From a3ca2cecb83f585cf52e9f078c344901b80dba18 Mon Sep 17 00:00:00 2001 From: whg517 Date: Sun, 23 Aug 2026 15:55:31 +0800 Subject: [PATCH] fix(build): let a failed image push fail the build The buildx push line is prefixed with `-`, so make ignores a non-zero exit. That turns a failed push into a silent no-op. release.yml happens to catch it, because a later cosign step reads docker-digests.json and dies when the file was never written: ERROR: failed to push quay.io/zncdatadev/nifi-operator:0.4.0-dev: 401 UNAUTHORIZED make: [Makefile:155: docker-buildx] Error 1 (ignored) jq: error: Could not open file docker-digests.json: No such file or directory publish.yml has no cosign step, so nothing notices - the push fails, make swallows it, and the job reports success. nifi-operator reported a successful Publish Image on 2026-08-19 while its quay repository did not exist and every push had been returning 401. The registry had zero tags. Drop the prefix on the push. It stays on `buildx create` and `buildx rm`, where tolerating failure is intentional: create fails when the builder already exists, and rm is cleanup. Co-Authored-By: Claude Opus 5 --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index c95b5da..8fab9bd 100644 --- a/Makefile +++ b/Makefile @@ -148,7 +148,7 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross - $(CONTAINER_TOOL) buildx create --name $(PROJECT_NAME)-builder $(CONTAINER_TOOL) buildx use $(PROJECT_NAME)-builder - - $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --metadata-file docker-digests.json -f Dockerfile.cross . + $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --metadata-file docker-digests.json -f Dockerfile.cross . - $(CONTAINER_TOOL) buildx rm $(PROJECT_NAME)-builder rm Dockerfile.cross