From acd4cb8a4a9ba0b1df19d51b8e2bfed3cf4ee9a9 Mon Sep 17 00:00:00 2001
From: Wynne Pirini <wynnepirini@gmail.com>
Date: Wed, 14 Oct 2026 14:36:04 +1300
Subject: [PATCH] packaging(ns8): fix buildah subcommand typo that broke
 manifest assembly

The first main-branch publish after #137 failed at 'Assemble and push the
multi-arch manifest'. The per-arch builds and pushes both succeeded (the
:build-amd64 and :build-arm64 tags are in the registry); the failure was the
preflight check in push-manifest.sh using 'buildah image exists'. There is
no singular image subcommand, so buildah errored out and the script bailed
before assembling anything.

Use 'buildah images -q', which prints the image ID when the tag is present
and nothing when it is absent.

This was only ever caught because the publish path was verified end to end:
PR builds push nothing, so the manifest step is skipped there and a green PR
run proves nothing about it.

Also add a validate step that asserts every buildah subcommand the build
scripts invoke actually exists, so this class of typo fails in seconds on a
PR instead of minutes into a release publish.
---
 .github/workflows/ns8-module.yml | 10 ++++++++++
 packaging/ns8/push-manifest.sh   |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ns8-module.yml b/.github/workflows/ns8-module.yml
index b53baf7e..76ef09f1 100644
--- a/.github/workflows/ns8-module.yml
+++ b/.github/workflows/ns8-module.yml
@@ -37,6 +37,16 @@ jobs:
           bash -n imageroot/actions/configure-module/80start_services
           bash -n build-images.sh
           bash -n push-manifest.sh
+          # Every buildah subcommand the scripts invoke must be a real one.
+          # A typo like "buildah image exists" (there is no singular form)
+          # only surfaces after a full two-arch build, minutes into a publish.
+          # This runner has buildah preinstalled, so check it here instead.
+          for sub in $(grep -ohE 'buildah [a-z]+' build-images.sh push-manifest.sh | awk '{print $2}' | sort -u); do
+            if ! buildah "$sub" --help >/dev/null 2>&1; then
+              echo "::error::buildah has no subcommand '$sub' used by the build scripts"
+              exit 1
+            fi
+          done
           # No build-time placeholders may remain: the unit and configure read
           # the app ref from ${CALNODE_IMAGE} at install time.
           ! grep -rn '__CALNODE_APP_IMAGE__' imageroot/
diff --git a/packaging/ns8/push-manifest.sh b/packaging/ns8/push-manifest.sh
index ea126793..f879ca14 100755
--- a/packaging/ns8/push-manifest.sh
+++ b/packaging/ns8/push-manifest.sh
@@ -36,7 +36,9 @@ if [ "${#arches[@]}" -eq 0 ]; then
 fi
 
 for arch in "${arches[@]}"; do
-    if ! buildah image exists "${repobase}/${reponame}:build-${arch}"; then
+    # `images -q` prints the image ID when the tag is present and prints
+    # nothing when it is absent. There is no singular "image exists" form.
+    if [ -z "$(buildah images -q "${repobase}/${reponame}:build-${arch}")" ]; then
         echo "Missing local image for ${arch}. Run build-images.sh with" \
              "TARGETARCH=${arch} PUSH=1 first." >&2
         exit 1