`bakery update files` accepts `--image-name` and `--image-version` as
optional filters. When neither is given, it silently re-renders every
image and every version in the project. There is no warning, dry-run,
or confirmation, so an accidental unscoped invocation touches unrelated
image versions across the whole repo.
This is undocumented as a footgun only in project skill/AGENTS files
(advisory), not enforced by the tool itself.
Fix: require the caller to explicitly opt in to the full-repo render,
mirroring the existing `--matrix-versions include/exclude` pattern on
`bakery build`. Add an `--all` flag; fail fast with a clear error if
no `--image-name`, `--image-version`, or `--all` is given.
`bakery update files` accepts `--image-name` and `--image-version` as
optional filters. When neither is given, it silently re-renders every
image and every version in the project. There is no warning, dry-run,
or confirmation, so an accidental unscoped invocation touches unrelated
image versions across the whole repo.
This is undocumented as a footgun only in project skill/AGENTS files
(advisory), not enforced by the tool itself.
Fix: require the caller to explicitly opt in to the full-repo render,
mirroring the existing `--matrix-versions include/exclude` pattern on
`bakery build`. Add an `--all` flag; fail fast with a clear error if
no `--image-name`, `--image-version`, or `--all` is given.