fix(common): apply registry override to image args

pkg/reconciler/common/testdata/test-replace-image.yaml

@@ -17,7 +17,8 @@ spec:
           name: controller-deployment
           args: [
             "-bash-image", "busybox",
-            "-nop=nop"
+            "-nop=nop",
+            "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver"
           ]
         - image: busybox
           name: sidecar

pkg/reconciler/common/transformers.go

@@ -321,23 +321,32 @@ func replaceContainerImages(containers []corev1.Container, images map[string]str
 			containers[i].Image = overrideImageRegistry(registry, containers[i].Image)
 		}
 
-		replaceContainersArgsImage(&container, images)
+		replaceContainersArgsImage(&container, images, registry)
 	}
 }
 
-func replaceContainersArgsImage(container *corev1.Container, images map[string]string) {
+// replaceContainersArgsImage replaces image references passed as container
+// args (e.g. "-workingdirinit-image", "gcr.io/..."). If no per-image env var
+// matches a given "*-image*" flag (e.g. "-shell-image-win"), it falls back
+// to rewriting just the registry domain, so TEKTON_REGISTRY_OVERRIDE alone
+// also applies to arg-based images and not only to container.Image.
+func replaceContainersArgsImage(container *corev1.Container, images map[string]string, registry string) {
 	for a, arg := range container.Args {
 		if argVal, hasArg := SplitsByEqual(arg); hasArg {
 			argument := formKey(ArgPrefix, argVal[0])
 			if url, exist := images[argument]; exist {
 				container.Args[a] = argVal[0] + "=" + url
+			} else if strings.Contains(argument, "_image") {
+				container.Args[a] = argVal[0] + "=" + overrideImageRegistry(registry, argVal[1])
 			}
 			continue
 		}
 
 		argument := formKey(ArgPrefix, arg)
 		if url, exist := images[argument]; exist {
 			container.Args[a+1] = url
+		} else if strings.Contains(argument, "_image") {
+			container.Args[a+1] = overrideImageRegistry(registry, container.Args[a+1])
 		}
 	}
 }

pkg/reconciler/common/transformers_test.go

@@ -277,6 +277,27 @@ func TestDeploymentImagesRegistryOverrideFallback(t *testing.T) {
 	assertDeployContainersHasImage(t, newManifest.Resources(), "sidecar", "custom-registry.io/custom-path/busybox")
 }
 
+func TestDeploymentContainerArgsImagesRegistryOverrideFallback(t *testing.T) {
+	t.Setenv("TEKTON_REGISTRY_OVERRIDE", "custom-registry.io/custom-path")
+	// no per-image env var matches any arg in the manifest
+	images := map[string]string{
+		"some_other_image": "foo.bar/unrelated",
+	}
+	testData := path.Join("testdata", "test-replace-image.yaml")
+
+	manifest, err := mf.ManifestFrom(mf.Recursive(testData))
+	assertNoError(t, err)
+	newManifest, err := manifest.Transform(DeploymentImages(images))
+	assertNoError(t, err)
+	// "-bash-image" ends in "-image", so the registry override fallback applies.
+	assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-bash-image", "custom-registry.io/custom-path/busybox")
+	// "-shell-image-win" contains "-image" but doesn't end with it (real example
+	// from the Tekton Pipeline controller manifest); the fallback must still apply.
+	assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-shell-image-win", "custom-registry.io/custom-path/powershell:nanoserver")
+	// "-git" does not look like an image flag and must be left untouched.
+	assertDeployContainerArgsHasImage(t, newManifest.Resources(), "-git", "git")
+}
+
 func TestTaskImagesRegistryOverrideFallback(t *testing.T) {
 	t.Setenv("TEKTON_REGISTRY_OVERRIDE", "custom-registry.io/custom-path")
 	images := map[string]string{}