6 changed files with 19 additions and 458 deletions
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@ -3,16 +3,13 @@ name: Build and Push Base Distro Images
 on:
  release:
    types: [published, prereleased]
-  push:
-    paths:
-      - '.gitea/workflows/publish.yaml'
+  workflow_dispatch:

 permissions:
  contents: read

 env:
  IMAGE_NAME: base-distro
-  APKO_VERSION: 1.1.2

 jobs:
  build-and-push:
@ -30,15 +27,11 @@ jobs:
            variant: dotnet-sdk
          - config: apko/flutter-sdk.yaml
            variant: flutter-sdk
-          - config: apko/flutter-sdk-android.yaml
-            variant: flutter-sdk-android
-          - config: apko/flutter-sdk-linux.yaml
-            variant: flutter-sdk-linux
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

-      - name: Determine tag type
+      - name: Determine tag
        id: tag
        run: |
          if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
@ -49,18 +42,9 @@ jobs:

      - name: Install apko
        run: |
+          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          APKO_VER="${{ env.APKO_VERSION }}"
-          curl -fsSL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VER}/apko_${APKO_VER}_linux_${APKO_ARCH}.tar.gz" \
-            -o /tmp/apko.tar.gz
-          tar xzf /tmp/apko.tar.gz --strip-components=1 -C /usr/local/bin
-          rm /tmp/apko.tar.gz
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko

      - name: Login to Docker Registry
        uses: docker/login-action@v3
@ -68,116 +52,10 @@ jobs:
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

-      - name: Determine upstream version
-        id: version
+      - name: Build and push image
        run: |
-          VARIANT="${{ matrix.variant }}"
-
-          case "$VARIANT" in
-            base|build)
-              UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
-              if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
-                UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
-              fi
-              ;;
-            dotnet-runtime)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            dotnet-sdk)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            flutter-sdk|flutter-sdk-android|flutter-sdk-linux)
-              UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
-                | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
-              ;;
-          esac
-
-          echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
-          echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
-
-          REPO_NAME="${{ env.IMAGE_NAME }}"
-          REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
-          NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
-
-          EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
-            | jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
-
-          MAX_BUILD=0
-          for tag in $EXISTING_TAGS; do
-            BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
-            if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
-              MAX_BUILD=$BUILD_NUM
-            fi
-          done
-
-          NEXT_BUILD=$((MAX_BUILD + 1))
-          VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
-          echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
-          echo "Next version tag: ${VERSION_TAG}"
-
-      - name: Build per-arch apko tarballs
-        run: |
-          mkdir -p /tmp/build-amd64 /tmp/build-arm64
-          apko build --arch x86_64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.tag.outputs.suffix }} \
-            /tmp/build-amd64/image.tar
-          apko build --arch aarch64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.tag.outputs.suffix }} \
-            /tmp/build-arm64/image.tar
-
-          # Extract the rootfs layer from the OCI archive for each arch.
-          # apko outputs an OCI image tarball; we need to extract just the
-          # filesystem layer (.tar.gz) and the config metadata.
-          for arch in amd64 arm64; do
-            cd /tmp/build-${arch}
-            tar xf image.tar
-            # The .tar.gz file is the filesystem layer
-            ROOTFS=$(ls *.tar.gz 2>/dev/null | head -1)
-            mv "$ROOTFS" rootfs.tar.gz
-            # Extract ENV and ENTRYPOINT from the OCI config
-            MANIFEST_DIGEST=$(jq -r '.manifests[0].digest' index.json | sed 's/sha256://')
-            CONFIG_DIGEST=$(jq -r '.config.digest' "sha256:${MANIFEST_DIGEST}" | sed 's/sha256://')
-            cp "sha256:${CONFIG_DIGEST}" config.json
-            # Clean up OCI artifacts
-            rm -f image.tar index.json manifest.json oci-layout sha256:*
-            cd /tmp
-          done
-
-          # Generate Dockerfile with metadata from the OCI config
-          # (use amd64 config as reference — env vars are the same for both arches)
-          ENV_LINES=$(jq -r '(.config.Env // [])[] | "ENV " + .' /tmp/build-amd64/config.json)
-          ENTRYPOINT=$(jq -r '(.config.Entrypoint // [])[]' /tmp/build-amd64/config.json | head -1)
-          USER_ID=$(jq -r '.config.User // "65532"' /tmp/build-amd64/config.json)
-          WORKDIR=$(jq -r '.config.WorkingDir // "/"' /tmp/build-amd64/config.json)
-
-          {
-            echo "FROM scratch"
-            echo "ARG TARGETARCH"
-            echo "ADD build-\${TARGETARCH}/rootfs.tar.gz /"
-            if [ -n "$ENV_LINES" ]; then
-              echo "$ENV_LINES"
-            fi
-            if [ -n "$ENTRYPOINT" ] && [ "$ENTRYPOINT" != "null" ]; then
-              echo "ENTRYPOINT [\"${ENTRYPOINT}\"]"
-            fi
-            echo "WORKDIR ${WORKDIR}"
-            echo "USER ${USER_ID}"
-          } > /tmp/Dockerfile
-
-      - name: Build and push with buildx (SBOM + provenance)
-        uses: docker/build-push-action@v5
-        with:
-          context: /tmp
-          file: /tmp/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          sbom: true
-          provenance: mode=max
-          tags: |
+          apko publish ${{ matrix.config }} \
            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.tag.outputs.suffix }}
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}

