From 1ddd200d4d1c632f3d5af269cd5838026afee562 Mon Sep 17 00:00:00 2001
From: Louis Parkin <louis.parkin@suse.com>
Date: Thu, 20 Aug 2026 12:06:21 +0200
Subject: [PATCH] STAC-25591: repin image-pipeline actions to pick up the
 Buildx digest fix

The self-hosted runners carry a Buildx built without version ldflags, so it
reports v0.0.0+unknown. build-push-action feature-gates its CLI flags on that
string, never passed --metadata-file, and returned an empty digest, so every
push to the default branch failed in "Publish and sign ... image" after the
image had already been pushed - publishing unsigned images and skipping the
multi-arch merge. The same gating dropped --attest, so the SBOM and provenance
attestations these builds request were never applied either.

image-pipeline#25 pins Buildx to a versioned release at the setup-buildx call
sites and fails closed when no digest is available. Repin all four actions in
both workflows onto that merge commit.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/build-binaries.yml | 8 ++++----
 .github/workflows/build-deb.yml      | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml
index 66731471f00..686d745eeb0 100644
--- a/.github/workflows/build-binaries.yml
+++ b/.github/workflows/build-binaries.yml
@@ -240,7 +240,7 @@ jobs:
             "${LOCAL_IMAGE}" version
 
       - name: Scan cluster-agent image, report-only (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
-        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/scan-image@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: ${{ env.LOCAL_IMAGE }}
           mode: inform
@@ -309,7 +309,7 @@ jobs:
 
       - name: Resolve canonical OCI labels
         id: oci
-        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image-name: stackstate-k8s-cluster-agent
           tag: ${{ steps.image.outputs.tag }}
@@ -322,7 +322,7 @@ jobs:
             [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
 
       - name: Build, publish, and sign architecture image
-        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: ${{ env.IMAGE }}
           tag: ${{ steps.image.outputs.tag }}
@@ -357,7 +357,7 @@ jobs:
           echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
 
       - name: Merge and sign multi-architecture manifest
-        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: quay.io/stackstate/stackstate-k8s-cluster-agent
           tag: ${{ steps.image.outputs.tag }}
diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml
index 65ffcdf77fa..5ca7bd04e7d 100644
--- a/.github/workflows/build-deb.yml
+++ b/.github/workflows/build-deb.yml
@@ -279,7 +279,7 @@ jobs:
           docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version
 
       - name: Scan agent image, report-only (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets)
-        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/scan-image@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: ${{ env.LOCAL_IMAGE }}
           mode: inform
@@ -353,7 +353,7 @@ jobs:
 
       - name: Resolve canonical OCI labels
         id: oci
-        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image-name: stackstate-k8s-agent
           tag: ${{ steps.image.outputs.tag }}
@@ -366,7 +366,7 @@ jobs:
             [{"registry": "${{ vars.REGISTRY_HOST }}", "username": "${{ vars.REGISTRY_USER }}", "password": "${{ secrets.REGISTRY_PASSWORD }}"}]
 
       - name: Build, publish, and sign architecture image
-        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: ${{ env.IMAGE }}
           tag: ${{ steps.image.outputs.tag }}
@@ -404,7 +404,7 @@ jobs:
           echo "tag=$(printf '%s' "${SOURCE_SHA}" | cut -c1-8)" >> "${GITHUB_OUTPUT}"
 
       - name: Merge and sign multi-architecture manifest
-        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@ab8ac3d608530ee0a295483c973d720230174348
         with:
           image: quay.io/stackstate/stackstate-k8s-agent
           tag: ${{ steps.image.outputs.tag }}