From caf98ed6a978f509c7a9cf23efe3a5b43f0ab13d Mon Sep 17 00:00:00 2001
From: mfwadejr <125498560+mfwadejr@users.noreply.github.com>
Date: Mon, 21 Sep 2026 22:58:24 +0000
Subject: [PATCH] Disable buildx provenance/SBOM attestations for the published
 image

QEMU cross-arch emulation hung indefinitely on the self-hosted Gitea
runner (likely no privileged Docker access), so the actual arch wasn't
the problem worth chasing. The far more common cause of "no matching
manifest" against a self-hosted registry is Buildx's default
provenance/SBOM attestation manifests, which not every registry
implementation (including Gitea's) resolves correctly when a client
requests a single-platform pull. Disabling both keeps the image a
plain single-manifest image, matching what a manual `docker push`
already produced and pulled fine.
---
 .github/workflows/publish-container.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml
index 2a79edc..694403b 100644
--- a/.github/workflows/publish-container.yml
+++ b/.github/workflows/publish-container.yml
@@ -29,9 +29,6 @@ jobs:
             echo "image=$host/marvin/vboxstock" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -57,7 +54,8 @@ jobs:
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm64
+          provenance: false
+          sbom: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |