Fix release workflow: manifest list conflict on major-version arch tags (#63)

* Fix release workflow: avoid pushing major-version tags to arch-specific repos

GHCR will not overwrite a manifest-list tag with a single-arch image push,
causing docker manifest create to fail with "is a manifest list". Fix by
only pushing the exact version tag to -amd64/-arm64 repos; both manifest
lists (:VERSION and :MAJOR) now reference the exact-version arch images.
Also fix deprecated LABEL syntax warnings in package/Dockerfile.

* Fix manifest list error: disable BuildKit default attestations

Newer Docker/BuildKit wraps single-platform builds in an OCI index when
it attaches a provenance attestation manifest. This makes every pushed
image a manifest list, causing docker manifest create to fail with "is a
manifest list". Setting BUILDX_NO_DEFAULT_ATTESTATIONS=1 prevents the
attestation wrapper so arch-specific images are pushed as plain
single-platform manifests.

Author: jeremiahlukus

package/Dockerfile

@@ -1,4 +1,4 @@
 FROM scratch
-LABEL org.opencontainers.image.source "https://github.com/rails-lambda/crypteia"
-LABEL org.opencontainers.image.description "Rust Lambda Extension for any Runtime to preload SSM Parameters as Secure Environment Variables!"
+LABEL org.opencontainers.image.source="https://github.com/rails-lambda/crypteia"
+LABEL org.opencontainers.image.description="Rust Lambda Extension for any Runtime to preload SSM Parameters as Secure Environment Variables!"
 COPY ./package/opt /opt

package/deploy-image-amzn

@@ -10,34 +10,36 @@ CRYPTEIA_VERSION_MAJOR=$(echo "${CRYPTEIA_VERSION}" | cut -d. -f1)
 
 docker login ghcr.io -u "metaskills" -p $DOCKER_LOGIN_PAT
 
+# Prevent BuildKit from wrapping single-platform builds in an OCI index
+# (attestation manifests), which breaks docker manifest create.
+export BUILDX_NO_DEFAULT_ATTESTATIONS=1
+
 ./amzn/setup
 BASE_NAME_AMD64="ghcr.io/rails-lambda/crypteia-extension-amzn-amd64"
 docker build \
   --platform linux/amd64 \
-  --tag "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}" \
   --tag "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
   --file package/Dockerfile .
-docker push "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}"
 docker push "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}"
 
 ./amzn/setup-arm64
 BASE_NAME_ARM64="ghcr.io/rails-lambda/crypteia-extension-amzn-arm64"
 docker build \
   --platform linux/arm64 \
-  --tag "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}" \
   --tag "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}" \
   --file package/Dockerfile .
-docker push "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}"
 docker push "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
 
-docker manifest create \
-  "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION_MAJOR}" \
-  --amend "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}" \
-  --amend "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}"
-docker manifest push "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION_MAJOR}"
-
+docker manifest rm "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION}" 2>/dev/null || true
 docker manifest create \
   "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION}" \
-  --amend "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
-  --amend "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
+  "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
+  "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
 docker manifest push "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION}"
+
+docker manifest rm "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION_MAJOR}" 2>/dev/null || true
+docker manifest create \
+  "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION_MAJOR}" \
+  "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
+  "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
+docker manifest push "ghcr.io/rails-lambda/crypteia-extension-amzn:${CRYPTEIA_VERSION_MAJOR}"

package/deploy-image-debian

@@ -10,34 +10,36 @@ CRYPTEIA_VERSION_MAJOR=$(echo "${CRYPTEIA_VERSION}" | cut -d. -f1)
 
 docker login ghcr.io -u "metaskills" -p $DOCKER_LOGIN_PAT
 
+# Prevent BuildKit from wrapping single-platform builds in an OCI index
+# (attestation manifests), which breaks docker manifest create.
+export BUILDX_NO_DEFAULT_ATTESTATIONS=1
+
 ./bin/setup
 BASE_NAME_AMD64="ghcr.io/rails-lambda/crypteia-extension-debian-amd64"
 docker build \
   --platform linux/amd64 \
-  --tag "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}" \
   --tag "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
   --file package/Dockerfile .
-docker push "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}"
 docker push "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}"
 
 ./debian/setup-arm64
 BASE_NAME_ARM64="ghcr.io/rails-lambda/crypteia-extension-debian-arm64"
 docker build \
   --platform linux/arm64 \
-  --tag "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}" \
   --tag "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}" \
   --file package/Dockerfile .
-docker push "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}"
 docker push "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
 
-docker manifest create \
-  "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION_MAJOR}" \
-  --amend "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION_MAJOR}" \
-  --amend "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION_MAJOR}"
-docker manifest push "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION_MAJOR}"
-
+docker manifest rm "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION}" 2>/dev/null || true
 docker manifest create \
   "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION}" \
-  --amend "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
-  --amend "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
+  "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
+  "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
 docker manifest push "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION}"
+
+docker manifest rm "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION_MAJOR}" 2>/dev/null || true
+docker manifest create \
+  "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION_MAJOR}" \
+  "${BASE_NAME_AMD64}:${CRYPTEIA_VERSION}" \
+  "${BASE_NAME_ARM64}:${CRYPTEIA_VERSION}"
+docker manifest push "ghcr.io/rails-lambda/crypteia-extension-debian:${CRYPTEIA_VERSION_MAJOR}"