fix: read container manifest digests without broken pipes - #161
Conversation
|
@codex review |
There was a problem hiding this comment.
Pull request overview
This PR updates the container release workflow to reliably capture the multi-architecture manifest digest without triggering early-exit awk pipelines (which can cause broken-pipe failures), keeping the existing digest validation and promotion checks intact.
Changes:
- Replace
docker buildx imagetools inspect | awk ...digest parsing withdocker buildx imagetools inspect --format '{{.Manifest.Digest}}'for the release-candidate manifest digest. - Apply the same formatted digest extraction for the post-promotion stable tag verification.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
Fix the first protected container release, which successfully published and verified both platform images but exited while extracting the provisional multi-architecture manifest digest.
awkpipelines with Docker Buildx's native--format "{{.Manifest.Digest}}"output.Verification
actionlint .github/workflows/container-release.ymlprettier --check .github/workflows/container-release.ymlsha256:ed65aa21030a21063795fe5410a6c2612e443cb932e27bcce217603848906f66for the publicly pullable amd64/arm64 candidate.0.1.4and runs as nonroot UID10001.