From 6a3092b112cdaf05775fe1986917c21616779c55 Mon Sep 17 00:00:00 2001 From: Michael D'Angelo Date: Thu, 30 Jul 2026 14:13:02 -0700 Subject: [PATCH] fix: read container manifest digests without broken pipes --- .github/workflows/container-release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/container-release.yml b/.github/workflows/container-release.yml index 4609c5bf..cdb81f10 100644 --- a/.github/workflows/container-release.yml +++ b/.github/workflows/container-release.yml @@ -463,7 +463,7 @@ jobs: --tag "$candidate" \ "${references[@]}" - manifest_digest="$(docker buildx imagetools inspect "$candidate" | awk '/^Digest:/{print $2; exit}')" + manifest_digest="$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$candidate")" if [[ ! "$manifest_digest" =~ ^sha256:[[:xdigit:]]{64}$ ]]; then echo 'The registry did not return a valid multiarchitecture image digest.' >&2 exit 1 @@ -590,7 +590,7 @@ jobs: --tag "$IMAGE:latest" \ "$IMAGE@$MANIFEST_DIGEST" - actual_digest="$(docker buildx imagetools inspect "$IMAGE:$VERSION" | awk '/^Digest:/{print $2; exit}')" + actual_digest="$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$IMAGE:$VERSION")" if [[ "$actual_digest" != "$MANIFEST_DIGEST" ]]; then echo '::error::The promoted stable tag does not reference the verified and attested candidate digest.' exit 1