From 3beea5536781d3f3f2e558cc7bb8a5c8db30c5b7 Mon Sep 17 00:00:00 2001
From: Nene7ko_ <1604009816@qq.com>
Date: Mon, 17 Aug 2026 21:02:22 +0800
Subject: [PATCH] fix: capture release image digests from build metadata

---
 .github/workflows/release.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 138fbc3..10752e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,14 +45,18 @@ jobs:
           for component in control-plane a2a-router; do
             image="ghcr.io/nekiro-project/nekiro-${component}:${GITHUB_REF_NAME}"
             dockerfile="apps/${component}/Dockerfile"
+            metadata_file="${component}-metadata.json"
+            rm -f "$metadata_file"
             docker buildx build \
               --file "$dockerfile" \
               --platform linux/amd64,linux/arm64 \
               --provenance=mode=max \
               --sbom=true \
               --tag "$image" \
+              --metadata-file "$metadata_file" \
               --push \
               .
+            test -s "$metadata_file"
           done
 
       - name: Record immutable image digests
@@ -60,8 +64,8 @@ jobs:
         run: |
           control_image="ghcr.io/nekiro-project/nekiro-control-plane:${GITHUB_REF_NAME}"
           router_image="ghcr.io/nekiro-project/nekiro-a2a-router:${GITHUB_REF_NAME}"
-          control_digest=$(docker buildx imagetools inspect "$control_image" | awk '/^Digest:/ { print $2; exit }')
-          router_digest=$(docker buildx imagetools inspect "$router_image" | awk '/^Digest:/ { print $2; exit }')
+          control_digest=$(jq -r '."containerimage.digest" // empty' control-plane-metadata.json)
+          router_digest=$(jq -r '."containerimage.digest" // empty' a2a-router-metadata.json)
           for digest in "$control_digest" "$router_digest"; do
             [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
           done