From 40ad28e97b9328907d4dfbcda635f30569b37d1c Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 29 Apr 2026 12:37:50 -0500
Subject: [PATCH] CI: build amd64-only via buildx with provenance/sbom off
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Forgejo runner with default Docker emits OCI image-index manifests for
multi-arch + attestation builds. argocd-image-updater cannot follow the
index → manifest chain to read the Created timestamp, so it never sees
new tags. Pinning to a single linux/amd64 build with no provenance/sbom
produces a plain Docker v2 manifest that image-updater can read.
---
 .forgejo/workflows/build.yaml | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 7ca50bb..a9e716d 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -37,10 +37,17 @@ jobs:
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
 
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
       - name: Build and push Docker image
-        run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-          docker build -t "${IMAGE}:${TAG}" -t "${IMAGE}:main" .
-          docker push "${IMAGE}:${TAG}"
-          docker push "${IMAGE}:main"
+        uses: https://github.com/docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64
+          provenance: false
+          sbom: false
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main