerregistry which doesn't allow to sort tag based on some filter as explained on google/go-containerregistry#1142