`set-meta-labels|annotations` not set on main manifest?

[mathieu-benoit]

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• The documentation does not mention anything about my problem
• There are no open or closed issues that are related to my problem

Description

I'm using set-meta-labels and set-meta-annotations here mathieu-benoit/sail-sharp#216.
But when deploying a new release (pushing the container images in multi-archs in ghcr), I don't see the labels and annotations on the main tag/image/manifest, see here: https://github.com/mathieu-benoit/sail-sharp/pkgs/container/my-sample-workload/669225547?tag=v1.60.0.

Is that expected? Or am I missing something?

Expected behaviour

I'm expecting that both labels and annotations should be set on the main tag/image/manifest.

Actual behaviour

labels and annotations are not set on the main tag/image/manifest, see here:

And here: ghcr.io/mathieu-benoit/my-sample-workload:v1.60.0.

They are set for each arch image/tag/manifest though:

• ghcr.io/mathieu-benoit/my-sample-workload:v1.60.0@sha256:4d21b9fb6c562bbfce6a8a38c5502322f8bdc3503e6ca30fce30ffada160b3dc
• ghcr.io/mathieu-benoit/my-sample-workload:v1.60.0@sha256:2879a418643c9507069fa63113d4cbc399e1b9d0f20ab7d2e154e39fbf990993

Repository URL

https://github.com/mathieu-benoit/sail-sharp

Workflow run URL

https://github.com/mathieu-benoit/sail-sharp/actions/runs/21636213719

YAML workflow

name: push-tag
on:
  push:
    tags:        
      - 'v*'
jobs:
  build-push:
    uses: docker/github-builder/.github/workflows/build.yml@v1
    permissions:
      contents: read # to fetch the repository content
      id-token: write # to sign attestation(s) with GitHub OIDC Token
      packages: write # to push container image to ghcr
    with:
      output: image
      push: true
      platforms: linux/amd64,linux/arm64
      sbom: true
      context: app/
      set-meta-labels: true
      set-meta-annotations: true
      meta-images: |
        ghcr.io/${{ github.repository_owner }}/my-sample-workload
      meta-tags: |
        type=ref,event=tag
        latest
    secrets:
      registry-auths: |
        - registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
        - registry: dhi.io
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PAT }}

Workflow logs

No response

BuildKit logs

Additional info

No response

[crazy-max]

Good catch! We could have an opt to set them on the index when merging manifests with imagetools create command at:

github-builder/.github/workflows/build.yml

Lines 823 to 836 in cf2bccf

	let createArgs = ['buildx', 'imagetools', 'create'];
	for (const tag of inpTagNames) {
	createArgs.push('-t', `${imageName}:${tag}`);
	}
	for (const digest of digests) {
	createArgs.push(digest);
	}
	if (inpPush) {
	await exec.exec('docker', createArgs);
	} else {
	await core.group(`Generated imagetools create command for ${imageName}`, async () => {
	core.info(`docker ${createArgs.join(' ')}`);
	});
	}