Tag builder latest by the digest of the full manifest list

pack pushes an image per target under the version tag before it pushes
the manifest list there, and the registry can still return one of those
right after the push. On builder-noble-java-tiny 0.0.200, `crane tag
<version> latest` copied the linux/arm64 image to `latest`, so amd64
builds failed with "exec format error"
(paketo-buildpacks/builder-noble-java-tiny#344).

Read the version tag until it lists every target of builder.toml (fail
after a minute), then tag latest by the digest of exactly that manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: alekseinovikov

builder/.github/workflows/push-image.yml

@@ -91,7 +91,23 @@ jobs:
         ./scripts/publish.sh --builder-toml-path "${{ matrix.builders.path }}/builder.toml" \
           --builder-image-ref "${IMAGE_REF}"
 
-        ./.bin/crane tag "${IMAGE_REF}" latest
+        EXPECTED_PLATFORMS=$(grep -c '^\[\[targets\]\]' "${{ matrix.builders.path }}/builder.toml" || true)
+        if [ "${EXPECTED_PLATFORMS}" -eq 0 ]; then
+          EXPECTED_PLATFORMS=1
+        fi
+
+        MAX_ATTEMPTS=12
+        for _ in $(seq 1 "${MAX_ATTEMPTS}"); do
+          ./.bin/crane manifest "${IMAGE_REF}" > manifest.json
+          PLATFORMS=$(jq 'if .manifests then (.manifests | length) else 1 end' manifest.json)
+          if [ "${PLATFORMS}" -eq "${EXPECTED_PLATFORMS}" ]; then
+            ./.bin/crane tag "${DOCKERHUB_ORG}/${CONTAINER_REPO}@sha256:$(sha256sum manifest.json | cut -d ' ' -f 1)" latest
+            exit 0
+          fi
+          sleep 5
+        done
+        echo "::error::${IMAGE_REF} has ${PLATFORMS} platforms, expected ${EXPECTED_PLATFORMS}"
+        exit 1
 
   failure:
     name: Alert on Failure