f026f8c30fpush-image-by-digest pushes the manifest to a :build-tmp tag to capture its digest without advertising a version tag pre-signing, but nothing ever removed it — so :build-tmp lingered in the registry tag list, pointing at the most recent pushed digest (defeating part of the L1 TOCTOU intent and cluttering the package view). promote-image-tag now deletes :build-tmp after the permanent vX.Y.Z tag points at the same digest (best-effort; tolerates absence on re-runs). |
||
|---|---|---|
| .. | ||
| build-image.yaml | ||
| cosign-attach-sbom.yaml | ||
| cosign-sign-image-by-digest.yaml | ||
| promote-image-tag.yaml | ||
| push-image-by-digest.yaml | ||
| resolve-release-tools-tag.yaml | ||
| syft-scan-image.yaml | ||
| verify-image-tools.yaml | ||