ci: public arm64 docker image (#850)

Author: andrewgazelka

.github/workflows/publish.yml

@@ -1,10 +1,23 @@
-name: Publish
+name: Build and Validate
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
+
 jobs:
-  publish:
-    runs-on: ubuntu-latest
+  build:
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: arm-hooray
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       id-token: write
@@ -25,27 +38,76 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Set the Docker tags based on the event type
+      - name: Set Docker tags
+        id: docker-tags
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "HYPERION_PROXY_TAGS=ghcr.io/${{ github.repository }}/hyperion-proxy:pr-${{ github.event.pull_request.number }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
+            echo "TAG_TAGS=ghcr.io/${{ github.repository }}/tag:pr-${{ github.event.pull_request.number }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
+          else
+            echo "HYPERION_PROXY_TAGS=ghcr.io/${{ github.repository }}/hyperion-proxy:latest-${{ matrix.arch }},ghcr.io/${{ github.repository }}/hyperion-proxy:${{ github.sha }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
+            echo "TAG_TAGS=ghcr.io/${{ github.repository }}/tag:latest-${{ matrix.arch }},ghcr.io/${{ github.repository }}/tag:${{ github.sha }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
+          fi
+
       - name: Build and push hyperion-proxy
         uses: docker/build-push-action@v5
         with:
           context: .
           target: hyperion-proxy
-          platforms: linux/amd64
+          platforms: ${{ matrix.platform }}
           push: true
-          tags: |
-            ghcr.io/${{ github.repository }}/hyperion-proxy:latest
-            ghcr.io/${{ github.repository }}/hyperion-proxy:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.docker-tags.outputs.HYPERION_PROXY_TAGS }}
 
       - name: Build and push tag
         uses: docker/build-push-action@v5
         with:
           context: .
           target: tag
-          platforms: linux/amd64
+          platforms: ${{ matrix.platform }}
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          tags: ${{ steps.docker-tags.outputs.TAG_TAGS }}
+
+  manifest:
+    needs: build
+    # Only run manifest job on pushes to main
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push manifest for hyperion-proxy
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/${{ github.repository }}/hyperion-proxy:latest
+            ghcr.io/${{ github.repository }}/hyperion-proxy:${{ github.sha }}
+          outputs: type=image,name=ghcr.io/${{ github.repository }}/hyperion-proxy
+
+      - name: Create and push manifest for tag
+        uses: docker/build-push-action@v5
+        with:
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: |
             ghcr.io/${{ github.repository }}/tag:latest
             ghcr.io/${{ github.repository }}/tag:${{ github.sha }}
+          outputs: type=image,name=ghcr.io/${{ github.repository }}/tag
 
       - name: Update test server
         env: