Fix PR builds: use local registry for base image in dependent sandbox builds

On PRs the base image is not pushed to GHCR, so dependent sandbox builds
cannot resolve the FROM reference. This spins up a local registry on PRs,
builds the base image into it, and points BASE_IMAGE there. On main the
existing GHCR flow is unchanged. PR builds also use single-platform
(linux/amd64) for speed since they only validate the build.

Author: drew

.github/workflows/build-sandboxes.yml

@@ -157,8 +157,17 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
+      # On PRs, use a local registry so the base image built in this job is
+      # accessible to the subsequent buildx build (docker-container driver
+      # cannot see images loaded into the host daemon).
+      - name: Start local registry (PR only)
+        if: github.ref != 'refs/heads/main'
+        run: docker run -d -p 5000:5000 --name registry registry:2
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: ${{ github.ref != 'refs/heads/main' && 'network=host' || '' }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -167,6 +176,26 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # On PRs the base image is not in GHCR. Build it locally, push to the
+      # local registry, and override BASE_IMAGE to point there.
+      - name: Build base image locally (PR only)
+        if: github.ref != 'refs/heads/main'
+        uses: docker/build-push-action@v6
+        with:
+          context: sandboxes/base
+          push: true
+          tags: localhost:5000/sandboxes/base:latest
+          cache-from: type=gha,scope=base
+
+      - name: Set BASE_IMAGE
+        id: base
+        run: |
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "image=${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/base:latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "image=localhost:5000/sandboxes/base:latest" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Generate image metadata
         id: meta
         uses: docker/metadata-action@v5
@@ -180,11 +209,11 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: sandboxes/${{ matrix.sandbox }}
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ github.ref == 'refs/heads/main' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
           push: ${{ github.ref == 'refs/heads/main' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            BASE_IMAGE=${{ env.REGISTRY }}/${{ steps.repo.outputs.image_prefix }}/sandboxes/base:latest
+            BASE_IMAGE=${{ steps.base.outputs.image }}
           cache-from: type=gha,scope=${{ matrix.sandbox }}
           cache-to: type=gha,mode=max,scope=${{ matrix.sandbox }}