From 429b330acf34c74752993b5c1784edc86b5b9389 Mon Sep 17 00:00:00 2001 From: chen21019 Date: Thu, 10 Sep 2026 04:23:00 +0800 Subject: [PATCH] Fix release manifest digest readback --- .github/workflows/release.yml | 2 +- scripts/check-source-gates | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9224f3d..0b5d33e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -167,7 +167,7 @@ jobs: printf '%s' "$GHCR_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin docker push "$RUNTIME_IMAGE" digest="$("$LOCKED_BUILDX" imagetools inspect "$RUNTIME_IMAGE" \ - --format '{{.Manifest.Digest}}')" + --format '{{json .Manifest}}' | jq -er '.digest')" [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] printf 'digest=%s\n' "$digest" >> "$GITHUB_OUTPUT" diff --git a/scripts/check-source-gates b/scripts/check-source-gates index db1ba7f..06fa9e4 100755 --- a/scripts/check-source-gates +++ b/scripts/check-source-gates @@ -465,6 +465,8 @@ require_marker .github/workflows/release.yml 'workflow_dispatch:' ECR_SYNC_RELEA require_marker .github/workflows/release.yml 'export DOCKER_CONFIG="$docker_config_root"' ECR_SYNC_RELEASE_BUILDER_CONFIG_MISSING require_marker .github/workflows/release.yml 'if [ -d LICENSES ]; then' ECR_SYNC_OPTIONAL_LICENSE_DIRECTORY_GATE_MISSING require_marker .github/workflows/release.yml '--version "${RELEASE_TAG#v}"' ECR_SYNC_RELEASE_SBOM_VERSION_BINDING_MISSING +require_marker .github/workflows/release.yml "--format '{{json .Manifest}}' | jq -er '.digest'" ECR_SYNC_RELEASE_REMOTE_DIGEST_GATE_MISSING +reject_marker .github/workflows/release.yml '{{.Manifest.Digest}}' ECR_SYNC_RELEASE_INVALID_DIGEST_TEMPLATE_PRESENT require_marker .github/workflows/supply-chain.yml '--version "${VERSION_OVERRIDE#v}"' ECR_SYNC_REVIEW_SBOM_VERSION_BINDING_MISSING require_marker .github/workflows/release.yml '.metadata.component.version == $version' ECR_SYNC_RELEASE_SBOM_VERSION_READBACK_MISSING require_marker .github/workflows/supply-chain.yml '.metadata.component.version == $version' ECR_SYNC_REVIEW_SBOM_VERSION_READBACK_MISSING