Creating an image and a docker output at once

[cdauth]

I am trying to follow the guide to build a multi-platform image in parallel. What's different about my setup than the guide is that I want to first build the image, then run integration tests on it, and then push the image to the registry (if the tests succeed).

I don't really know much about how buildx works, but the way I understand it is that to create a multi-platform image in parallel, I have to run one job for each platform in parallel where it builds the image and pushes it to the registry using a “push by digest”. My understanding is that this pushes the image without creating/updating an image tag in the repository; the image can be accessed and downloaded as org/name@sha256:<hash>, although I think on Docker Hub I cannot see a list of the existing digests of an image, so the images pushed by digest are kind of hidden.

My understanding is that after all platform images have been built and pushed, I have to run another job where it creates a manifest that references all the digests of the different platforms, and then push this manifest as a new tag of the image.

Since I have not been able to find a way to first build the image locally, then run the integration tests, and then “push by digest” the image (related discussion: docker/buildx#2718; I have also not found a way to “push by digest” using a regular docker push command, which would be an alternative solution to my problem), the approach that I am trying to use now is to first build and push by digest, then run the integration tests, and then create and push the manifest only if the integration tests have succeed. It's a bit of a waste of resources since it uploads the images if the tests fail, but at least it will not publish the image (in the form of a tag) in that case.

Where I am getting stuck now is that in the step where I build and push by digest the image, I also need to store my image locally in order to use it in the integration tests. You can find my full configuration here (only the build-facilmap and merge-facilmap jobs are relevant for this question, the other ones build something else), but the important step is this:

      -
        name: Build and push docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          labels: ${{ steps.meta.outputs.labels }}
          outputs: |
            type=image,"name=facilmap/facilmap",push-by-digest=true,name-canonical=true,push=true
            type=docker,name=facilmap-ci

I am trying to both push by digest the image to the facilmap/facilmap repository and to a local image tagged facilmap-ci. With this setup, the integration tests succeed (so the facilmap-ci image is properly tagged locally) but pushing the multi-platform manifest later fails because the digests cannot be found (example error: ERROR: docker.io/facilmap/facilmap@sha256:494f9534668c9aeef797f14f492bbffaef1767d5bcd59a7667697fb595921762: not found), so the image was not pushed by digest. However, if I remove the type=docker,name=facilmap-ci line from the outputs (and the steps that run the integration tests), pushing the multi-platform manifest succeeds, so the image is properly pushed by digest.

This looks to me like trying to create the two outputs at once does not work in this case. What could be the reason for this? What could be a workaround (that does not involve downloading the image back from the repository)?