`docker scout attestation add` SIGSEVs without tag

Start with internal/attestations/create.go at the reported line and the command entry point in internal/commands/attest/add.go. Reproduce the command with an image reference ending in an empty tag, then trace the nil-pointer path. Done means the command returns a proper error message instead of panicking for this input.

Describe the bug

Running docker scout attestation add panics with a nil pointer dereference but no proper output if an empty tag is given.

To Reproduce

docker scout attestation add --file sboms/sbom.oci.cdx.json --predicate-type https://cyclonedx.org/bom/v1.6 <my-image>:

Be aware that there is nothing after the colon. It was a variable interpolation issue, but the message was not helping.

Expected behavior

A proper error message is given.

Actual behavior

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x10d985d]
goroutine 1 [running]:
github.com/google/go-containerregistry/pkg/v1/remote.(*Puller).get(0x31adf7a6d100, {0x79fa088, 0x31adf8b80210}, {0x0, 0x0}, {0x31adf84de000, 0x6, 0x8}, {{0x684181f, 0x5}, ...})
	/home/runner/go/pkg/mod/github.com/docker/go-containerregistry@v0.0.0-20260402085319-b08b4d306dec/pkg/v1/remote/puller.go:98 +0x5d
github.com/google/go-containerregistry/pkg/v1/remote.get({0x0, 0x0}, {0x31adf84de000, 0x6, 0x8}, {0x31adf8b80240?, 0x426f91?, 0x7fc5667cabe8?})
	/home/runner/go/pkg/mod/github.com/docker/go-containerregistry@v0.0.0-20260402085319-b08b4d306dec/pkg/v1/remote/descriptor.go:97 +0x19c
github.com/google/go-containerregistry/pkg/v1/remote.Get(...)
	/home/runner/go/pkg/mod/github.com/docker/go-containerregistry@v0.0.0-20260402085319-b08b4d306dec/pkg/v1/remote/descriptor.go:73
github.com/docker/scout-cli-plugin/internal/attestations.Create({0x79fa088, 0x31adf8b80210}, {0x31adf87969b0, 0x1, 0x5}, {0x7ffd81c16948, 0x1e}, {0x31adf897f9c8, 0x1, 0x1}, ...)
	/home/runner/work/scout-cli-plugin/scout-cli-plugin/internal/attestations/create.go:122 +0x2df
github.com/docker/scout-cli-plugin/internal/commands/attest.newAddCmd.func2(0x0?, {0x0?, 0x0?, 0xf93af256f658ac8d?})
	/home/runner/work/scout-cli-plugin/scout-cli-plugin/internal/commands/attest/add.go:72 +0x2be
github.com/docker/cli/cli-plugins/plugin.RunPlugin.func1.1.2(0x31adf8a41b08, {0x31adf87969b0, 0x1, 0x5})
	/home/runner/go/pkg/mod/github.com/docker/cli@v29.5.0+incompatible/cli-plugins/plugin/plugin.go:65 +0x64
github.com/spf13/cobra.(*Command).execute(0x31adf8a41b08, {0x31adf867e830, 0x5, 0x5})
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.10.2/command.go:1015 +0xb14
github.com/spf13/cobra.(*Command).ExecuteC(0x31adf8a46f08)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.10.2/command.go:1148 +0x465
github.com/spf13/cobra.(*Command).Execute(...)
	/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.10.2/command.go:1071
github.com/docker/cli/cli-plugins/plugin.RunPlugin(0x31adf89cf400, 0x31adf85ee308, {{0x684175c, 0x5}, {0x68744b6, 0xb}, {0x31adf7cf3679, 0x7}, {0x6883e51, 0xc}, ...})
	/home/runner/go/pkg/mod/github.com/docker/cli@v29.5.0+incompatible/cli-plugins/plugin/plugin.go:80 +0x158
main.runPlugin(0x31adf89cf400)
	/home/runner/work/scout-cli-plugin/scout-cli-plugin/cmd/docker-scout/main.go:30 +0x18a
main.main()
	/home/runner/work/scout-cli-plugin/scout-cli-plugin/cmd/docker-scout/main.go:57 +0x176

Environment

Scout version: v1.23.1 (go1.26.3 - linux/amd64)
Docker CLI: v29.5.0
OS: Linux amd64