From 9835f925aa3118c4eace383e85ea87e4782be21a Mon Sep 17 00:00:00 2001
From: Maximilian <maximilian.reichel@backbrain.io>
Date: Mon, 27 Apr 2026 13:43:47 +0200
Subject: [PATCH] ci(publish): walk per-cell layouts instead of merging into
 one dir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

actions/download-artifact's merge-multiple: true overwrote each cell's
oci-layout/index.json (same relative path across all 20 artifacts),
leaving the merged layout's index referencing only the last cell's
manifests. Cell blob bytes survived in blobs/sha256/ but were
unreferenced, so phpup push only saw a fraction of the manifests it
should have promoted.

Symptom seen post-merge of #87 (canonical-tag fix): the publish job's
Promote step succeeded but only one redis 6.3.0 canonical tag landed
on GHCR — the rest were the index.json entries that got overwritten
during the merge. Update lockfile then 404'd on 9 of 10 redis 6.3.0
cells.

Drop merge-multiple, let each artifact land in its own subdir under
out/, and loop over them in the Promote step. Each phpup push call
sees a complete per-cell index.json. Net work is identical (each
manifest is still pushed once).
---
 .github/workflows/ci.yml | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39c893c..732c355 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -247,18 +247,36 @@ jobs:
       - name: Build phpup
         run: make bin/phpup
       - name: Download all oci-layout artifacts
+        # Each cell's artifact lands in its own subdirectory:
+        #   out/oci-layout-<os>-<arch>-<php>/<oci-layout files>
+        # We deliberately do NOT use merge-multiple here — that flag
+        # overwrites colliding files (every cell's oci-layout/index.json
+        # lives at the same relative path), losing 19 cells' worth of
+        # manifest entries even though the blob bytes survive in
+        # blobs/sha256/. Promote walks each layout separately instead.
         uses: actions/download-artifact@v8
         with:
           pattern: oci-layout-*
-          path: out/merged-layout
-          merge-multiple: true
+          path: out
       - name: Promote to GHCR
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OWNER: ${{ github.repository_owner }}
         run: |
-          bin/phpup push \
-            --from "oci-layout:$(pwd)/out/merged-layout" \
-            --to "ghcr.io/${{ github.repository_owner }}"
+          set -euo pipefail
+          shopt -s nullglob
+          layouts=(out/oci-layout-*/)
+          if [ "${#layouts[@]}" -eq 0 ]; then
+            echo "::error::no oci-layout-* artifacts found under out/"
+            exit 1
+          fi
+          for layoutdir in "${layouts[@]}"; do
+            echo "::group::Promote $layoutdir"
+            bin/phpup push \
+              --from "oci-layout:$(pwd)/${layoutdir%/}" \
+              --to "ghcr.io/$OWNER"
+            echo "::endgroup::"
+          done
       - name: Update lockfile
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}