fix(ci): disable provenance attestation in docker check to avoid manifest-tag collision #267

Merged

YousifShkara merged 1 commit from fix/BUNYIP-241-disable-provenance-in-docker-check into main

2026-06-29 10:42:09 +02:00

YousifShkara commented

2026-06-29 09:38:59 +02:00

Owner

BUNYIP-241: the Docker builder stage step in check.yml has been failing on PRs with image "docker.io/library/bunyip-api-builder:check": already exists AFTER the build itself succeeded. The cause is buildkit's default-on provenance / SBOM attestation: the exporter emits both an image manifest and an attestation manifest list and names BOTH under the requested tag, which collides inside the same run after the first naming to ... done. BUNYIP-231's docker image rm only clears cross-run leftover state and so does not address this.

The check step does not consume the resulting image (the only assertion that runs against it is the in-Dockerfile binary-size sanity check during the build itself), so the provenance attestation is not load-bearing here. --provenance=false collapses the export to a single manifest with no observable downside, and the BUNYIP-231 image-rm guard stays for cross-run protection.

#BUNYIP-241

BUNYIP-241: the `Docker builder stage` step in check.yml has been failing on PRs with `image "docker.io/library/bunyip-api-builder:check": already exists` AFTER the build itself succeeded. The cause is buildkit's default-on provenance / SBOM attestation: the exporter emits both an image manifest and an attestation manifest list and names BOTH under the requested tag, which collides inside the same run after the first `naming to ... done`. BUNYIP-231's `docker image rm` only clears cross-run leftover state and so does not address this. The check step does not consume the resulting image (the only assertion that runs against it is the in-Dockerfile binary-size sanity check during the build itself), so the provenance attestation is not load-bearing here. `--provenance=false` collapses the export to a single manifest with no observable downside, and the BUNYIP-231 image-rm guard stays for cross-run protection. #BUNYIP-241

YousifShkara self-assigned this

2026-06-29 09:38:59 +02:00

YousifShkara added 1 commit

2026-06-29 09:38:59 +02:00

fix(ci): disable provenance attestation in docker check to avoid manifest-tag collision

E2E / Playwright against deployment (pull_request) Successful in 19s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 22m42s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

281d85be3d

BUNYIP-241: the `Docker builder stage` step in check.yml has been failing on PRs with `image "docker.io/library/bunyip-api-builder:check": already exists` AFTER the build itself succeeded. The cause is buildkit's default-on provenance / SBOM attestation: the exporter emits both an image manifest and an attestation manifest list and names BOTH under the requested tag, which collides inside the same run after the first `naming to ... done`. BUNYIP-231's `docker image rm` only clears cross-run leftover state and so does not address this.

The check step does not consume the resulting image (the only assertion that runs against it is the in-Dockerfile binary-size sanity check during the build itself), so the provenance attestation is not load-bearing here. `--provenance=false` collapses the export to a single manifest with no observable downside, and the BUNYIP-231 image-rm guard stays for cross-run protection.

#BUNYIP-241

YousifShkara merged commit 902db911c8 into main

2026-06-29 10:42:09 +02:00

YousifShkara deleted branch fix/BUNYIP-241-disable-provenance-in-docker-check

2026-06-29 10:42:09 +02:00

YousifShkara referenced this pull request from a commit

2026-06-29 10:42:10 +02:00

Merge pull request 'fix(ci): disable provenance attestation in docker check to avoid manifest-tag collision' (#267) from fix/BUNYIP-241-disable-provenance-in-docker-check into main