      - name: Install Docker Scout
        run: |
--- a/.gitea/workflows/rebuild.yaml
+++ b/.gitea/workflows/rebuild.yaml
@ -4,16 +4,13 @@ on:
  schedule:
    # Rebuild weekly to pick up Wolfi security patches
    - cron: '0 6 * * 1'
-  push:
-    paths:
-      - '.gitea/workflows/rebuild.yaml'
+  workflow_dispatch:

 permissions:
  contents: read

 env:
  IMAGE_NAME: base-distro
-  APKO_VERSION: 1.1.2

 jobs:
  rebuild:
@ -37,18 +34,9 @@ jobs:

      - name: Install apko
        run: |
+          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          APKO_VER="${{ env.APKO_VERSION }}"
-          curl -fsSL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VER}/apko_${APKO_VER}_linux_${APKO_ARCH}.tar.gz" \
-            -o /tmp/apko.tar.gz
-          tar xzf /tmp/apko.tar.gz --strip-components=1 -C /usr/local/bin
-          rm /tmp/apko.tar.gz
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko

      - name: Login to Docker Registry
        uses: docker/login-action@v3
@ -56,116 +44,10 @@ jobs:
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

-      - name: Determine upstream version
-        id: version
+      - name: Rebuild and push with latest Wolfi packages
        run: |
-          VARIANT="${{ matrix.variant }}"
-
-          case "$VARIANT" in
-            base|build)
-              UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
-              if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
-                UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
-              fi
-              ;;
-            dotnet-runtime)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            dotnet-sdk)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            flutter-sdk)
-              UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
-                | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
-              ;;
-          esac
-
-          echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
-          echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
-
-          REPO_NAME="${{ env.IMAGE_NAME }}"
-          REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
-          NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
-
-          EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
-            | jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
-
-          MAX_BUILD=0
-          for tag in $EXISTING_TAGS; do
-            BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
-            if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
-              MAX_BUILD=$BUILD_NUM
-            fi
-          done
-
-          NEXT_BUILD=$((MAX_BUILD + 1))
-          VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
-          echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
-          echo "Next version tag: ${VERSION_TAG}"
-
-      - name: Build per-arch apko tarballs
-        run: |
-          mkdir -p /tmp/build-amd64 /tmp/build-arm64
-          apko build --arch x86_64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest \
-            /tmp/build-amd64/image.tar
-          apko build --arch aarch64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest \
-            /tmp/build-arm64/image.tar
-
-          # Extract the rootfs layer from the OCI archive for each arch.
-          # apko outputs an OCI image tarball; we need to extract just the
-          # filesystem layer (.tar.gz) and the config metadata.
-          for arch in amd64 arm64; do
-            cd /tmp/build-${arch}
-            tar xf image.tar
-            # The .tar.gz file is the filesystem layer
-            ROOTFS=$(ls *.tar.gz 2>/dev/null | head -1)
-            mv "$ROOTFS" rootfs.tar.gz
-            # Extract ENV and ENTRYPOINT from the OCI config
-            MANIFEST_DIGEST=$(jq -r '.manifests[0].digest' index.json | sed 's/sha256://')
-            CONFIG_DIGEST=$(jq -r '.config.digest' "sha256:${MANIFEST_DIGEST}" | sed 's/sha256://')
-            cp "sha256:${CONFIG_DIGEST}" config.json
-            # Clean up OCI artifacts
-            rm -f image.tar index.json manifest.json oci-layout sha256:*
-            cd /tmp
-          done
-
-          # Generate Dockerfile with metadata from the OCI config
-          # (use amd64 config as reference — env vars are the same for both arches)
-          ENV_LINES=$(jq -r '(.config.Env // [])[] | "ENV " + .' /tmp/build-amd64/config.json)
-          ENTRYPOINT=$(jq -r '(.config.Entrypoint // [])[]' /tmp/build-amd64/config.json | head -1)
-          USER_ID=$(jq -r '.config.User // "65532"' /tmp/build-amd64/config.json)
-          WORKDIR=$(jq -r '.config.WorkingDir // "/"' /tmp/build-amd64/config.json)
-
-          {
-            echo "FROM scratch"
-            echo "ARG TARGETARCH"
-            echo "ADD build-\${TARGETARCH}/rootfs.tar.gz /"
-            if [ -n "$ENV_LINES" ]; then
-              echo "$ENV_LINES"
-            fi
-            if [ -n "$ENTRYPOINT" ] && [ "$ENTRYPOINT" != "null" ]; then
-              echo "ENTRYPOINT [\"${ENTRYPOINT}\"]"
-            fi
-            echo "WORKDIR ${WORKDIR}"
-            echo "USER ${USER_ID}"
-          } > /tmp/Dockerfile
-
-      - name: Build and push with buildx (SBOM + provenance)
-        uses: docker/build-push-action@v5
-        with:
-          context: /tmp
-          file: /tmp/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          sbom: true
-          provenance: mode=max
-          tags: |
+          apko publish ${{ matrix.config }} \
            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}

