Fix manifest-list bug: --provenance=false --sbom=false in buildx build (oleks/ci-scripts#15)

.woodpecker/drift.yaml

@@ -17,4 +17,4 @@ steps:
         from_secret: ci_drift_token
     commands:
       - echo "▸ arch=$(uname -m)"
-      - nix shell nixpkgs#python3 nixpkgs#python3Packages.pyyaml -c python3 drift_check.py
+      - "nix-shell -p 'python3.withPackages (ps: [ ps.pyyaml ])' --run 'python3 drift_check.py'"

ci/local.sh

@@ -67,7 +67,11 @@ build)
 		push_flag="--push"
 	fi
 	echo "▸ building ${IMAGE}:${tag} for linux/${arch}"
-	docker buildx build --platform "linux/${arch}" "${push_flag}" -t "${IMAGE}:${tag}" .
+	# --provenance=false --sbom=false: see entrypoint.sh buildx_build_flow —
+	# without these, BuildKit pushes even a single-platform build as a
+	# manifest list, which `docker manifest create` then refuses to
+	# reference as a member (oleks/ci-scripts#15 real bug, found in CI).
+	docker buildx build --platform "linux/${arch}" --provenance=false --sbom=false "${push_flag}" -t "${IMAGE}:${tag}" .
 	;;
 manifest)
 	registry_login

entrypoint.sh

@@ -135,7 +135,13 @@ buildx_build_flow() {
 	tag=$(render_tag "$tag_scheme" "$version" "$arch")
 	local context="${PLUGIN_CONTEXT:-.}"
 	echo "▸ building ${PLUGIN_IMAGE_NAME}:${tag} for linux/${arch} (context ${context})"
-	docker buildx build --push --platform "linux/${arch}" -t "${PLUGIN_IMAGE_NAME}:${tag}" "${context}"
+	# --provenance=false --sbom=false: BuildKit >=0.11 attaches attestations
+	# by default, which forces even a single-platform build to push as an
+	# OCI manifest LIST (index) rather than a plain image manifest. That
+	# breaks `docker manifest create` downstream (buildx-manifest flow),
+	# which refuses to add a manifest-list as a member. Disable both so the
+	# per-arch tag is a plain image manifest.
+	docker buildx build --push --provenance=false --sbom=false --platform "linux/${arch}" -t "${PLUGIN_IMAGE_NAME}:${tag}" "${context}"
 }
 
 buildx_manifest_flow() {