From 683e7bb0349652bcbe631d6c304d27d921c4e6b0 Mon Sep 17 00:00:00 2001
From: Cedrick Lunven <cedrick.lunven@gmail.com>
Date: Wed, 19 Aug 2026 14:49:17 +0200
Subject: [PATCH 1/2] fix: disable provenance attestations to remove
 unknown/unknown manifests from image index

---
 .github/workflows/docker-image-publish.yaml | 2 ++
 .github/workflows/release.yaml              | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/docker-image-publish.yaml b/.github/workflows/docker-image-publish.yaml
index 9f0c4cd172..31ae5defb8 100644
--- a/.github/workflows/docker-image-publish.yaml
+++ b/.github/workflows/docker-image-publish.yaml
@@ -52,6 +52,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+        with:
+          provenance: false
 
       - name: Configure AWS credentials via OIDC
         uses: aws-actions/configure-aws-credentials@v6
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index da07da27df..ecc4567dfd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -158,6 +158,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+        with:
+          provenance: false
 
       # only set version here
       - name: Install
@@ -202,6 +204,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
+        with:
+          provenance: false
 
       # only set version here
       - name: Install

From 2090d1edf86c2cb0b71816963580e3e85968b864 Mon Sep 17 00:00:00 2001
From: Eric Hare <ericrhare@gmail.com>
Date: Thu, 20 Aug 2026 13:04:45 -0700
Subject: [PATCH 2/2] fix: use BUILDX_NO_DEFAULT_ATTESTATIONS on build steps
 (provenance is not a setup-buildx-action input)

---
 .github/workflows/docker-image-publish.yaml | 7 +++++--
 .github/workflows/release.yaml              | 8 ++++----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-image-publish.yaml b/.github/workflows/docker-image-publish.yaml
index 31ae5defb8..02d9884b4d 100644
--- a/.github/workflows/docker-image-publish.yaml
+++ b/.github/workflows/docker-image-publish.yaml
@@ -52,8 +52,6 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
-        with:
-          provenance: false
 
       - name: Configure AWS credentials via OIDC
         uses: aws-actions/configure-aws-credentials@v6
@@ -68,10 +66,15 @@ jobs:
           mask-password: 'true'
 
       - name: Build and push (Amazon ECR)
+        env:
+          # avoid unknown/unknown attestation manifests
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
         run: |
           ./mvnw -B -ntp clean package -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.registry=${{ secrets.ECR_REPOSITORY }} -Dquarkus.container-image.tag=${{ github.sha }} -Dquarkus.container-image.additional-tags='' ${{ matrix.profile }}
 
       - name: Build and push image for profiling (Amazon ECR)
+        env:
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
         run: |
           ./mvnw -B -ntp clean package -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true -Dquarkus.container-image.registry=${{ secrets.ECR_REPOSITORY }} -Dquarkus.container-image.tag=${{ github.sha }} -Dquarkus.container-image.additional-tags='' -Dquarkus.container-image.name=jsonapi-profiling -Dquarkus.docker.dockerfile-jvm-path=src/main/docker/Dockerfile-profiling.jvm ${{ matrix.profile }}
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ecc4567dfd..bb2016543a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -158,8 +158,6 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
-        with:
-          provenance: false
 
       # only set version here
       - name: Install
@@ -175,6 +173,9 @@ jobs:
 
       - name: Build data-api image and push (Docker Hub)
         if: ${{ !inputs.skipPublish }}
+        env:
+          # avoid unknown/unknown attestation manifests
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
         run: |
           ./mvnw -B -ntp clean package -DskipTests -Dquarkus.container-image.build=true -Dquarkus.docker.buildx.platform=linux/amd64,linux/arm64 -Dquarkus.container-image.push=true  -Dquarkus.container-image.tag=${{needs.resolve-tag.outputs.release-tag}} -Dquarkus.container-image.name=data-api ${{ matrix.profile }}
 
@@ -204,8 +205,6 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
-        with:
-          provenance: false
 
       # only set version here
       - name: Install
@@ -229,6 +228,7 @@ jobs:
       - name: Build and push (Amazon ECR)
         if: ${{ !inputs.skipPublish }}
         env:
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
           QUARKUS_APPLICATION_NAME: 'Astra DB Serverless Data API'
           QUARKUS_SMALLRYE_OPENAPI_INFO_DESCRIPTION: 'The Astra DB Serverless Data API modifies and queries data stored as unstructured JSON documents in collections. See the [documentation site](https://docs.datastax.com/en/astra/astra-db-vector/api-reference/data-api.html) for additional information.'
           QUARKUS_SMALLRYE_OPENAPI_INFO_TERMS_OF_SERVICE: 'https://www.ibm.com/legal'