From 1c9093f218dd98b2f0b774c21a05076072d8163b Mon Sep 17 00:00:00 2001 From: ThePhaseless Date: Sun, 9 Aug 2026 19:25:09 +0200 Subject: [PATCH] fix(ci): extract first image tag by line, not space metadata-action emits tags newline-separated, so FIRST_TAG=${TAGS%% *} kept the entire multi-line value and expanded to 4 args on tag releases, making `imagetools inspect` fail before the manifest could be signed. Split on the first line instead. --- .github/workflows/docker-publish.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5cd0769..6180075 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -216,9 +216,10 @@ jobs: # All tags created above alias a single manifest list; capture its digest # so the signature is bound to the image bytes, not a mutable tag. - # Tags from metadata-action are full references (image:tag). - FIRST_TAG=${TAGS%% *} - DIGEST=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' ${FIRST_TAG}) + # Tags from metadata-action are full references (image:tag), one per line, + # so take the first line rather than splitting on spaces. + FIRST_TAG=$(printf '%s' "$TAGS" | head -n1) + DIGEST=$(docker buildx imagetools inspect --format '{{.Manifest.Digest}}' "$FIRST_TAG") echo "DIGEST=$DIGEST" >> $GITHUB_OUTPUT # Sign the manifest list by digest — every consumer tag aliases this digest