Disable provenance/SBOM attestations

.github/workflows/build-and-push.yml

@@ -37,14 +37,32 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Build
-        uses: docker/build-push-action@v2
-        with:
-          context: .
-          platforms: linux/${{ matrix.arch }}
-          load: true
-          tags: |
-            fedorapython/fedora-python-tox:${{ matrix.arch }}
-            fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
+        env:
+          DOCKER_BUILDKIT: 0
+        run: |
+          docker build \
+            --platform linux/${{ matrix.arch }} \
+            -t fedorapython/fedora-python-tox:${{ matrix.arch }} \
+            -t fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }} \
+            .
+      - name: Verify single-platform image
+        run: |
+          # Inspect the manifest
+          manifest=$(docker manifest inspect fedorapython/fedora-python-tox:${{ matrix.arch }})
+
+          # For single-platform images, manifests should be null
+          # For multi-platform or images with attestations, manifests is an array
+          manifests=$(echo "$manifest" | jq '.manifests')
+
+          if [ "$manifests" != "null" ]; then
+            manifest_count=$(echo "$manifests" | jq '. | length')
+            echo "ERROR: Image has a manifest list with $manifest_count entries (expected null for single-platform)!"
+            echo "This usually means attestations are enabled or it's a multi-platform image."
+            echo "$manifests" | jq '.[] | {platform: .platform, digest: .digest, annotations: .annotations}'
+            exit 1
+          fi
+
+          echo "✓ Verified: Image is single-platform (manifests: null)"
       - name: Test local project
         env:
           TOXENV: ${{ matrix.toxenv }}
@@ -75,15 +93,10 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Push to Dockerhub
-        uses: docker/build-push-action@v2
         if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-        with:
-          context: .
-          platforms: linux/${{ matrix.arch }}
-          push: true
-          tags: |
-            fedorapython/fedora-python-tox:${{ matrix.arch }}
-            fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
+        run: |
+          docker push fedorapython/fedora-python-tox:${{ matrix.arch }}
+          docker push fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
 
   description_update:
     name: 'Update Dockerhub description'