From 8c95af88f62c35133d96344a0f856346daec51f7 Mon Sep 17 00:00:00 2001
From: Noa Resare <noa@resare.com>
Date: Thu, 16 Jul 2026 09:55:57 +0100
Subject: [PATCH] Build multi-arch image on native runners

Replace the single QEMU-emulated build with a matrix that builds each
architecture on its own native runner (ubuntu-24.04 for amd64,
ubuntu-24.04-arm for arm64), pushes each by digest with zstd
compression, then assembles the manifest list in a merge job. This
drops slow arm64 emulation.

The bktools content hash is now computed in a dedicated version job and
consumed by the merge job when it tags the manifest list. Trigger,
registry, tag scheme and IAM role are unchanged.
---
 .github/workflows/publish-image.yaml | 73 ++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml
index 2e91bd4..e7ebbc4 100644
--- a/.github/workflows/publish-image.yaml
+++ b/.github/workflows/publish-image.yaml
@@ -14,10 +14,16 @@ concurrency:
   group: publish-image-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  IMAGE: public.ecr.aws/q3z6g1h3/idcat
+
 jobs:
-  publish:
+  version:
     runs-on: ubuntu-latest
 
+    outputs:
+      tag: ${{ steps.image-version.outputs.tag }}
+
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
@@ -34,7 +40,28 @@ jobs:
         id: image-version
         run: |
           image_version="$(uv run bktools-image-version-hash)"
-          echo "tag=public.ecr.aws/q3z6g1h3/idcat:${image_version}" >> "$GITHUB_OUTPUT"
+          echo "tag=${image_version}" >> "$GITHUB_OUTPUT"
+
+  build:
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-24.04
+            output_name: digest_amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            output_name: digest_arm64
+
+    runs-on: ${{ matrix.runner }}
+
+    outputs:
+      digest_amd64: ${{ steps.export.outputs.digest_amd64 }}
+      digest_arm64: ${{ steps.export.outputs.digest_arm64 }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
@@ -47,16 +74,44 @@ jobs:
         with:
           registry-type: public
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build and push Docker image
+      - name: Build and push image by digest
+        id: build
         uses: docker/build-push-action@v7
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.image-version.outputs.tag }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true,compression=zstd,force-compression=true
+
+      - name: Export digest
+        id: export
+        run: |
+          echo "${{ matrix.output_name }}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
+
+  merge:
+    needs: [version, build]
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::436027055282:role/product-roles/idcat-ecr-publish
+          aws-region: us-east-1
+
+      - name: Log in to Amazon ECR Public
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registry-type: public
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Create and push manifest list
+        run: |
+          docker buildx imagetools create \
+            -t "${IMAGE}:${{ needs.version.outputs.tag }}" \
+            "${IMAGE}@${{ needs.build.outputs.digest_amd64 }}" \
+            "${IMAGE}@${{ needs.build.outputs.digest_arm64 }}"