Tag builder latest by the digest of the full manifest list

pack pushes an image per target under the version tag before it pushes
the manifest list there, and the registry can still serve one of those
right after the push. On builder-noble-java-tiny 0.0.200, `crane tag
<version> latest` copied the linux/arm64 image to `latest`, so amd64
builds failed with "exec format error"
(paketo-buildpacks/builder-noble-java-tiny#344).

Read the version tag until it lists every target of builder.toml (fail
after a minute), then tag latest by the digest of exactly that manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: alekseinovikov

builder/.github/workflows/push-image.yml

@@ -91,7 +91,29 @@ jobs:
         ./scripts/publish.sh --builder-toml-path "${{ matrix.builders.path }}/builder.toml" \
           --builder-image-ref "${IMAGE_REF}"
 
-        ./.bin/crane tag "${IMAGE_REF}" latest
+        # pack pushes an image per target under IMAGE_REF before the manifest list, and the registry
+        # can still serve one of them right after the push. Tag latest by the digest of a manifest
+        # that lists every target of builder.toml, so it never ends up single-platform.
+        EXPECTED=$(grep -c '^\[\[targets\]\]' "${{ matrix.builders.path }}/builder.toml" || true)
+        if [ "${EXPECTED}" -lt 1 ]; then
+          EXPECTED=1
+        fi
+
+        for attempt in $(seq 1 12); do
+          ./.bin/crane manifest "${IMAGE_REF}" > manifest.json
+          PLATFORMS=$(jq 'if .manifests then [.manifests[] | select(.platform.architecture != "unknown")] | length else 1 end' manifest.json)
+          if [ "${PLATFORMS}" -eq "${EXPECTED}" ]; then
+            break
+          fi
+          if [ "${attempt}" -eq 12 ]; then
+            echo "::error::${IMAGE_REF} lists ${PLATFORMS} platforms, builder.toml has ${EXPECTED} targets"
+            exit 1
+          fi
+          sleep 5
+        done
+
+        DIGEST="sha256:$(sha256sum manifest.json | cut -d ' ' -f 1)"
+        ./.bin/crane tag "${DOCKERHUB_ORG}/${CONTAINER_REPO}@${DIGEST}" latest
 
   failure:
     name: Alert on Failure