From 336fc199c1eb33782399573d49870e16ec35e391 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blair@pinpredict.com>
Date: Thu, 2 Jul 2026 17:33:44 -0400
Subject: [PATCH] fix(chart-release): pass the manifest media type when
 aliasing charts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

helm's OCI manifests omit the optional top-level mediaType field, and
put-image without --image-manifest-media-type rejects them with a
misleading "Invalid JSON syntax" — every sha alias since the step
landed failed (warn-only, so releases stayed green). Also extract the
manifest with jq -ej to a file: -j keeps the bytes exact so ECR
aliases the same image instead of storing a trailing-newline variant
as a second one, and -e fails the pipeline on a null lookup instead
of passing the literal "null" on.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/chart-release.yml | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
index 26afde0..a75fe30 100644
--- a/.github/workflows/chart-release.yml
+++ b/.github/workflows/chart-release.yml
@@ -202,14 +202,24 @@ jobs:
           # same manifest under a new one. Warn-only: without the
           # alias the direct CI notification below still covers the
           # release.
+          # put-image needs the media type passed explicitly: helm's OCI
+          # manifests omit the optional top-level mediaType field, and
+          # without it ECR rejects the manifest with a misleading
+          # "Invalid JSON syntax". jq -j keeps the manifest byte-exact
+          # (a trailing newline changes the digest and ECR stores a
+          # second image instead of aliasing); -e fails the pipeline on
+          # a null lookup instead of passing the literal "null" on.
           SHORT_SHA="${GITHUB_SHA:0:7}"
-          manifest=$(aws ecr batch-get-image --repository-name "charts/${NAME}" \
-            --image-ids imageTag="${version}" \
-            --query 'images[0].imageManifest' --output text)
-          aws ecr put-image --repository-name "charts/${NAME}" \
-            --image-tag "${version}-${SHORT_SHA}" \
-            --image-manifest "$manifest" >/dev/null \
-            || echo "::warning::sha alias tag failed for charts/${NAME}:${version}-${SHORT_SHA}"
+          {
+            aws ecr batch-get-image --repository-name "charts/${NAME}" \
+              --image-ids imageTag="${version}" --output json \
+              | jq -ej '.images[0].imageManifest' > manifest.json
+            aws ecr put-image --repository-name "charts/${NAME}" \
+              --image-tag "${version}-${SHORT_SHA}" \
+              --image-manifest "file://manifest.json" \
+              --image-manifest-media-type "application/vnd.oci.image.manifest.v1+json" \
+              >/dev/null
+          } || echo "::warning::sha alias tag failed for charts/${NAME}:${version}-${SHORT_SHA}"
 
           # Tag immediately after successful push (retry up to 3 times).
           # If permanent failure the chart sits in ECR with no git tag —