From f109d035790e372a6c35173a09814adca51ae52a Mon Sep 17 00:00:00 2001
From: gitclonebrian <235774926+gitclonebrian@users.noreply.github.com>
Date: Tue, 30 Jun 2026 13:36:54 -0400
Subject: [PATCH 1/2] added steps to each matrix iteration to generate a
 manifest fragment for the image built in that step. added a final job to
 aggregate the fragments into a final manifest

---
 .github/workflows/build.yml | 53 +++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 399af5498c62..e8719e3b9e37 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -286,6 +286,29 @@ jobs:
           push: true
           tags: ${{ steps.image-tags.outputs.tags }}
 
+      - name: Generate image manifest fragment
+        env:
+          PROJECT_NAME: ${{ steps.setup.outputs.project_name }}
+          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
+          DIGEST: ${{ steps.build-artifacts.outputs.digest }}
+        run: |
+          mkdir -p image-manifest-fragments
+          jq -n \
+            --arg name "$PROJECT_NAME" \
+            --arg registry "$_AZ_REGISTRY" \
+            --arg image "$PROJECT_NAME" \
+            --arg tag "$IMAGE_TAG" \
+            --arg digest "$DIGEST" \
+            '{($name): {type: "container_image", registry: $registry, image: $image, tag: $tag, digest: $digest}}' \
+            > "image-manifest-fragments/${PROJECT_NAME}.json"
+
+      - name: Upload image manifest fragment
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: image-manifest-fragment-${{ steps.setup.outputs.project_name }}
+          path: image-manifest-fragments/${{ steps.setup.outputs.project_name }}.json
+          if-no-files-found: error
+
       - name: Install Cosign
         if: github.event_name != 'pull_request' && env.is_publish_branch == 'true'
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -327,6 +350,36 @@ jobs:
       - name: Log out from Azure
         uses: bitwarden/gh-actions/azure-logout@main
 
+  image-manifest:
+    name: Build image manifest
+    runs-on: ubuntu-22.04
+    needs: build-artifacts
+    permissions:
+      contents: read
+    steps:
+      - name: Download image manifest fragments
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          pattern: image-manifest-fragment-*
+          path: image-manifest-fragments
+          merge-multiple: true
+
+      - name: Combine image manifest fragments
+        id: combine
+        run: |
+          additional_artifacts=$(jq -s 'add' image-manifest-fragments/*.json)
+          {
+            echo "additional_artifacts<<EOF"
+            echo "$additional_artifacts"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and upload artifact manifest
+        uses: bitwarden/gh-actions/artifact-manifest@main
+        with:
+          mode: upload
+          additional_artifacts: ${{ steps.combine.outputs.additional_artifacts }}
+
   upload:
     name: Upload
     runs-on: ubuntu-22.04

From eb02883f41bd27b2532ad8597e2da56e12895caf Mon Sep 17 00:00:00 2001
From: gitclonebrian <235774926+gitclonebrian@users.noreply.github.com>
Date: Thu, 2 Jul 2026 12:19:49 -0400
Subject: [PATCH 2/2] added needs to k8s deploy step to make sure manifest is
 complete

---
 .github/workflows/build.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e8719e3b9e37..54d637b0440f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -622,7 +622,9 @@ jobs:
     name: Trigger K8s deploy
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-22.04
-    needs: build-artifacts
+    needs:
+      - build-artifacts
+      - image-manifest
     permissions:
       id-token: write
     steps: