From 932acf744927bcf0096de584ef54058e68b1cd51 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 13:50:28 +0000 Subject: [PATCH 1/5] Initial plan From 7c67e50bef037f4c23be72c78e549c92952957e7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 13:53:54 +0000 Subject: [PATCH 2/5] Fix GHCR rate limit failure with retry in build-and-push workflow Co-authored-by: mythz <89361+mythz@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index caa63fe..7b7e78c 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -63,21 +63,25 @@ jobs: - name: Build and push Docker image id: build - uses: docker/build-push-action@v5 + uses: Wandalen/wretry.action@v3 with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 + action: docker/build-push-action@v6 + with: | + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64,linux/arm64 + attempt_limit: 3 + attempt_delay: 60000 - name: Generate artifact attestation if: github.event_name != 'pull_request' uses: actions/attest-build-provenance@v1 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ steps.build.outputs.digest }} + subject-digest: ${{ fromJSON(steps.build.outputs.outputs).digest }} push-to-registry: true From 475c57f5c5c2495eb01e2ed64438ee41b617d9d1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 13:55:07 +0000 Subject: [PATCH 3/5] Add explicit digest extraction with validation for attestation step Co-authored-by: mythz <89361+mythz@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 7b7e78c..6ce9fb5 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -77,11 +77,22 @@ jobs: attempt_limit: 3 attempt_delay: 60000 + - name: Extract build digest + id: digest + if: github.event_name != 'pull_request' + run: | + DIGEST=$(echo '${{ steps.build.outputs.outputs }}' | jq -r '.digest') + if [ -z "$DIGEST" ] || [ "$DIGEST" = "null" ]; then + echo "ERROR: Could not extract image digest from build outputs" + exit 1 + fi + echo "digest=$DIGEST" >> $GITHUB_OUTPUT + - name: Generate artifact attestation if: github.event_name != 'pull_request' uses: actions/attest-build-provenance@v1 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ fromJSON(steps.build.outputs.outputs).digest }} + subject-digest: ${{ steps.digest.outputs.digest }} push-to-registry: true From f39d8d89d0184a99c9af7be09cc28c01fb1ab74b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 14:07:27 +0000 Subject: [PATCH 4/5] Fix multiline metadata inputs in docker publish workflow Co-authored-by: mythz <89361+mythz@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 6ce9fb5..03d2b29 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -69,8 +69,10 @@ jobs: with: | context: . push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} + tags: | + ${{ steps.meta.outputs.tags }} + labels: | + ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max platforms: linux/amd64,linux/arm64 @@ -95,4 +97,3 @@ jobs: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.digest.outputs.digest }} push-to-registry: true - From 1a17d65a112bdec2b578736601f4087386ef7501 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 18 Aug 2026 14:07:58 +0000 Subject: [PATCH 5/5] Harden digest extraction in docker publish workflow Co-authored-by: mythz <89361+mythz@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 03d2b29..2518f17 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -82,8 +82,10 @@ jobs: - name: Extract build digest id: digest if: github.event_name != 'pull_request' + env: + BUILD_OUTPUTS: ${{ steps.build.outputs.outputs }} run: | - DIGEST=$(echo '${{ steps.build.outputs.outputs }}' | jq -r '.digest') + DIGEST=$(printf '%s' "$BUILD_OUTPUTS" | jq -r '.digest') if [ -z "$DIGEST" ] || [ "$DIGEST" = "null" ]; then echo "ERROR: Could not extract image digest from build outputs" exit 1