From bcfa6cf8c32eb52225d231568a974ee006c65661 Mon Sep 17 00:00:00 2001
From: Anoop Narang <anoop@hotdata.dev>
Date: Fri, 13 Feb 2026 19:14:28 +0530
Subject: [PATCH] fix(ci): disable provenance attestations in docker build

BuildKit now defaults to attaching provenance attestations on push,
which wraps single-platform images in manifest lists and breaks the
multi-arch manifest creation step.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99c3440..df527b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -168,7 +168,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push Docker image
         run: |
-          docker build -t ghcr.io/${{ github.repository }}:${{ needs.image_meta.outputs.image_tag }}-${{ matrix.arch }} .
+          docker build --provenance=false -t ghcr.io/${{ github.repository }}:${{ needs.image_meta.outputs.image_tag }}-${{ matrix.arch }} .
           docker push ghcr.io/${{ github.repository }}:${{ needs.image_meta.outputs.image_tag }}-${{ matrix.arch }}
 
   manifest: