From bc980032e9ebdd5c18f9f8ed4d5b2e84a6001e59 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 2 Oct 2026 16:11:32 +0000
Subject: [PATCH] test(updater): expect the amd64-only publish and the
 lowercase namespace

The workflow test still described the multi-arch publish. It now checks
that only amd64 builds natively, that arm64 is documented as paused, that
one digest feeds the manifest, and that every image name comes from the
lowercase namespace step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
---
 infra/updater/src/publish-workflow.test.ts | 23 ++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/infra/updater/src/publish-workflow.test.ts b/infra/updater/src/publish-workflow.test.ts
index b4654c4..67e992a 100644
--- a/infra/updater/src/publish-workflow.test.ts
+++ b/infra/updater/src/publish-workflow.test.ts
@@ -19,31 +19,38 @@ const workflow = parse(workflowText) as {
 };
 
 describe("server image publish workflow", () => {
-  it("builds every architecture natively instead of emulating arm64", () => {
+  it("builds amd64 natively on the Linux runner and keeps arm64 paused, not emulated", () => {
     expect(workflowText).not.toContain("setup-qemu-action");
+    expect(workflowText).toContain("arm64 is paused");
     const build = workflow.jobs.build;
     expect(build["runs-on"]).toContain("matrix.runner");
-    expect(build.strategy?.matrix?.arch).toEqual(["amd64", "arm64"]);
+    expect(build.strategy?.matrix?.arch).toEqual(["amd64"]);
     const runners = Object.fromEntries(
       (build.strategy?.matrix?.include ?? [])
         .filter((entry) => entry.arch !== undefined)
         .map((entry) => [entry.arch, entry.runner]),
     );
-    expect(runners).toEqual({
-      amd64: ["self-hosted", "evoo-ci", "Linux"],
-      arm64: ["self-hosted", "evoo-ci", "macOS"],
-    });
+    expect(runners).toEqual({ amd64: ["self-hosted", "evoo-ci", "Linux"] });
   });
 
-  it("publishes one verified multi-arch manifest per image after both builds", () => {
+  it("publishes one verified manifest per image after the build", () => {
     const publish = workflow.jobs.publish;
     expect(publish.needs).toBe("build");
     expect(workflowText).toContain("push-by-digest=true");
     expect(workflowText).toContain("docker buildx imagetools create");
-    expect(workflowText).toContain("for want in linux/amd64 linux/arm64");
+    expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]');
+    expect(workflowText).toContain("for want in linux/amd64; do");
     expect(workflowText).toContain("actions/attest-build-provenance@");
   });
 
+  it("names every image under the lowercase repository namespace", () => {
+    expect(workflowText).not.toContain("ghcr.io/${{ github.repository }}");
+    const references =
+      workflowText.match(/ghcr\.io\/\$\{\{ steps\.ns\.outputs\.repo \}\}\//g) ?? [];
+    expect(references.length).toBeGreaterThanOrEqual(6);
+    expect(workflowText).toContain("repo=${GITHUB_REPOSITORY,,}");
+  });
+
   it("keeps pull requests read-only and every action pinned to a commit", () => {
     const validate = workflow.jobs.validate;
     const build = workflow.jobs.build;