From 2fafd35b3e576f77cc342296061141e2eb8bb438 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 19 May 2026 09:45:38 -0600
Subject: [PATCH 1/3] Push stable tags as plain images instead of manifest
 lists

The `docker buildx imagetools create` command wraps the single-arch
amd64 image in a manifest list, which prevents arm64 clients (e.g.
Apple Silicon) from pulling it even with emulation. Switch back to
docker pull/tag/push so stable tags behave the same as latest tags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/promote-stable.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/promote-stable.yaml b/.github/workflows/promote-stable.yaml
index 392b6994..09e8f085 100644
--- a/.github/workflows/promote-stable.yaml
+++ b/.github/workflows/promote-stable.yaml
@@ -27,5 +27,7 @@ jobs:
             SRC="quay.io/stackrox-io/apollo-ci:${flavor}-${VERSION}"
             DST="quay.io/stackrox-io/apollo-ci:${flavor}-stable"
             echo "Promoting ${SRC} → ${DST}"
-            docker buildx imagetools create --tag "${DST}" "${SRC}"
+            docker pull "${SRC}"
+            docker tag "${SRC}" "${DST}"
+            docker push "${DST}"
           done

From 567c5339a04dff8e8fc8c50f62ee62cb1d77bf31 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 19 May 2026 09:48:30 -0600
Subject: [PATCH 2/3] Use skopeo for server-side retag instead of docker
 pull/tag/push

skopeo copy preserves the original manifest format (plain single-arch
image, no manifest list wrapping) and operates server-side without
pulling the image locally. skopeo is pre-installed on ubuntu-latest.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/promote-stable.yaml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/promote-stable.yaml b/.github/workflows/promote-stable.yaml
index 09e8f085..47a94ee5 100644
--- a/.github/workflows/promote-stable.yaml
+++ b/.github/workflows/promote-stable.yaml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Log in to Quay
         run: |
-          docker login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
+          skopeo login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
       - name: Retag all flavors as stable
         run: |
           VERSION="${{ inputs.version }}"
@@ -27,7 +27,5 @@ jobs:
             SRC="quay.io/stackrox-io/apollo-ci:${flavor}-${VERSION}"
             DST="quay.io/stackrox-io/apollo-ci:${flavor}-stable"
             echo "Promoting ${SRC} → ${DST}"
-            docker pull "${SRC}"
-            docker tag "${SRC}" "${DST}"
-            docker push "${DST}"
+            skopeo copy "docker://${SRC}" "docker://${DST}"
           done

From da110d7809c3deee7cd1372910496522f0e03f02 Mon Sep 17 00:00:00 2001
From: davdhacs <105243888+davdhacs@users.noreply.github.com>
Date: Tue, 19 May 2026 09:51:07 -0600
Subject: [PATCH 3/3] Add configurable target tag suffix to promote-stable
 workflow

Allows overriding the target tag (default: "stable") for testing
promotions without affecting the real stable tags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/promote-stable.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/promote-stable.yaml b/.github/workflows/promote-stable.yaml
index 47a94ee5..715c40d5 100644
--- a/.github/workflows/promote-stable.yaml
+++ b/.github/workflows/promote-stable.yaml
@@ -7,6 +7,10 @@ on:
         description: "Version to promote (e.g. 0.5.7). Defaults to 'latest'."
         required: false
         default: "latest"
+      target:
+        description: "Target tag suffix (e.g. 'stable', 'stable-test'). Defaults to 'stable'."
+        required: false
+        default: "stable"
 
 env:
   QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
@@ -25,7 +29,9 @@ jobs:
           VERSION="${VERSION:-latest}"
           for flavor in scanner-build scanner-test stackrox-build stackrox-test stackrox-ui-test jenkins-plugin; do
             SRC="quay.io/stackrox-io/apollo-ci:${flavor}-${VERSION}"
-            DST="quay.io/stackrox-io/apollo-ci:${flavor}-stable"
+            TARGET="${{ inputs.target }}"
+            TARGET="${TARGET:-stable}"
+            DST="quay.io/stackrox-io/apollo-ci:${flavor}-${TARGET}"
             echo "Promoting ${SRC} → ${DST}"
             skopeo copy "docker://${SRC}" "docker://${DST}"
           done