From 76fb95497964d3952a0f8682878ca72cb0925d86 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 24 Apr 2026 16:07:28 -0700
Subject: [PATCH] fix(ci): disable buildx provenance to fix ACR Standard push
 (400)

ACR Standard SKU does not support OCI image indexes containing buildx
attestation manifests, causing docker/build-push-action to fail with
'400 Bad Request' on the manifest HEAD/PUT step.

Set provenance: false on all docker/build-push-action@v6 steps in:
  - .github/workflows/docker-build-and-push.yml
  - .github/workflows/job-docker-build.yml

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/docker-build-and-push.yml | 3 +++
 .github/workflows/job-docker-build.yml      | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/docker-build-and-push.yml b/.github/workflows/docker-build-and-push.yml
index 06410dd2..32b61af0 100644
--- a/.github/workflows/docker-build-and-push.yml
+++ b/.github/workflows/docker-build-and-push.yml
@@ -92,6 +92,7 @@ jobs:
           context: ./src/backend-api
           file: ./src/backend-api/Dockerfile
           push: ${{ github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix') }}
+          provenance: false
           tags: |
             ${{ steps.registry.outputs.ext_registry }}/backend-api:${{ env.BASE_TAG }}
             ${{ steps.registry.outputs.ext_registry }}/backend-api:${{ env.DATE_TAG }}
@@ -102,6 +103,7 @@ jobs:
           context: ./src/processor
           file: ./src/processor/Dockerfile
           push: ${{ github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix') }}
+          provenance: false
           tags: |
             ${{ steps.registry.outputs.ext_registry }}/processor:${{ env.BASE_TAG }}
             ${{ steps.registry.outputs.ext_registry }}/processor:${{ env.DATE_TAG }}
@@ -112,6 +114,7 @@ jobs:
           context: ./src/frontend
           file: ./src/frontend/Dockerfile
           push: ${{ github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'hotfix') }}
+          provenance: false
           tags: |
             ${{ steps.registry.outputs.ext_registry }}/frontend:${{ env.BASE_TAG }}
             ${{ steps.registry.outputs.ext_registry }}/frontend:${{ env.DATE_TAG }}
\ No newline at end of file
diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml
index b197eabe..682ba697 100644
--- a/.github/workflows/job-docker-build.yml
+++ b/.github/workflows/job-docker-build.yml
@@ -67,6 +67,7 @@ jobs:
           context: ./src/backend-api
           file: ./src/backend-api/Dockerfile
           push: true
+          provenance: false
           tags: |
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/backend-api:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/backend-api:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
@@ -79,6 +80,7 @@ jobs:
           context: ./src/processor
           file: ./src/processor/Dockerfile
           push: true
+          provenance: false
           tags: |
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/processor:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/processor:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
@@ -91,6 +93,7 @@ jobs:
           context: ./src/frontend
           file: ./src/frontend/Dockerfile
           push: true
+          provenance: false
           tags: |
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/frontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/frontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}