External images can have only one architecture

[divolgin]

If an architecture is not found for an external image, simply ignore it and don't record it as an error.

[greptile-apps]

Greptile Summary

The PR allows external images to complete SBOM collection when only one requested architecture is available. It adds Syft stderr classification for unsupported platforms and aggregates per-architecture outcomes before setting digest-level status.

• Recognizes several unsupported-platform error messages as skippable.
• Marks a digest successful when at least one architecture produces a usable SBOM.
• Adds unit coverage for unsupported-platform and authentication-error classification.

Confidence Score: 4/5

The mixed-error classification should be fixed before merging because it can silently replace or discard genuine registry authentication failures.

Syft can report errors from multiple source providers together, but the new classifier skips the entire result whenever any unsupported-platform phrase appears, even when the same stderr contains a real 401 authentication failure.

Files Needing Attention: pkg/listener/update-external-image-sbom-status.go, pkg/listener/update-external-image-sbom-status_test.go

Important Files Changed

Filename	Overview
pkg/listener/update-external-image-sbom-status.go	Adds per-digest result aggregation and unsupported-platform classification, but the substring classifier can hide genuine errors included in Syft's combined stderr.
pkg/listener/update-external-image-sbom-status_test.go	Adds focused classifier tests, including a mixed platform-mismatch and authentication-error fixture whose expected result demonstrates the misclassification.

_{Reviews (1): Last reviewed commit: "External images can have only one archit..." | Re-trigger Greptile}

[greptile-apps]

Mixed Syft errors are skipped

When Syft reports a platform mismatch for one source and a genuine registry error such as 401 Unauthorized for another source in the same stderr output, this substring match classifies the entire result as an unsupported architecture. This replaces the authentication failure with a misleading no-supported-architecture failure, or discards it entirely when another architecture succeeds.

Knowledge Base Used: Build Queue and Vulnerability Scanning