@@ -497,28 +497,14 @@ jobs:
497497 if [[ "${{ github.ref == 'refs/heads/main' }}" == "true" ]]; then
498498 skopeo copy --all --authfile "${REGISTRY_AUTH_FILE}" "oci-archive:${image_path}" "docker://${IMAGE}"
499499
500- # Verify the registry actually holds what we built — skopeo copy can
501- # succeed while silently publishing an incomplete result (missing --all
502- # drops non-native-arch manifests without erroring), so compare the
503- # published manifest against the local artifact rather than trusting
504- # the exit code alone. Index and single-arch images need different
505- # comparisons: an index has no useful top-level digest of its own, so
506- # we compare per-platform digests instead; a plain manifest has no
507- # platform list, so we compare its config/layer digests directly.
508500 LOCAL_RAW=$(skopeo inspect --raw "oci-archive:${image_path}")
509501 REMOTE_RAW=$(skopeo inspect --raw --authfile "${REGISTRY_AUTH_FILE}" "docker://${IMAGE}")
510502
511503 if echo "$LOCAL_RAW" | jq -e '.manifests' >/dev/null 2>&1; then
512- # Multi-arch index: compare platform+digest pairs. Attestation
513- # manifests (no real platform, arch reported as "unknown") are
514- # excluded so they don't pad out an otherwise-empty comparison.
515504 JQ_FILTER='[.manifests[] | select(.platform.architecture and .platform.architecture != "unknown") | {arch: .platform.architecture, digest: .digest}] | sort_by(.arch)'
516505 LOCAL=$(echo "$LOCAL_RAW" | jq -c "$JQ_FILTER")
517506 REMOTE=$(echo "$REMOTE_RAW" | jq -c "$JQ_FILTER")
518507 else
519- # Single-arch manifest: compare config + layer digests structurally
520- # rather than raw bytes, since the registry may re-serialize the
521- # manifest on push without changing its actual content.
522508 JQ_FILTER='{config: .config.digest, layers: [.layers[].digest]}'
523509 LOCAL=$(echo "$LOCAL_RAW" | jq -c "$JQ_FILTER")
524510 REMOTE=$(echo "$REMOTE_RAW" | jq -c "$JQ_FILTER")
0 commit comments