ci: Restore sbom: true to maintain OCI manifest index format

Merged
SH
5mo ago
+3-3

Summary

Restores sbom: true on all three build-push-action steps (n8n, runners, runners-distroless).

When sbom: false, BuildKit stops using the OCI referrers API and falls back to Docker manifest list format (application/vnd.docker.distribution.manifest.list.v2+json). This caused older containerd versions on AKS to misidentify attestation manifests as image manifests, producing a number of layers and diffIDs don't match error and ImagePullBackOff for 2.26.0.

Restoring sbom: true forces OCI manifest index format (application/vnd.oci.image.index.v1+json), matching 2.25.6 and earlier. The enriched cosign-attested SBOM from the sbom-attestation job remains and can be applied on top of the release asset independently.

How to test

Merge and trigger a patch release build. Verify the manifest media type is application/vnd.oci.image.index.v1+json.

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

  • I have seen this code, I have run this code, and I take responsibility for this code.
  • I have seen this code, I have run this code, and I take responsibility for this code.
  • PR title and summary are descriptive. (conventions)
  • Docs updated or follow-up ticket created.
  • Tests included.
  • PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

🤖 PR Summary generated by AI