[dd-Splunk]

Summary

• --image REF reads the Splunk version from a container image tag (splunk/splunk:9.4.2, 10.6.1-rhel9, registry ports, digests). latest, untagged images and unexpanded variables warn and skip the compatibility check; combining it with --splunk-version is a usage error. Prints a note: naming the version it used.
• --cloud only picks releases marked Splunk Cloud compatible; JSON output gains cloud_compatible (true/false/null). Implemented in both the Python and bash scripts.
• The description claimed Kubernetes support. The Splunk Operator installs apps from S3/Azure/GCP storage (App Framework), not Splunkbase URLs, so the claim is dropped and Kubernetes is routed away in SKILL.md, metadata.splunk.not-for and the Docker reference.
• Docker reference re-verified against docker-splunk (README, APP_INSTALL, entrypoint.sh), Docker Hub tags and the operator docs. Findings: SPLUNK_GENERAL_TERMS is only required from 10.x images (9.x does not check it), only linux/amd64 is published, comma-separated SPLUNK_APPS_URL and the two credential variables are confirmed. An unverified @splunk.com login claim was removed. Sources added to references/sources.md.
• Version bumped to 2.2.0 with a changelog entry.

Test plan

• python3 -m unittest discover -s tests: 124 tests, 7 live ones skipped
• New contract tests run against both Python and bash (cloud filter, cloud + version, null cloud field, image tag cases, registry port and digest, latest/untagged/variable, usage error, -q)
• Unit tests for the tag parser and select_release(cloud_only=...)
• SPLUNKBASE_LIVE=1 live tests pass against the real API, including a new check that cloud_compatible is a boolean
• New bash options checked under macOS /bin/bash 3.2
• shellcheck and ruff clean

🤖 Generated with Claude Code