CI: matrix build instead of QEMU

Author: nevyn

.github/workflows/docker-image.yml

@@ -3,20 +3,33 @@ name: Publish Docker image
 on:
   release:
     types: [published]
-  push: 
-    branches:
-      - "*"
+  push:
+    branches: ["*"]
   pull_request: {}
 
+permissions:
+  packages: write
+  contents: write
+  attestations: write
+  id-token: write
+
 jobs:
-  push_to_registry:
-    name: Build (and push if publishing release)
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: write
-      attestations: write
-      id-token: write
+  build:
+    name: Build ${{ matrix.platform }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+            tag_suffix: -amd64
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            tag_suffix: -arm64
+
+    runs-on: ${{ matrix.runner }}
 
     steps:
       - name: Check out the repo
@@ -25,70 +38,86 @@ jobs:
           lfs: 'true'
           submodules: 'recursive'
 
-      # Only log in when we actually intend to push (release event).
       - name: Log in to Docker Hub
         if: github.event_name == 'release'
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      # Multi-arch setup only needed for release builds.
-      - name: Set up QEMU (release only)
-        if: github.event_name == 'release'
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx (release only)
-        if: github.event_name == 'release'
-        uses: docker/setup-buildx-action@v3
-
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@v5
         with:
           images: alloverse/alloplace3
 
-      # Validation build for pushes/PRs: single-arch, no push.
-      - name: Build Docker image (validation, no push)
+      # Validation builds (push/PR): single-arch, no push
+      - name: Build image (validation only, no push)
         if: github.event_name != 'release'
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
+          platforms: ${{ matrix.platform }}
           push: false
-          platforms: linux/amd64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      # Release build: multi-platform and pushed.
-      - name: Build & push Docker image (multi-platform, release)
+      # Release builds: push single-arch image with suffix
+      - name: Build & push image (release)
         if: github.event_name == 'release'
-        id: push
-        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        id: push_single
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platform }}
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          provenance: false
+          sbom: false
+          tags: alloverse/alloplace3:${{ github.event.release.tag_name }}${{ matrix.tag_suffix }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      # Attestation only makes sense when an image was pushed.
+  publish_manifest:
+    name: Create multi-arch tag(s), attest, & update notes
+    needs: build
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Create multi-arch manifest (tag + latest)
+        run: |
+          IMAGE=alloverse/alloplace3:${{ github.event.release.tag_name }}
+          docker buildx imagetools create \
+            -t "${IMAGE}" \
+            -t alloverse/alloplace3:latest \
+            "${IMAGE}-amd64" \
+            "${IMAGE}-arm64"
+
+      - name: Inspect manifest (get digest)
+        id: insp
+        run: |
+          IMAGE=alloverse/alloplace3:${{ github.event.release.tag_name }}
+          docker buildx imagetools inspect --raw "$IMAGE" | sha256sum | awk '{print "sha256:"$1}' > digest.txt
+          echo "digest=$(cat digest.txt)" >> $GITHUB_OUTPUT
+
       - name: Generate artifact attestation
-        if: github.event_name == 'release'
         uses: actions/attest-build-provenance@v2
         with:
           subject-name: index.docker.io/alloverse/alloplace3
-          subject-digest: ${{ steps.push.outputs.digest }}
+          subject-digest: ${{ steps.insp.outputs.digest }}
           push-to-registry: true
 
-      # Append Docker image info to the release notes
       - name: Update release notes with Docker instructions
-        if: github.event_name == 'release'
         uses: actions/github-script@v7
         env:
           IMAGE_BASE: alloverse/alloplace3
-          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
+          IMAGE_DIGEST: ${{ steps.insp.outputs.digest }}
         with:
           script: |
             const rel = context.payload.release;
@@ -102,11 +131,12 @@ jobs:
               '',
               '```bash',
               `docker pull ${image}`,
+              `docker pull ${process.env.IMAGE_BASE}:latest`,
               `docker run --rm -it -p 9080:9080 ${image}`,
               '```',
               '',
-              'Multi-arch: `linux/amd64, linux/arm64`.',
-              process.env.IMAGE_DIGEST ? `Digest: \`${process.env.IMAGE_DIGEST}\`.` : '',
+              'Architectures: `linux/amd64, linux/arm64`.',
+              process.env.IMAGE_DIGEST ? `Manifest digest: \`${process.env.IMAGE_DIGEST}\`.` : '',
               ''
             ].join('\n');
             const body = (rel.body || '') + '\n\n' + snippet;