From 63f17f167d4e3cc55859a2c27444430381b9c40b Mon Sep 17 00:00:00 2001
From: repo-worker <repo-worker@git.oleks.space>
Date: Sun, 5 Jul 2026 21:28:26 +0300
Subject: [PATCH] Fix manifest-list bug: --provenance=false --sbom=false in
 buildx build (oleks/ci-scripts#15)

---
 ci/local.sh   | 6 +++++-
 entrypoint.sh | 8 +++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/ci/local.sh b/ci/local.sh
index bc03a47..fd7c420 100755
--- a/ci/local.sh
+++ b/ci/local.sh
@@ -67,7 +67,11 @@ build)
 		push_flag="--push"
 	fi
 	echo "▸ building ${IMAGE}:${tag} for linux/${arch}"
-	docker buildx build --platform "linux/${arch}" "${push_flag}" -t "${IMAGE}:${tag}" .
+	# --provenance=false --sbom=false: see entrypoint.sh buildx_build_flow —
+	# without these, BuildKit pushes even a single-platform build as a
+	# manifest list, which `docker manifest create` then refuses to
+	# reference as a member (oleks/ci-scripts#15 real bug, found in CI).
+	docker buildx build --platform "linux/${arch}" --provenance=false --sbom=false "${push_flag}" -t "${IMAGE}:${tag}" .
 	;;
 manifest)
 	registry_login
diff --git a/entrypoint.sh b/entrypoint.sh
index f2db88e..7292f70 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -135,7 +135,13 @@ buildx_build_flow() {
 	tag=$(render_tag "$tag_scheme" "$version" "$arch")
 	local context="${PLUGIN_CONTEXT:-.}"
 	echo "▸ building ${PLUGIN_IMAGE_NAME}:${tag} for linux/${arch} (context ${context})"
-	docker buildx build --push --platform "linux/${arch}" -t "${PLUGIN_IMAGE_NAME}:${tag}" "${context}"
+	# --provenance=false --sbom=false: BuildKit >=0.11 attaches attestations
+	# by default, which forces even a single-platform build to push as an
+	# OCI manifest LIST (index) rather than a plain image manifest. That
+	# breaks `docker manifest create` downstream (buildx-manifest flow),
+	# which refuses to add a manifest-list as a member. Disable both so the
+	# per-arch tag is a plain image manifest.
+	docker buildx build --push --provenance=false --sbom=false --platform "linux/${arch}" -t "${PLUGIN_IMAGE_NAME}:${tag}" "${context}"
 }
 
 buildx_manifest_flow() {