Fix: duplicate build-args key in Build-Publish workflow

[mrsabath]

Summary

The Build and push step in build.yaml declared build-args: twice, which is invalid YAML (duplicate mapping key). GitHub rejects the whole workflow with "This run likely failed because of a workflow file issue", so no cortex images are being published under rossoctl/cortex.

This merges the two build-arg sources into a single multiline build-args::

• static per-image matrix.image_config.build_args (used by authbridge-lite for GO_BUILD_TAGS)
• dynamically resolved steps.buildargs.outputs.args (used by authbridge-cpex for CPEX_FFI_VERSION / CPEX_FFI_ABI)

Only one image sets each source, so concatenating them is safe.

Why it matters

Downstream, rossoctl/operator E2E fails in BeforeSuite pulling ghcr.io/rossoctl/cortex/authbridge-*:latest with denied — because those images never publish while this workflow is invalid. Fixing this unblocks image publishing.

(Note: after images publish, their GHCR package visibility should be confirmed public so anonymous CI pulls succeed — separate from this change.)

Part of the Kagenti to rossoctl rename CI cleanup.

Summary by CodeRabbit

• Bug Fixes
  • Fixed the container build workflow to correctly combine build arguments.
  • Prevented potential workflow failures caused by duplicate build-argument configuration.
  • Image publishing settings, platforms, tags, and labels remain unchanged.

[coderabbitai]

📝 Walkthrough

Walkthrough

The build workflow now merges matrix-provided and dynamically resolved CPEX build arguments into a single build-args block, removing the duplicate YAML key while preserving image push, platform, tag, and label settings.

Changes

Build workflow

Layer / File(s)	Summary
Merge image build arguments .github/workflows/build.yaml	The Build and push step combines matrix build arguments with resolved authbridge-cpex arguments in one build-args block and retains existing publishing configuration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: huang195

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main fix: removing the duplicate build-args key in the Build-Publish workflow.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build-args-duplicate-key

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[esnible]

Correctly fixes an invalid-YAML duplicate build-args: mapping key in the Build and push step that was rejecting the entire build.yaml workflow (so no cortex images published). The two build-arg sources are merged into one multiline block.

Verified against main that only authbridge-lite sets matrix.image_config.build_args (GO_BUILD_TAGS) and only authbridge-cpex produces steps.buildargs.outputs.args (CPEX_FFI_*, guarded by an image-name check), so concatenating the two sources is safe — no image sets both, and undeclared/blank build-args are ignored by docker/build-push-action.

Well-commented, minimal, all CI green (DCO, YAML Lint, Action Pinning, CodeQL). LGTM.

Assisted-By: Claude Code