Added support for changed (bug?) format with oras 1.3.0

[malice00]

The update to the GH action 'oras-project/setup-oras' brought with it v1.3.0 of oras. This version gives a different output for oras discover compared to the previous version(s).

The question is, if this output it correct, because the official documentation still shows the old output!

Old:

oras discover --format json --platform linux/amd64 ghcr.io/cyclonedx/opensuse-lang@sha256:84b639892598fb3c92e4511e9d0ecf348b9ece28bef3f40ca25fc0d002867be6 
{
  "manifests": [
    {
      "reference": "ghcr.io/cyclonedx/opensuse-lang@sha256:21868b1158e16efc9fbafce612f4fa610917b47767bb0f814ba717f06ce96c88",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:21868b1158e16efc9fbafce612f4fa610917b47767bb0f814ba717f06ce96c88",
      "size": 777,
      "annotations": {
        "org.opencontainers.image.created": "2025-09-10T18:40:31Z"
      },
      "artifactType": "sbom/cyclonedx"
    }
  ]
}

New:

oras discover --format json --platform linux/amd64 ghcr.io/cyclonedx/opensuse-lang@sha256:84b639892598fb3c92e4511e9d0ecf348b9ece28bef3f40ca25fc0d002867be6  
{
  "reference": "ghcr.io/cyclonedx/opensuse-lang@sha256:84b639892598fb3c92e4511e9d0ecf348b9ece28bef3f40ca25fc0d002867be6",
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "digest": "sha256:84b639892598fb3c92e4511e9d0ecf348b9ece28bef3f40ca25fc0d002867be6",
  "size": 678,
  "referrers": [
    {
      "reference": "ghcr.io/cyclonedx/opensuse-lang@sha256:21868b1158e16efc9fbafce612f4fa610917b47767bb0f814ba717f06ce96c88",
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:21868b1158e16efc9fbafce612f4fa610917b47767bb0f814ba717f06ce96c88",
      "size": 777,
      "annotations": {
        "org.opencontainers.image.created": "2025-09-10T18:40:31Z"
      },
      "artifactType": "sbom/cyclonedx",
      "referrers": []
    }
  ]
}

[prabhu]

Great find!

[prabhu]

Feels like a bug to me. Shall we report to the oras-go project?

[malice00]

Didn't get around to it yet, was in the zone with coding/configuring. But will do it in a bit. And if it is correct, they should update the documentation -- there's an issue here, one way or another!

[malice00]

Issue filed