Pushing to ghcr.io creates untagged image without multi platform build or provenance

[Time0o]

Maybe I am missing something here but I have the following setup:

    - name: Extract image metadata                                                  
      id: metadata                                                                  
      # 369eb59 = v5.6.1                                                            
      uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96         
      with:                                                                         
        images: ghcr.io/my_org/my_image                                                                                      
        tags: |                                                                     
          type=raw,value=latest                                                     
          type=raw,pattern={{version}},value=${{ steps.version.outputs.version }}

    - name: Build and push image                                                    
      # 4f58ea7 = v6.9.0                                                            
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75       
      with:                                                                         
        context: images/my_image                                        
        file: images/my_image/Dockerfile                                                                      
        tags: ${{ steps.metadata.outputs.tags }}                                    
        labels: ${{ steps.metadata.outputs.labels }}                                
        push: true                                                                                        
        outputs: type=image,name=ghcr.io/my_org/my_image,push=true 
        platforms: linux/amd64                                                   
        provenance: false  

This produces two images on ghcr.io, one tagged with latest and the version from steps.version.outputs.version with hash sha256:e96362243d37fe00c56793c3b75dbe2b7c716f6123f37eeb817156bea6fe36ea as well as another one with hash sha256:0545832aef292a8efe0795dfe6a5ab07c180eeaadebd1cc5faa2e0f86b9fc070 that has the same history as the former. What is going on here?