Can't push tagged ref docker.io/user/image:latest by digest

[erhhung]

I'm trying to build a multi-platform image and push to both Docker Hub and GHCR, but after augmenting the image tags in the metadata-action step to include the prefixes docker.io/ and ghcr.io/, the push is now failing (to Docker Hub at least).

#39 exporting to image
#39 exporting layers
#39 exporting layers 31.0s done
#39 exporting manifest sha256:9bdc9c3f93a69383887af3e656fb181619390ee51b83e38b087ef1083d1085d5 done
#39 exporting config sha256:90e25434ccf58e8147de284f719389e0d1ce03236b1512e102fcdcdbe1b16f2e done
#39 exporting attestation manifest sha256:684b43f1b0b2f06903d3302c3b49e3fe27103e446df4506058e3c56d370fa906 done
#39 exporting manifest list sha256:9d57306557545b22895c[9422](https://github.com/erhhung/al2023-devops/actions/runs/10443045694/job/28916036654#step:12:9428)4f98014784aeb24a7c2865f0c46a1ec938a7e5a0 done
#39 ERROR: failed to push docker.io/erhhung/al2023-devops:24.08: can't push tagged ref docker.io/erhhung/al2023-devops:24.08 by digest

Full workflow log is available here.

It was previously working when I specified just ${{ github.repository }} (without any registry-specific prefix) for the images input to metadata-action, so only pushing to Docker Hub (the default), and also left out the tags input to build-push-action.

I've logged in successfully to all the required registries before the build-push-action step, so it's likely not an auth issue. I'd appreciate it if anyone can identify what else might be wrong with my workflow.

jobs:
  launch-runner:
    # omitted for brevity
  build:
    needs: launch-runner
    # use self-hosted runner for arm64 build; use GitHub-hosted runner otherwise
    runs-on: ${{ matrix.platform == 'linux/arm64' && fromJSON( needs.launch-runner.outputs.labels-json ) || 'ubuntu-latest' }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
      - name: Check out Source Code
        uses: actions/checkout@v4
      - name: Set Environment Variables
        run: |
          platform=${{ matrix.platform }}
          cat <<EOF >> $GITHUB_ENV
          PLATFORM_PAIR=${platform//\//-}
          EOF
      - name: Set up Docker Daemon
        uses: crazy-max/ghaction-setup-docker@v3
      - name: Set up QEMU Emulator
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ matrix.platform }}
      - name: Set up Docker BuildX
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          platforms: ${{ matrix.platform }}
          buildkitd-flags: >-
            --allow-insecure-entitlement security.insecure
            --allow-insecure-entitlement network.host
      - name: Extract Metadata for Docker
        id: metadata
        uses: docker/metadata-action@v5
        with:
          images: |
            docker.io/${{ github.repository }}
            ghcr.io/${{ github.repository }}
          labels: ${{ env.IMAGE_LABELS }}
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      - name: Log in to ECR Public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public
      - name: Log in to Docker Hub
        uses: docker/#-action@v3
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
      - name: Log in to GitHub GHCR
        uses: docker/#-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Build and Push by Digest
        id: build
        uses: docker/build-push-action@v6
        env:
          BUILDKIT_PROGRESS: plain
        with:
          platforms: ${{ matrix.platform }}
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          cache-from: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
          cache-to: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }},mode=max
          outputs: type=image,name=${{ github.repository }},push-by-digest=true,name-canonical=true,push=true
      - name: Export Digest
        run: |
          digest="${{ steps.build.outputs.digest }}"
          [ "$digest" ] || exit 1
          mkdir -p /tmp/digests
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload Digest
        uses: actions/upload-artifact@v4
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
  merge:
    # omitted for brevity
  terminate-runner:
    # omitted for brevity

[erhhung]

Figured out the issue, and I guess the emitted error message did give a clue if I had understood it then: can't push tagged ref docker.io/user/image:latest by digest

By tagged ref, it means the image tag :latest conflicts with the push-by-digest=true output option. So it's either push by tag or push by digest, and, if the latter, the tags input must then be a CSV of repo names only, like:

tags: docker.io/${{ github.repository }},ghcr.io/${{ github.repository }}