fix: Improved publish flow

[juanjosevazquezgil]

Related to https://github.com/prefapp/features/issues/1126

[Copilot]

Pull request overview

This PR adjusts the image publish flow in BuildImages.compile_image_and_publish to better preserve multi-platform manifests by publishing via Dagger and then attempting to append the newly published digest to an existing registry manifest using Docker Buildx imagetools.

Changes:

• Removed the “inspect existing manifest” approach (_get_existing_platforms) and the associated json parsing logic.
• After publishing, derived a digest-based ref and invoked docker buildx imagetools create --append ... to merge with an existing manifest.
• Updated unit tests to mock publish and subprocess.run and assert the imagetools invocation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
firestarter/workflows/build_images/build_images.py	Reworks publish behavior to append newly published digest to an existing multi-platform manifest via Docker Buildx imagetools.
firestarter/tests/test_build_images_functionality.py	Updates mocks/assertions to cover the new publish+append behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

firestarter/tests/test_build_images_functionality.py:364

• After updating the mocked publish() return value to include a digest reference, this assertion should expect the new digest-based ref. The implementation extracts the digest (portion after @) and formats the first entry as f"{image}@{digest}".

            subprocess_run_mock.assert_called_once_with(
                ["docker", "buildx", "imagetools", "create", "--tag", image,
                 f"{image}@Mock publish result", f"{image}@sha256:oldsingledigest"],
                capture_output=True, text=True, check=True, timeout=60
            )

firestarter/workflows/build_images/build_images.py:392

• get_existing_platform_digests() runs subprocess.run() synchronously from within an async method, which will block the event loop while Docker inspects the remote image. This can stall other async work and slow down the workflow under concurrency. Run this call in a worker thread (as the previous implementation did) or make the helper async.

        if self.publish:
            existing_platforms = self.get_existing_platform_digests(image)
            platforms_built = set(platforms_to_build)

firestarter/tests/test_build_images_functionality.py:342

• The test sets publish() to return a value without an @... digest, but the implementation only runs the manifest merge (docker buildx imagetools create) when published_ref contains @. With the current mock return value, the merge path is skipped and this test will fail when it later asserts subprocess.run was called.

This issue also appears on line 360 of the same file.

        async def _publish(*args, **kwargs):
            return "Mock publish result"
        ctx_mock_publish_mock = mocker.patch.object(ctx_mock, "publish", side_effect=_publish)