From c2db4f47fe388016db9b4b4927f6fb0f94440fbc Mon Sep 17 00:00:00 2001 From: maoyifeng Date: Mon, 19 Oct 2026 15:18:30 +0800 Subject: [PATCH] fix: release , aliyun Personal ACR does not support image proof lists (#21136) --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1314695bc3..807119de6c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -334,6 +334,16 @@ jobs: file: ./Dockerfile platforms: linux/arm64 push: true + # Disable build attestations (provenance/SBOM). build-push-action v6 + # otherwise attaches an application/vnd.docker.attestation.manifest.v1+json + # artifact to the image. That artifact is not supported by some registries + # (e.g. Alibaba Cloud personal OCR), and skopeo sync then fails with + # "unsupported image-specific operation on artifact with type + # application/vnd.docker.attestation.manifest.v1+json". Disabling it keeps + # the pushed image a clean manifest so the multi-arch index merged below + # contains only amd64 + arm64 image manifests. + provenance: false + sbom: false # Use a Go proxy that is reliable from GitHub-hosted runners; the # Dockerfile default (goproxy.cn) is flaky here (HTTP/2 GOAWAY). build-args: |