use digest instead of temp tags

Author: LexLuthr

.github/workflows/docker.yml

@@ -63,7 +63,6 @@ jobs:
               runner: ubuntu-24.04-arm
     env:
       PUBLISH: ${{ github.event.inputs.publish == 'true' || github.event_name != 'pull_request' }}
-      BUILD_TAG: &build-tag build-${{ github.run_id }}-${{ matrix.network }}
     steps:
       - &channel
         id: channel
@@ -122,15 +121,32 @@ jobs:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build image
+        id: build
         uses: docker/build-push-action@v5
         with:
           context: .
           platforms: linux/${{ matrix.platform.arch }}
-          push: ${{ env.PUBLISH == 'true' }}
-          tags: filecoin/${{ matrix.image }}:${{ env.BUILD_TAG }}-${{ matrix.platform.arch }}
+          outputs: type=image,name=filecoin/${{ matrix.image }},push-by-digest=true,name-canonical=true,push=${{ env.PUBLISH == 'true' }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ${{ matrix.network != 'mainnet' && format('GOFLAGS=-tags={0}', matrix.network) || ''}}
+      - name: Export image digest
+        if: env.PUBLISH == 'true'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+          ARCH: ${{ matrix.platform.arch }}
+        run: |
+          [[ "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 1
+          mkdir -p "$RUNNER_TEMP/digests"
+          printf '%s\n' "$DIGEST" > "$RUNNER_TEMP/digests/$ARCH"
+      - name: Upload image digest
+        if: env.PUBLISH == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-digests-${{ matrix.image }}-${{ matrix.network }}-${{ matrix.platform.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          overwrite: true
 
   publish:
     name: Publish Docker (${{ matrix.image }} / ${{ matrix.network }})
@@ -152,14 +168,19 @@ jobs:
           - image: lotus
             network: mainnet
     env:
-      BUILD_TAG: *build-tag
       IMAGE: filecoin/${{ matrix.image }}
     steps:
       - *channel
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - *git
+      - name: Download image digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: image-digests-${{ matrix.image }}-${{ matrix.network }}-*
+          merge-multiple: true
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - *docker-meta
@@ -172,7 +193,12 @@ jobs:
         env:
           METADATA_JSON: ${{ steps.meta.outputs.json }}
         run: |
-          sources=("$IMAGE:$BUILD_TAG-amd64" "$IMAGE:$BUILD_TAG-arm64")
+          sources=()
+          for arch in amd64 arm64; do
+            digest="$(cat "$RUNNER_TEMP/digests/$arch")"
+            [[ "$digest" =~ ^sha256:[a-f0-9]{64}$ ]] || exit 1
+            sources+=("$IMAGE@$digest")
+          done
 
           tag_args=()
           while IFS= read -r tag; do
@@ -186,25 +212,3 @@ jobs:
             | sort | unique == ["amd64", "arm64"]
           ' "$RUNNER_TEMP/manifest.json"
           docker buildx imagetools create "${tag_args[@]}" "${sources[@]}"
-      - name: Remove temporary architecture tags
-        # A cleanup failure must not invalidate a successfully published image.
-        continue-on-error: true
-        env:
-          IMAGE_TAG: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
-          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
-          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          docker buildx imagetools inspect --raw "$IMAGE_TAG" | jq -e '
-            [.manifests[].platform | select(.os == "linux") | .architecture]
-            | sort | unique == ["amd64", "arm64"]
-          '
-
-          hub_token="$(jq -n '{identifier: env.DOCKERHUB_USERNAME, secret: env.DOCKERHUB_TOKEN}' |
-            curl -fsS -H 'Content-Type: application/json' --data-binary @- \
-              https://hub.docker.com/v2/auth/token |
-            jq -er '.access_token // empty')"
-          echo "::add-mask::$hub_token"
-          for arch in amd64 arm64; do
-            curl -fsS -X DELETE -H "Authorization: Bearer $hub_token" \
-              "https://hub.docker.com/v2/namespaces/filecoin/repositories/${IMAGE#*/}/tags/$BUILD_TAG-$arch/"
-          done