From 753cc626d1689151a87f3b505b8fcc055ec1c911 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20St=C3=A4bler?= <cstabler@redhat.com>
Date: Wed, 28 Jan 2026 09:15:46 +0100
Subject: [PATCH] Use image digest in release manifest

---
 .github/workflows/release.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cffaf09..3713a02 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,6 +86,7 @@ jobs:
           fi
 
       - name: Build and push image (latest version)
+        id: build_latest
         if: steps.version.outputs.is_latest == 'true'
         uses: docker/build-push-action@v6
         with:
@@ -100,6 +101,7 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
 
       - name: Build and push image (none latest version)
+        id: build_non_latest
         if: steps.version.outputs.is_latest == 'false'
         uses: docker/build-push-action@v6
         with:
@@ -120,10 +122,19 @@ jobs:
       - name: Generate installation manifest
         run: |
           GIT_SHA=$(git rev-parse --short HEAD)
+          
+          # Use digest from whichever build step ran (latest or non-latest)
+          if [ "${{ steps.version.outputs.is_latest }}" == "true" ]; then
+            IMAGE_DIGEST="${{ steps.build_latest.outputs.digest }}"
+          else
+            IMAGE_DIGEST="${{ steps.build_non_latest.outputs.digest }}"
+          fi
+          
           make build-installer \
-            IMG=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.full }} \
+            IMG=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${IMAGE_DIGEST} \
             VERSION_LABEL=v${{ steps.version.outputs.full }} \
             GIT_SHA_LABEL=${GIT_SHA}
+          
           mv dist/install.yaml func-operator.yaml
 
       - name: Create GitHub Release