Skip to content

fix: set up buildx driver for dockers_v2 sbom attestation in release - #724

Merged
SoulPancake merged 2 commits into
mainfrom
fix/release-buildx-driver
Jul 13, 2026
Merged

fix: set up buildx driver for dockers_v2 sbom attestation in release#724
SoulPancake merged 2 commits into
mainfrom
fix/release-buildx-driver

Conversation

@SoulPancake

@SoulPancake SoulPancake commented Jul 13, 2026

Copy link
Copy Markdown
Member

Description

For fixing this issue during the goreleaser run

https://github.com/openfga/cli/actions/runs/29270705836/job/86888153455

dockers_v2 migration changed the buildx command GoReleaser runs. It now builds a multi-platform image (--platform linux/amd64,linux/arm64) with SBOM attestations (--attest=type=sbom). Both of those require BuildKit running under the docker-container driver.

Our release job never initialized buildx, so it fell back to the default docker driver, which supports neither multi-platform manifests nor attestations. That's the exact error the release hit:

  ERROR: failed to build: Attestation is not supported for the docker driver.
  Switch to a different driver, or turn on the containerd image store, and try again.

The old dockers: (v1) config built single-platform images per arch with no attestations, so the default driver was fine — which is why this never failed before the migration.

Adding docker/setup-buildx-action creates a docker-container builder that supports both, and docker/setup-qemu-action provides the arm64 emulation needed to cross-build the arm64 image on the amd64 runner. This is also the setup GoReleaser's own docs recommend for multi-arch image builds.

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

  • New Features
    • Release builds now support multi-architecture Docker images.
    • Container packaging is more compatible across different processor architectures.

Copilot AI review requested due to automatic review settings July 13, 2026 18:09
@SoulPancake
SoulPancake requested a review from a team as a code owner July 13, 2026 18:09
@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3f30ad70-bcad-42e5-ad31-b8073b950c6a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

The tagged goreleaser workflow now initializes QEMU and Docker Buildx before Docker Hub login and release packaging steps.

Changes

Release container build setup

Layer / File(s) Summary
Docker build prerequisites
.github/workflows/main.yaml
The goreleaser job adds QEMU and Docker Buildx setup steps before subsequent Docker and release actions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: copilot, dependabot[bot], siddhant-k-code, rhamzeh

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the change: it describes adding Buildx setup in the release workflow for Docker/SBOM attestation.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/release-buildx-driver

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the release workflow to ensure Docker Buildx is configured during tagged releases, addressing a GoReleaser failure when building multi-arch Docker images with SBOM attestation.

Changes:

  • Add a QEMU setup step to enable multi-architecture builds in the release job.
  • Add a Docker Buildx setup step so docker buildx build --attest=type=sbom runs with a compatible driver before the Docker Hub publish step.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@SoulPancake
SoulPancake added this pull request to the merge queue Jul 13, 2026
Merged via the queue into main with commit fe382e0 Jul 13, 2026
27 checks passed
@SoulPancake
SoulPancake deleted the fix/release-buildx-driver branch July 13, 2026 18:17
@openfga-releaser-bot openfga-releaser-bot Bot mentioned this pull request Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants