From 712c298de51d40fd3ffe5cc27fa990e3b0a0a499 Mon Sep 17 00:00:00 2001 From: lr90 Date: Sun, 23 Aug 2026 10:35:12 +0800 Subject: [PATCH] ci: disable default buildx attestations when pushing images Since BuildKit v0.11, `buildx build --push` attaches a provenance attestation by default. The attestation is referenced from the OCI image index through a descriptor whose config mediaType is `application/vnd.oci.empty.v1+json`, which Alicloud ACR does not recognise. Every push to the ACR targets has therefore been rejected with: denied: unknown manifest class for application/vnd.oci.empty.v1+json Layers and the image manifest push fine; only the attestation manifest is refused, which fails the whole build. Docker Hub accepts the format, so only the ACR targets break. The workflow file itself did not change - `docker/setup-buildx-action@v1` installs the current buildx release, so the behaviour drifted underneath us. `Release Image` has failed on every run since 2026-08-21 and no nightly image has been published since 2026-07-14. `docker/build-push-action@v2` is too old to expose a `provenance` input, so opt out through the buildx-native environment variable instead, which works regardless of the action version. Fixes #613 Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release_image.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release_image.yml b/.github/workflows/release_image.yml index dc32de8f..a757d986 100644 --- a/.github/workflows/release_image.yml +++ b/.github/workflows/release_image.yml @@ -67,6 +67,11 @@ jobs: - name: Build uses: docker/build-push-action@v2 + env: + # Alicloud ACR rejects the provenance attestation manifest that buildx + # attaches by default since BuildKit v0.11 ("unknown manifest class for + # application/vnd.oci.empty.v1+json"), which fails the whole push. + BUILDX_NO_DEFAULT_ATTESTATIONS: "1" with: builder: ${{ steps.buildx.outputs.name }} context: .