From e575066ea908bf369602884744437b426bdc387f Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Sat, 11 Jul 2026 02:18:00 -0500
Subject: [PATCH] revert(ci): restore two-build docker.yml publish

#2122 collapsed the per-registry builds into one build with two type=image
outputs and a single steps.build.outputs.digest. With build-push-action's
default provenance attestation, that digest does not resolve at ghcr, so the
multi-arch manifest step fails ("ghcr.io/...@sha256:...: not found"). Restore
the separate build-ghcr / build-dockerhub steps so each registry gets its own
digest. The ci-build.yml type=gha cache change from #2122 is kept.
---
 .github/workflows/docker.yml | 37 ++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 1f9ed67e..e606850e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -62,14 +62,14 @@ jobs:
           sudo rm -rf /usr/local/share/boost
           docker system prune -af
 
-      - name: build once and push to both registries by digest
-        id: build
+      - name: build and push to ghcr.io by digest
+        id: build-ghcr
         uses: docker/build-push-action@v7
         with:
           context: .
           platforms: ${{ matrix.platform }}
           cache-from: type=gha,scope=${{ matrix.platform }}
-          cache-to: type=gha,scope=${{ matrix.platform }},mode=max,ignore-error=true
+          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
           build-args: |
             SKIP_BACKEND_TEST=true
             SKIP_FRONTEND_TEST=true
@@ -77,18 +77,31 @@ jobs:
             GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
             GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
             GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
-          outputs: |
-            type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true
-            type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+          outputs: type=image,name=ghcr.io/umputun/remark42,push-by-digest=true,name-canonical=true,push=true
 
-      - name: export digest
+      - name: build and push to DockerHub by digest
+        id: build-dockerhub
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          build-args: |
+            SKIP_BACKEND_TEST=true
+            SKIP_FRONTEND_TEST=true
+            CI=github
+            GITHUB_SHA=${{ github.event.workflow_run.head_sha }}
+            GIT_BRANCH=${{ github.event.workflow_run.head_branch }}
+            GITHUB_REF=refs/heads/${{ github.event.workflow_run.head_branch }}
+          outputs: type=image,name=umputun/remark42,push-by-digest=true,name-canonical=true,push=true
+
+      - name: export digests
         run: |
-          # both registries receive the same content-addressed image, so the
-          # single build digest applies to each
           mkdir -p /tmp/digests/ghcr /tmp/digests/dockerhub
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/ghcr/${digest#sha256:}"
-          touch "/tmp/digests/dockerhub/${digest#sha256:}"
+          digest_ghcr="${{ steps.build-ghcr.outputs.digest }}"
+          digest_dockerhub="${{ steps.build-dockerhub.outputs.digest }}"
+          touch "/tmp/digests/ghcr/${digest_ghcr#sha256:}"
+          touch "/tmp/digests/dockerhub/${digest_dockerhub#sha256:}"
 
       - name: upload ghcr digest
         uses: actions/upload-artifact@v7