Fix software docker builds when docker is podman

[kevindetry-milaboratories]

Podman, used as docker on some hosts, rejects --provenance (unknown flag) and --sbom=false (--sbom takes a scanner preset). Software image builds failed with status 125 in build:dev-local, build:dev-remote, and block builds.

This PR sets BUILDX_NO_DEFAULT_ATTESTATIONS=1 in the docker build environment instead of the flags from #1613. Docker buildx output does not change: the variable disables the default provenance (buildx v0.10.4+), and SBOM is off by default. Podman ignores the variable.

Tested:

• Docker 29.8.2 / buildx 0.37.2 (dind), containerd and classic stores: the same image as with the flags. Without either, the containerd store adds an attestation and the image ID changes on each rebuild.
• Podman 6.1.3: build:dev-local in this repo and in a block, tests/package-builder, a push to a local registry, and a full pnpm build:dev-remote against the dev ECR and S3 (ECR login, push of ptabler and ptexter: single OCI manifests). Tags are stable across rebuilds.
• New unit test docker-build.test.ts checks the build arguments and environment.

Note: buildx 0.10.0–0.10.3 ignores the variable. There, tags change on each rebuild again (re-push only). On podman, the remoteImageExists push skip never matches; this was already true before this PR and is not changed here.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking improvement to test cleanup.

Findings

1.  Test deletes inherited settings ▶

Fix with agent prompt

### Issue 1
lib/node/package-builder-lib/src/core/__tests__/docker-build.test.ts:43
If `BUILDX_NO_DEFAULT_ATTESTATIONS` was already set, this test deletes its original value. Forked tests limit the impact today, but future tests in this file could see different settings depending on test order. Save and restore the original value, or use `vi.stubEnv` with `vi.unstubAllEnvs`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Software image builds now set BUILDX_NO_DEFAULT_ATTESTATIONS=1 instead of passing flags that Podman rejects.

• New tests check the command, environment override, and unchanged build platform.
• The changeset releases the library and both downstream tools.
• One non-blocking cleanup improvement: restore the inherited environment value after the override test.

Important touched terms:

• docker.build: The function that builds software images. It replaces the attestation flags with a child-process environment setting.
• BUILDX_NO_DEFAULT_ATTESTATIONS: The buildx setting that turns off default attestations. Each build now forces it to "1".
• NodeJS.ProcessEnv: The type used for environment variables. The new test uses it to inspect the environment passed to the build.
• defaults.DOCKER_BUILD_PLATFORM: The target platform for software images. Its value is unchanged; the new test checks linux/amd64.

Acknowledged limitations:

• kevindetry-milaboratories states that buildx 0.10.0–0.10.3 ignores the variable, so identical rebuilds can require another push. This known limitation is not reported.
• kevindetry-milaboratories states that Podman's remoteImageExists push skip already fails to match. This unchanged behavior is not reported.

_{Reviews (1) · Last reviewed commit: "Disable buildx attestations via env, not..." · Reviewed by Greptile}

[changeset-bot]

🦋 Changeset detected

Latest commit: f69c796

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@platforma-sdk/package-builder-lib	Patch
@platforma-sdk/package-builder	Patch
@platforma-sdk/block-tools	Patch
@milaboratories/pl-middle-layer	Patch
@platforma-sdk/pl-cli	Patch
@platforma-sdk/test	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.34%. Comparing base (04d0558) to head (f69c796).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1891      +/-   ##
==========================================
+ Coverage   57.29%   57.34%   +0.05%     
==========================================
  Files         446      446              
  Lines       23281    23309      +28     
  Branches     5245     5254       +9     
==========================================
+ Hits        13338    13366      +28     
+ Misses       8404     8403       -1     
- Partials     1539     1540       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.