Fix manifest digest extraction for multi-arch Docker images

[Copilot]

docker buildx imagetools inspect --format '{{.Manifest.Digest}}' is unreliable on the GitHub Actions runner used by this workflow. Instead of returning only the digest, buildx ignores the plain template and emits the default multi-line inspection output (MediaType: application/vnd.oci.image.index.v1+json, etc.), which breaks $GITHUB_OUTPUT parsing.

• Use the buildx JSON template workaround to extract only the manifest digest:

# Before (broken on this runner)
DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${META_VERSION}" --format '{{.Manifest.Digest}}')

# After
DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${META_VERSION}" --format '{{json .Manifest.Digest}}' | jq -r '.')

This returns a clean single-line sha256:... digest for the multi-arch manifest, which can be safely written to $GITHUB_OUTPUT and passed to actions/attest-build-provenance.

The change is intentionally minimal and scoped to the manifest job in the release Docker workflow.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[JaredHatfield]

@copilot

I think this is totally wrong. Look into this again and come up with the correct solution after performing the appropriate research using subagents.

[Copilot]

@copilot

I think this is totally wrong. Look into this again and come up with the correct solution after performing the appropriate research using subagents.

Updated in 5244659. I re-ran the investigation with subagent research plus local reproduction on docker buildx and switched the workflow to the buildx --format workaround: --format '{{json .Manifest.Digest}}' | jq -r '.'. On this runner, plain {{.Manifest.Digest}} is ignored and emits the multi-line MediaType: output that breaks $GITHUB_OUTPUT; the JSON form returns a clean single-line sha256:... digest.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (38a7783) to head (5244659).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff          @@
##            main     #77   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files          1       1           
  Lines         17      17           
=====================================
  Misses        17      17           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.