panates / rman / 39457286215

95%

main: 95%

push

github

feat(publish): report the digest a docker push returned, in a JSON document printed after the run

`rman publish --json` without `--dry-run` used to print the plan before
publishing, which nothing read. It now prints one document once the run is
over, saying what happened: `published` rows (not the plan's `publish`),
`error` for a failure, and an `artifact: { ref, digest }` where a target
pushed something addressed by content. A run that stops before publishing
prints the plan, once.

The docker target passes buildx `--metadata-file` and reads
`containerimage.digest`, the pushed index's own. Asked for by
syncbridge-io/syncbridge, whose production deploy pins `<image>@sha256:...`
and needs the digest from the push in the same run rather than a tag read
back from Docker Hub later. Unreadable metadata leaves `artifact` out; the
publish still succeeded.

stdout stays one document: `exec` gains `stdio: 'stderr'`, used for
`npm publish` (`+ pkg@1.0.0`) and `docker login` (`Login Succeeded`), and
the `published` lines go to stderr under `--json`. `--dry-run --json` is
unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4612 of 5043 branches covered (91.45%)

Branch coverage included in aggregate %.

108 of 114 new or added lines in 5 files covered. (94.74%)

24509 of 25642 relevant lines covered (95.58%)

263.61 hits per line