feat(docker-build-cloud): add checksum output

.github/workflows/docker-build-cloud.yml

@@ -38,10 +38,16 @@ on:
       dockerhub-password:
         description: "DockerHub PAT with Build scope (required to authenticate to Docker Build Cloud endpoint)"
         required: true
+    outputs:
+      checksum:
+        description: "Checksum (0x<sha256-hex>) of the pushed multi-arch image index"
+        value: ${{ jobs.build.outputs.checksum }}
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    outputs:
+      checksum: ${{ steps.checksum.outputs.checksum }}
 
     steps:
       - name: Checkout Repository
@@ -62,6 +68,7 @@ jobs:
           endpoint: ${{ inputs.cloud-builder-endpoint }}
 
       - name: Build and push multi-platform image
+        id: build
         uses: docker/build-push-action@v7
         with:
           build-args: ${{ inputs.build-args }}
@@ -70,3 +77,13 @@ jobs:
           platforms: ${{ inputs.platforms }}
           push: true
           tags: ${{ inputs.image-name }}:${{ inputs.image-tag }}
+
+      - name: Compute checksum of the Docker image
+        id: checksum
+        # avoid shell injection through string interpolation
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          # build-push-action returns the pushed multi-arch INDEX digest as "sha256:<hex>".
+          # Expose it as "0x<hex>" to match the docker-build.yml output format.
+          echo "checksum=0x${DIGEST#sha256:}" | tee -a "$GITHUB_OUTPUT"

docker-build-cloud/README.md

@@ -10,6 +10,7 @@ This reusable GitHub Actions workflow builds and pushes a multi-platform Docker
 - 🔐 Authenticates to DockerHub for both registry push and DBC endpoint access
 - 🏷️ Tags the image with `<image-name>:<image-tag>`
 - 🚀 No QEMU emulation, no native ARM runners — DBC handles arch-specific builds
+- 🧾 Exposes the pushed multi-arch image index digest as a `checksum` output
 
 > [!IMPORTANT]
 > Requires a Docker Build Cloud subscription and a builder configured in your DockerHub organization. The DockerHub PAT must have the **Build** scope to authenticate to the cloud endpoint.
@@ -33,6 +34,12 @@ This reusable GitHub Actions workflow builds and pushes a multi-platform Docker
 | `dockerhub-username` | Username for Docker Hub authentication                                                     | Yes      |
 | `dockerhub-password` | Personal Access Token for Docker Hub with the **Build** scope (needed for DBC endpoint)    | Yes      |
 
+## 📤 Outputs
+
+| Name       | Description                                                       |
+| ---------- | ----------------------------------------------------------------- |
+| `checksum` | Checksum (`0x<sha256-hex>`) of the pushed multi-arch image index  |
+
 ## 💻 Example Usage
 
 ```yaml