fix: compute merged manifest digest from raw bytes instead of Go template

The --format '{{.Manifest.Digest}}' template doesn't work for OCI image
indexes. Use --raw | sha256sum to reliably compute the digest.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gugu

.github/workflows/build-agent.yml

@@ -156,7 +156,7 @@ jobs:
         id: manifest
         run: |
           TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
-          DIGEST=$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --format '{{.Manifest.Digest}}')
+          DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
           echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
 
       - name: Attest Merged Manifest Provenance

.github/workflows/build.yml

@@ -157,7 +157,7 @@ jobs:
         id: manifest
         run: |
           TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
-          DIGEST=$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --format '{{.Manifest.Digest}}')
+          DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
           echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
 
       - name: Attest Merged Manifest Provenance

.github/workflows/quay.yml

@@ -165,7 +165,7 @@ jobs:
         id: manifest
         run: |
           TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
-          DIGEST=$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --format '{{.Manifest.Digest}}')
+          DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
           echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
 
       - name: Attest Merged Manifest Provenance