Merge pull request Stack-Cairn#241 from Stack-Cairn/fix/release-verify-digest-conflict

ci: 修复发布 workflow 按架构校验步骤的 digest 冲突

Author: su-fen

.github/workflows/gateway-docker.yml

@@ -68,15 +68,22 @@ jobs:
       - name: Verify per-arch binaries
         run: |
           set -euo pipefail
-          image="$(echo "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')@${{ steps.push.outputs.digest }}"
+          repo="$(echo "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')"
+          index="$repo@${{ steps.push.outputs.digest }}"
           for arch in amd64 arm64; do
             case "$arch" in
               amd64) want="x86-64" ;;
               arm64) want="aarch64" ;;
             esac
-            docker pull --platform "linux/$arch" "$image" >/dev/null
+            # Pull each variant by its own manifest digest. Pulling the shared
+            # index digest with --platform binds repo@digest to one platform,
+            # so the second arch fails with "cannot overwrite digest".
+            digest="$(docker buildx imagetools inspect --raw "$index" \
+              | jq -r --arg arch "$arch" '.manifests[] | select(.platform.os == "linux" and .platform.architecture == $arch) | .digest')"
+            test -n "$digest" || { echo "::error::pushed index has no linux/$arch manifest"; exit 1; }
+            docker pull "$repo@$digest" >/dev/null
             docker rm -f "verify-$arch" >/dev/null 2>&1 || true
-            docker create --platform "linux/$arch" --name "verify-$arch" "$image" >/dev/null
+            docker create --name "verify-$arch" "$repo@$digest" >/dev/null
             docker cp "verify-$arch:/usr/local/bin/liveagent-gateway" "/tmp/gateway-$arch"
             docker rm -f "verify-$arch" >/dev/null
             info="$(file -b "/tmp/gateway-$arch")"