comments, second pass

.github/workflows/docker-release.yml

@@ -2,7 +2,6 @@ name: Build Docker
 
 permissions:
   contents: read    # needed to checkout repo
-  id-token: write    # needed for signing attestations (SBOM & provenance) with GitHub OIDC
   packages: write    # needed for interacting with GHCR
 
 on:
@@ -105,7 +104,7 @@ jobs:
         env:
           DIGEST: ${{ steps.build.outputs.digest }}
         run: |
-          mkdir -p $RUNNER_TEMP/digests
+          mkdir -p "$RUNNER_TEMP/digests"
           touch "$RUNNER_TEMP/digests/${DIGEST#sha256:}"
 
       - name: "Upload digest"
@@ -129,6 +128,7 @@ jobs:
       - name: "Download digests"
         uses: actions/download-artifact@v7
         with:
+          if_no_artifact_found: fail
           path: ${{ runner.temp }}/digests
           pattern: digest-*
           merge-multiple: true
@@ -154,12 +154,16 @@ jobs:
       - name: "Create image index"
         env:
           DOCKER_TAGS: ${{ steps.metadata.outputs.tags }}
-          GITHUB_TAG: ${{ github.ref_name }}
         working-directory: ${{ runner.temp }}/digests
         run: |
-          TAG_ARGS=""
-          for tag in $DOCKER_TAGS; do
-            TAG_ARGS="$TAG_ARGS --tag $tag"
+          TAG_ARGS=()
+          while IFS= read -r tag; do
+            TAG_ARGS+=(--tag "$tag")
+          done <<< "$DOCKER_TAGS"
+
+          DIGEST_ARGS=()
+          for digest in *; do
+            DIGEST_ARGS+=("$GHCR_IMAGE@sha256:$digest")
           done
 
           docker buildx imagetools create \
@@ -167,10 +171,12 @@ jobs:
             --annotation "index:org.opencontainers.image.description=$OCI_DESCRIPTION" \
             --annotation "index:org.opencontainers.image.title=$OCI_TITLE" \
             --annotation "index:org.opencontainers.image.url=$OCI_URL" \
-            $TAG_ARGS \
-            $(printf "$GHCR_IMAGE@sha256:%s " *)
+            "${TAG_ARGS[@]}" \
+            "${DIGEST_ARGS[@]}"
 
       - name: "Inspect images"
+        env:
+          GITHUB_TAG: ${{ github.ref_name }}
         run: |
           docker buildx imagetools inspect "$GHCR_IMAGE:latest"
           docker buildx imagetools inspect "$GHCR_IMAGE:$GITHUB_TAG"