Regression: Multi-platform builds broken

[Zenexer]

Troubleshooting

Before submitting a bug report please read the Troubleshooting doc.

Behaviour

Steps to reproduce this issue

1. Attempt to build for multiple platforms using the platforms directive
2. Attempt to push the results to ghcr.io

Expected behaviour

Images for multiple platforms will be pushed.

This was the observed behavior until about 24 hours ago, when multi-platform builds broke.

Actual behaviour

All but one of the platforms will fail with an error similar to the following:

#13 ERROR: unexpected status: 401 Unauthorized
------
 > exporting to image:
------
error: failed to solve: unexpected status: 401 Unauthorized
Error: buildx failed with: error: failed to solve: unexpected status: 401 Unauthorized

Replacing the platforms directive with a single platform resolves the issue, regardless of which platform is chosen.

I'm not sure why it's a 401 error; that may indicate the issue is specific to ghcr.io, but I'm not sure.

Configuration

• Repository URL (if public): private
• Build URL (if public): private

name: "Docker"

on:
  push:
    tags:
      - "v*"

jobs:
  push:
    runs-on: "ubuntu-latest"

    steps:
      - uses: "actions/checkout@v2"
      - uses: "docker/setup-qemu-action@v1"
      - uses: "docker/setup-buildx-action@v1"

      - name: "Get docker info"
        run: |
          echo "Actor: ${{ github.actor }}"

      - name: "Log into GitHub Container Registry"
        if: "github.event_name != 'pull_request'"
        uses: "docker/login-action@v1"
        with:
          registry: "ghcr.io"
          username: "${{ github.actor }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: "Build and push"
        uses: "docker/build-push-action@v2"
        with:
          context: "."
          platforms: "linux/amd64,linux/arm64"
          push: ${{ github.event_name != 'pull_request' }}
          tags: ghcr.io/foo/bar:latest

[thaJeztah]

related discussion; docker/buildx#734

[Zenexer]

Minimal repro: https://github.com/Zenexer/docker-bug-test/actions Notice that the only difference between the two workflows is that the platforms are split into separate build steps in the working workflow.

[stefanprodan]

Any workaround for this? All our release pipelines for the https://github.com/fluxcd projects are broken.

[Zenexer]

@stefanprodan Yes, but it's not pretty: docker/buildx#734 (comment)

[stefanprodan]

@Zenexer I'm not sure how does this work, if I split this https://github.com/fluxcd/kustomize-controller/blob/main/.github/workflows/release.yml#L52-L69 per platform who will push the multi-arch meta layer?

[clambin]

seems to be working again.

[crazy-max]

https://github.com/docker/build-push-action/runs/3361578868?check_suite_focus=true