      - name: Install Docker Scout
        run: |
--- a/.gitea/workflows/scout.yaml
+++ b/.gitea/workflows/scout.yaml
@ -10,7 +10,6 @@ permissions:

 env:
  IMAGE_NAME: base-distro
-  APKO_VERSION: 1.1.2

 jobs:
  scout:
@ -53,12 +52,9 @@ jobs:
      - name: Install apko
        if: steps.should_run.outputs.run == 'true'
        run: |
+          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          APKO_VER="${{ env.APKO_VERSION }}"
-          curl -fsSL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VER}/apko_${APKO_VER}_linux_${APKO_ARCH}.tar.gz" \
-            -o /tmp/apko.tar.gz
-          tar xzf /tmp/apko.tar.gz --strip-components=1 -C /usr/local/bin
-          rm /tmp/apko.tar.gz
+          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko

      - name: Build image locally
        if: steps.should_run.outputs.run == 'true'
--- a/.gitea/workflows/update-check.yaml
+++ b/.gitea/workflows/update-check.yaml
@ -13,7 +13,6 @@ permissions:

 env:
  IMAGE_NAME: base-distro
-  APKO_VERSION: 1.1.2

 jobs:
  check-wolfi:
@ -27,12 +26,9 @@ jobs:

      - name: Install apko
        run: |
+          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          APKO_VER="${{ env.APKO_VERSION }}"
-          curl -fsSL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VER}/apko_${APKO_VER}_linux_${APKO_ARCH}.tar.gz" \
-            -o /tmp/apko.tar.gz
-          tar xzf /tmp/apko.tar.gz --strip-components=1 -C /usr/local/bin
-          rm /tmp/apko.tar.gz
+          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko

      - name: Check for Wolfi package updates
        id: check
@ -126,18 +122,9 @@ jobs:

      - name: Install apko
        run: |
+          APKO_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          APKO_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-          APKO_VER="${{ env.APKO_VERSION }}"
-          curl -fsSL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VER}/apko_${APKO_VER}_linux_${APKO_ARCH}.tar.gz" \
-            -o /tmp/apko.tar.gz
-          tar xzf /tmp/apko.tar.gz --strip-components=1 -C /usr/local/bin
-          rm /tmp/apko.tar.gz
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+          curl -fsSL "https://github.com/chainguard-dev/apko/releases/latest/download/apko_${APKO_OS}_${APKO_ARCH}.tar.gz" | tar xz -C /usr/local/bin apko

      - name: Login to Docker Registry
        uses: docker/login-action@v3
@ -145,84 +132,10 @@ jobs:
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

-      - name: Determine upstream version
-        id: version
+      - name: Build and push image
        run: |
-          VARIANT="${{ matrix.variant }}"
-
-          case "$VARIANT" in
-            base|build)
-              UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
-              if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
-                UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
-              fi
-              ;;
-            dotnet-runtime)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            dotnet-sdk)
-              UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
-                | jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
-              ;;
-            flutter-sdk)
-              UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
-                | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
-              ;;
-          esac
-
-          echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
-          echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
-
-          REPO_NAME="${{ env.IMAGE_NAME }}"
-          REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
-          NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
-
-          EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
-            | jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
-
-          MAX_BUILD=0
-          for tag in $EXISTING_TAGS; do
-            BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
-            if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
-              MAX_BUILD=$BUILD_NUM
-            fi
-          done
-
-          NEXT_BUILD=$((MAX_BUILD + 1))
-          VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
-          echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
-          echo "Next version tag: ${VERSION_TAG}"
-
-      - name: Build per-arch apko tarballs
-        run: |
-          mkdir -p /tmp/build-amd64 /tmp/build-arm64
-          apko build --arch x86_64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest \
-            /tmp/build-amd64/image.tar
-          apko build --arch aarch64 ${{ matrix.config }} \
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest \
-            /tmp/build-arm64/image.tar
-          cat > /tmp/Dockerfile <<'EOF'
-          FROM scratch
-          ARG TARGETARCH
-          ADD build-${TARGETARCH}/image.tar /
-          USER 65532
-          EOF
-          sed -i 's/^          //' /tmp/Dockerfile
-
-      - name: Build and push with buildx (SBOM + provenance)
-        uses: docker/build-push-action@v5
-        with:
-          context: /tmp
-          file: /tmp/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          sbom: true
-          provenance: mode=max
-          tags: |
+          apko publish ${{ matrix.config }} \
            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
-            ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}

      - name: Install Docker Scout
        run: |
--- a/apko/flutter-sdk-android.yaml
+++ b/apko/flutter-sdk-android.yaml
@ -1,49 +0,0 @@
-contents:
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  repositories:
-    - https://packages.wolfi.dev/os
-  packages:
-    # Base runtime
-    - wolfi-baselayout
-    - glibc
-    - glibc-locale-posix
-    - libstdc++
-    - ca-certificates-bundle
-    - tzdata
-    # Build tools
-    - bash
-    - busybox
-    - coreutils
-    - git
-    - curl
-    - wget
-    - unzip
-    - xz
-    - zip
-    # Java (for Android SDK)
-    - openjdk-17
-    - openjdk-17-default-jvm
-
-accounts:
-  groups:
-    - groupname: flutter
-      gid: 65532
-  users:
-    - username: flutter
-      uid: 65532
-      gid: 65532
-  run-as: 65532
-
-archs:
-  - x86_64
-  - aarch64
-
-environment:
-  TZ: UTC
-  FLUTTER_HOME: /opt/flutter
-  JAVA_HOME: /usr/lib/jvm/java-17-openjdk
-  PATH: /opt/flutter/bin:/opt/flutter/bin/cache/dart-sdk/bin:/usr/lib/jvm/java-17-openjdk/bin:/usr/bin:/bin:/usr/sbin:/sbin
-
-entrypoint:
-  command: /bin/bash
--- a/apko/flutter-sdk-linux.yaml
+++ b/apko/flutter-sdk-linux.yaml
@ -1,59 +0,0 @@
-contents:
-  keyring:
-    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-  repositories:
-    - https://packages.wolfi.dev/os
-  packages:
-    # Base runtime
-    - wolfi-baselayout
-    - glibc
-    - glibc-locale-posix
-    - libstdc++
-    - ca-certificates-bundle
-    - tzdata
-    # Build tools
-    - bash
-    - busybox
-    - coreutils
-    - git
-    - curl
-    - wget
-    - unzip
-    - xz
-    # Linux desktop build toolchain
-    - clang-19
-    - cmake
-    - ninja-build
-    - pkgconf
-    # GTK and dependencies for Flutter Linux
-    - gtk-3-dev
-    - glib-dev
-    - pango-dev
-    - harfbuzz-dev
-    - cairo-dev
-    - gdk-pixbuf-dev
-    - xz-dev
-
-accounts:
-  groups:
-    - groupname: flutter
-      gid: 65532
-  users:
-    - username: flutter
-      uid: 65532
-      gid: 65532
-  run-as: 65532
-
-archs:
-  - x86_64
-  - aarch64
-
-environment:
-  TZ: UTC
-  FLUTTER_HOME: /opt/flutter
-  CC: clang
-  CXX: clang++
-  PATH: /opt/flutter/bin:/opt/flutter/bin/cache/dart-sdk/bin:/usr/bin:/bin:/usr/sbin:/sbin
-
-entrypoint:
-  command: /bin/bash