fix: clean sed backups via EXIT trap; deterministic apply order

Install an EXIT trap removing Containerfile .bak files so a sed failure
mid-apply (die path) cannot strand backup files on disk; the redundant
per-file rm in the loop is folded into the trap.

Iterate the apply phase over MANAGED_ARGS in declaration order instead
of undefined associative-array key order, matching the plan and report
loops and removing a latent ordering hazard.

Add a regression test asserting no .bak files remain after an update.

Signed-off-by: Jonathan Springer <jps@s390x.com>

Author: jonpspri

scripts/container-bump-image-versions.sh

@@ -116,19 +116,20 @@ main() {
     fi
 
     # ---- Apply phase ----
-    for arg in "${!new_tag[@]}"; do
+    # sed -i.bak leaves the backup behind if it fails mid-write; remove any
+    # stray backups on exit, including the die path, so nothing leaks.
+    trap 'rm -f "${CONTAINERFILE_PATH}.bak" "${WHEELS_CONTAINERFILE_PATH}.bak"' EXIT
+    for arg in "${MANAGED_ARGS[@]}"; do
+        [ -n "${new_tag[$arg]:-}" ] || continue
         local files=("$CONTAINERFILE_PATH")
         # UBI_MINIMAL is pinned in both Containerfiles; keep them identical.
         if [ "$arg" = "UBI_MINIMAL" ]; then
             files+=("$WHEELS_CONTAINERFILE_PATH")
         fi
         local f
         for f in "${files[@]}"; do
-            if sed -i.bak "s|^ARG ${arg}=.*|ARG ${arg}=${image_of[$arg]}:${new_tag[$arg]}|" "$f"; then
-                rm -f "${f}.bak"
-            else
-                die "failed to update ${arg} in $f"
-            fi
+            sed -i.bak "s|^ARG ${arg}=.*|ARG ${arg}=${image_of[$arg]}:${new_tag[$arg]}|" "$f" \
+                || die "failed to update ${arg} in $f"
             echo "  updated $f"
         done
     done

tests/scripts/container-bump-image-versions.bats

@@ -175,6 +175,17 @@ write_tags() {  # write_tags <fixture-name> <tag>...
     cmp "$WHEELS_CONTAINERFILE_PATH" "$TEST_DIR/wheels.Containerfile.orig"
 }
 
+@test "leaves no sed backup files behind after an update" {
+    write_tags ubi10.json        "10.2-1784669000"
+    write_tags nodejs.json       "10.2-1784669001"
+    write_tags ubi-minimal.json  "10.2-1784669047"
+
+    run "$SCRIPT"
+    [ "$status" -eq 0 ]
+    [ ! -e "${CONTAINERFILE_PATH}.bak" ]
+    [ ! -e "${WHEELS_CONTAINERFILE_PATH}.bak" ]
+}
+
 @test "refuses to manage a pin that is not a full build tag" {
     sed -i.bak 's|^ARG UBI_BASE=.*|ARG UBI_BASE=registry.access.redhat.com/ubi10:latest|' "$CONTAINERFILE_PATH"
     rm -f "${CONTAINERFILE_PATH}.bak"