merge after all builds

Author: opajonk

.github/workflows/ci.yaml

@@ -110,3 +110,41 @@ jobs:
               echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
               ./scripts/publish-arm.sh "main"
             fi
+  merge:
+    name: 'Merge Labels'
+    needs: ["build-x86_64", "build-arm64"]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout (GitHub)
+        uses: actions/checkout@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Use .devcontainer from THIS repo for building and testing
+      - name: Merge
+        uses: devcontainers/[email protected]
+        with:
+          # The .devcontainer is never published as pre-built container.
+          # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
+          push: "never"
+          runCmd: |
+            set -eux pipefail
+
+            # Optionally: Merge
+            # We do not use the push feature of devcontainers/ci here, since that would push the wrong container.
+            # Instead, we use the publish script which pushes the correct container (residing in src/s-core-devcontainer).
+            if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+              # manually login to ghcr.io for publishing
+              echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+              ./scripts/merge.sh "main"
+            fi

scripts/merge.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+if [ "$#" -eq 0 ]; then
+    echo "Error: At least one parameter (label) must be provided."
+    exit 1
+fi
+
+LABELS=()
+for LABEL in "$@"; do
+    LABELS+=("${LABEL}")
+done
+
+# Define target architectures
+ARCHITECTURES=("amd64", "arm64")
+
+# Create and push the merged multiarch manifest for each tag; each tag combines all architecture-specific tags into one tag
+for LABEL in "${LABELS[@]}"; do
+    echo "Merging all architectures (${ARCHITECTURES[@]}) into single tag: ${LABEL}"
+
+    MANIFEST_MERGE_CALL="docker buildx imagetools create -t ghcr.io/eclipse-score/devcontainer:${LABEL}"
+
+    for ARCH in "${ARCHITECTURES[@]}"; do
+        MANIFEST_MERGE_CALL+=" ghcr.io/eclipse-score/devcontainer:${LABEL}-${ARCH}"
+    done
+
+    eval "$MANIFEST_MERGE_CALL"
+done