chore: do not push -arch tags and use digests instead

Author: nox-404

.github/workflows/merge.yaml

@@ -40,14 +40,26 @@ jobs:
         env:
           ARCH: ${{ matrix.arch }}
           TAG: ${{ github.sha }}
-          IMAGE_TAG: ${{ needs.prepare.outputs.branch }}
+      - name: Upload digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: digests-${{ matrix.arch }}
+          path: digests/*
+          if-no-files-found: error
+          retention-days: 1
 
   manifest:
     needs: [prepare, build]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+      - name: Download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: digests
+          pattern: digests-*
+          merge-multiple: true
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Docker login

.github/workflows/release.yml

@@ -53,14 +53,26 @@ jobs:
         env:
           ARCH: ${{ matrix.arch }}
           TAG: ${{ needs.prepare.outputs.tag }}
-          IMAGE_TAG: ${{ needs.prepare.outputs.tag }}
+      - name: Upload digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: digests-${{ matrix.arch }}
+          path: digests/*
+          if-no-files-found: error
+          retention-days: 1
 
   manifest:
     needs: [prepare, build]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+      - name: Download digests
+        uses: actions/download-artifact@v8
+        with:
+          path: digests
+          pattern: digests-*
+          merge-multiple: true
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
       - name: Docker login
@@ -74,4 +86,4 @@ jobs:
           IMAGE_TAG: ${{ needs.prepare.outputs.tag }}
       - name: Create latest manifest
         if: needs.prepare.outputs.is_highest == 'true'
-        run: make docker-manifest IMAGE_TAG=latest SOURCE_TAG=${{ needs.prepare.outputs.tag }}
+        run: make docker-manifest IMAGE_TAG=latest

Makefile

@@ -12,7 +12,6 @@ FULL_IMAGE ?= $(REGISTRY)/$(IMAGE)
 
 TAG ?= $(shell git rev-parse HEAD)
 IMAGE_TAG ?= $(shell git rev-parse HEAD)
-SOURCE_TAG ?= $(IMAGE_TAG)
 COMMIT_SHA ?= $(shell git rev-parse HEAD)
 
 DOCKER_CLI_EXPERIMENTAL ?= enabled
@@ -44,12 +43,16 @@ docker-build:
 .PHONY: docker-push-arch
 docker-push-arch:
 	@echo "Building and pushing scaleway-cloud-controller-manager for $(ARCH)"
-	docker buildx build . --platform=linux/$(ARCH) --build-arg TAG=$(TAG) --build-arg COMMIT_SHA=$(COMMIT_SHA) --build-arg BUILD_DATE=$(BUILD_DATE) --push -t $(FULL_IMAGE):$(IMAGE_TAG)-$(ARCH)
+	mkdir -p digests
+	docker buildx build . --platform=linux/$(ARCH) --build-arg TAG=$(TAG) --build-arg COMMIT_SHA=$(COMMIT_SHA) --build-arg BUILD_DATE=$(BUILD_DATE) \
+		--output type=image,name=$(FULL_IMAGE),push=true,push-by-digest=true,name-canonical=true \
+		--metadata-file digests/$(ARCH).json
+	jq -r '."containerimage.digest"' digests/$(ARCH).json > digests/$(ARCH)
 
 .PHONY: docker-manifest
 docker-manifest:
-	@echo "Creating manifest $(FULL_IMAGE):$(IMAGE_TAG) from $(foreach arch,$(ARCHS),$(FULL_IMAGE):$(SOURCE_TAG)-$(arch))"
-	docker buildx imagetools create -t $(FULL_IMAGE):$(IMAGE_TAG) $(foreach arch,$(ARCHS),$(FULL_IMAGE):$(SOURCE_TAG)-$(arch))
+	@echo "Creating manifest $(FULL_IMAGE):$(IMAGE_TAG) from $(foreach arch,$(ARCHS),digests/$(arch))"
+	docker buildx imagetools create -t $(FULL_IMAGE):$(IMAGE_TAG) $(foreach arch,$(ARCHS),$(FULL_IMAGE)@$(shell cat digests/$(arch)))
 
 .PHONY: docker-push-all
 docker-push-all: