From b67af4c7e61cb01dfb6eb8bcaec58dbc55de1805 Mon Sep 17 00:00:00 2001
From: germondai <germondai@gmail.com>
Date: Wed, 22 Jul 2026 20:06:04 +0200
Subject: [PATCH] fix(ci): inspect uses fully-qualified tag from
 metadata-action JSON

---
 .github/workflows/publish.yml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 43ac49f..86bc650 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -113,16 +113,13 @@ jobs:
             $(printf '${{ env.IMAGE }}@sha256:%s ' *)
 
       - name: Inspect manifest
-        env:
-          IMAGE: ${{ env.IMAGE }}
         run: |
           # Pull the first tag actually pushed by docker/metadata-action in the previous
-          # step (env var DOCKER_METADATA_OUTPUT_JSON). The legacy logic re-derived from
-          # ${{ github.ref }} / ${{ github.sha }}, but `type=sha,prefix=nightly-` writes
-          # the short 7-char SHA while `${{ github.sha }}` is the full 40-char hash, so
-          # the inspect always 404'd on main pushes (e.g. searched for
-          # nightly-2b146e36bd89510b0027978d72fdcb2a95b5bb37 but only
-          # nightly-2b146e3 was pushed).
+          # step. DOCKER_METADATA_OUTPUT_JSON.tags[] is already fully-qualified
+          # ("ghcr.io/germondai/trawl:nightly-…") so no $IMAGE prefix needed — the legacy
+          # logic re-derived from ${{ github.ref }} / ${{ github.sha }} which disagreed
+          # with what got pushed (type=sha,prefix=nightly- writes short 7-char SHA but
+          # github.sha is the full 40-char hash).
           tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
-          docker buildx imagetools inspect "$IMAGE:$tag"
+          docker buildx imagetools inspect "$tag"