Reset the manifest source list between nightly and release merges (#136)

combine-images.bash accumulated the per-arch source images in a single
`sources` array shared across both merge_images calls, and never reset it. The
nightly merge ran first and left nightly-amd64 and nightly-arm64 in the array;
the release merge then appended release-amd64 and release-arm64 and published
the release manifest from all four, nightly entries first. Docker resolves a
multi-arch tag to the first image matching the host platform, so pulling any of
these :release images returned the nightly build on both amd64 and arm64 -- and
projects using them for release CI were compiling against nightly ponyc.

Resetting the array at the start of each merge fixes every affected variant:
libressl-4.2.0, libressl-4.2.1, openssl-3.6.0, openssl-3.6.2, openssl-4.0.0. The
plain standard-builder and -with-pcre build multi-arch directly and were never
affected.

Author: SeanTAllen

standard-builder-with-libressl-4.2.0/combine-images.bash

@@ -23,6 +23,11 @@ check_image() {
 
 merge_images() {
   local TAG="$1"
+  # Reset the accumulator each call: check_image appends to it, so without this
+  # the release merge reuses the nightly per-arch images collected by the
+  # nightly merge and publishes all four under the release manifest, leaving
+  # :release resolve to the nightly image on each platform.
+  sources=()
   echo "Checking available architecture images for ${NAME}:$TAG"
 
   check_image "${NAME}:${TAG}-amd64"

standard-builder-with-libressl-4.2.1/combine-images.bash

@@ -23,6 +23,11 @@ check_image() {
 
 merge_images() {
   local TAG="$1"
+  # Reset the accumulator each call: check_image appends to it, so without this
+  # the release merge reuses the nightly per-arch images collected by the
+  # nightly merge and publishes all four under the release manifest, leaving
+  # :release resolve to the nightly image on each platform.
+  sources=()
   echo "Checking available architecture images for ${NAME}:$TAG"
 
   check_image "${NAME}:${TAG}-amd64"

standard-builder-with-openssl-3.6.0/combine-images.bash

@@ -23,6 +23,11 @@ check_image() {
 
 merge_images() {
   local TAG="$1"
+  # Reset the accumulator each call: check_image appends to it, so without this
+  # the release merge reuses the nightly per-arch images collected by the
+  # nightly merge and publishes all four under the release manifest, leaving
+  # :release resolve to the nightly image on each platform.
+  sources=()
   echo "Checking available architecture images for ${NAME}:$TAG"
 
   check_image "${NAME}:${TAG}-amd64"

standard-builder-with-openssl-3.6.2/combine-images.bash

@@ -23,6 +23,11 @@ check_image() {
 
 merge_images() {
   local TAG="$1"
+  # Reset the accumulator each call: check_image appends to it, so without this
+  # the release merge reuses the nightly per-arch images collected by the
+  # nightly merge and publishes all four under the release manifest, leaving
+  # :release resolve to the nightly image on each platform.
+  sources=()
   echo "Checking available architecture images for ${NAME}:$TAG"
 
   check_image "${NAME}:${TAG}-amd64"

standard-builder-with-openssl-4.0.0/combine-images.bash

@@ -23,6 +23,11 @@ check_image() {
 
 merge_images() {
   local TAG="$1"
+  # Reset the accumulator each call: check_image appends to it, so without this
+  # the release merge reuses the nightly per-arch images collected by the
+  # nightly merge and publishes all four under the release manifest, leaving
+  # :release resolve to the nightly image on each platform.
+  sources=()
   echo "Checking available architecture images for ${NAME}:$TAG"
 
   check_image "${NAME}:${TAG}-amd64"