From e617ed176ada94159be12321b36e9eb37b15876e Mon Sep 17 00:00:00 2001
From: simoleo89 <simoleo89@gmail.com>
Date: Wed, 9 Sep 2026 20:27:03 +0200
Subject: [PATCH] fix(ci): resolve OCI platform before verifying published
 config

---
 scripts/publish-container.sh      | 2 +-
 src/lib/publish-container.test.ts | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/publish-container.sh b/scripts/publish-container.sh
index 65083652..54cf64c6 100644
--- a/scripts/publish-container.sh
+++ b/scripts/publish-container.sh
@@ -62,7 +62,7 @@ for target in "$image-migrations" "$image"; do
   # Import may change compression/manifest representation, but the immutable
   # image config digest must still match the exact local image we verified.
   expected_config="$(docker image inspect --format '{{.Id}}' "$target")"
-  remote_config="$(regctl manifest get "$target" --format '{{.GetConfig.Digest}}')"
+  remote_config="$(regctl manifest get "$target" --platform "linux/$arch" --format '{{.GetConfig.Digest}}')"
   [[ "$remote_config" = "$expected_config" ]] || { echo "Published image config does not match verified local image" >&2; exit 1; }
   rm -f -- "$context/image.tar"
 done
diff --git a/src/lib/publish-container.test.ts b/src/lib/publish-container.test.ts
index d873ca06..40fbbfd5 100644
--- a/src/lib/publish-container.test.ts
+++ b/src/lib/publish-container.test.ts
@@ -89,6 +89,7 @@ it("bounds uploads and verifies both published image configs", () => {
 	expect(calls).not.toContain("docker push");
 	expect(calls.match(/regctl image import/g)).toHaveLength(2);
 	expect(calls.match(/regctl manifest get/g)).toHaveLength(2);
+	expect(calls.match(/--platform linux\/amd64/g)).toHaveLength(2);
 });
 it.each(["upload-fails", "wrong-config", "bad-checksum"])(
 	"stops publication on %s",