Skip to content

Publish one manifest and propagate tags by digest#24

Merged
Danathar merged 4 commits into
mainfrom
copilot/publish-determinism
Jul 2, 2026
Merged

Publish one manifest and propagate tags by digest#24
Danathar merged 4 commits into
mainfrom
copilot/publish-determinism

Conversation

Copilot AI commented Jul 2, 2026

Copy link
Copy Markdown

Run 143 failed correctly: podman's sequential multi-tag push emitted different manifest bytes for latest vs the date tags, producing an inconsistent tag set that the verify step caught.

Root cause: redhat-actions/push-to-registry called once with all tags pushes each tag as a separate operation, and podman can produce distinct manifests across calls.

Fix: Push a single tag (latest), then copy that manifest to the remaining tags server-side with skopeo copy --preserve-digests. Tag identity becomes structural rather than asserted.

Changes:

  • .github/workflows/build.yml

    • Push To GHCR: hardcode tags: latest instead of the full tag list
    • Add "Propagate tags from the pushed digest" step immediately after push — iterates steps.metadata.outputs.tags, skips latest, copies each via:
      skopeo copy --preserve-digests \
        "docker://${IMAGE_REGISTRY}/${IMAGE_NAME}@${digest}" \
        "docker://${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}"
      --preserve-digests makes skopeo fail rather than rewrite the manifest, so the existing verify step passes by construction
    • Verify and sign steps are untouched
  • README.md — sync the publish-flow description

Replace the hardcoded latest in the push step and the propagation skip
with the existing DEFAULT_TAG env knob so the single-push scheme keeps
working if the default tag ever changes, and reword the step comment to
describe the observed per-push manifest divergence instead of citing a
run number.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@Danathar
Danathar marked this pull request as ready for review July 2, 2026 18:30
@Danathar
Danathar merged commit 52d01d2 into main Jul 2, 2026
1 check failed
@Danathar
Danathar deleted the copilot/publish-determinism branch July 2, 2026 22:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants