fix multiplatform builds

.github/workflows/build.yml

@@ -19,9 +19,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-24.04
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -37,15 +39,15 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - id: build-meta
-        name: Docker meta
+        name: Prepare Docker metadata
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository }}
           tags: type=sha,suffix=${{ env.BUILD_SUFFIX }}
 
       # Build cache is shared among all builds of the same architecture
       - id: cache-meta
-        name: Docker meta
+        name: Fetch build cache metadata
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository }}
@@ -60,6 +62,7 @@ jobs:
         name: Build/push the arch-specific image
         uses: docker/build-push-action@v6
         with:
+          platforms: ${{ matrix.platform }}
           cache-from: type=registry,ref=${{ steps.cache-meta.outputs.tags }}
           cache-to: type=registry,ref=${{ steps.cache-meta.outputs.tags }},mode=max
           labels: ${{ steps.build-meta.outputs.labels }}
@@ -74,13 +77,15 @@ jobs:
           echo "image-${RUNNER_ARCH,,}=${{ steps.get-registry.outputs.registry }}@${{ steps.build.outputs.digest }}" | tee -a "$GITHUB_OUTPUT"
 
   merge:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: build
     env:
       DOCKER_APP_IMAGE_ARM64: ${{ needs.build.outputs.image-arm64 }}
       DOCKER_APP_IMAGE_X64: ${{ needs.build.outputs.image-x64 }}
     outputs:
       image: ${{ steps.meta.outputs.tags }}
+      build-image-arm64: ${{ needs.build.outputs.image-arm64 }}
+      build-image-x64: ${{ needs.build.outputs.image-x64 }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -100,7 +105,8 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository }}
-          tags: type=sha,suffix=${{ env.BUILD_SUFFIX }}
+          tags: |
+            type=sha,suffix=-build-${{ github.run_id }}_${{ github.run_attempt }}
 
       - name: Push the multi-platform app image
         run: |
@@ -109,7 +115,7 @@ jobs:
             "$DOCKER_APP_IMAGE_ARM64" "$DOCKER_APP_IMAGE_X64"
 
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: merge
     env:
       COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
@@ -164,16 +170,20 @@ jobs:
           if-no-files-found: error
 
   push:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs:
       - merge
       - test
     env:
       DOCKER_APP_IMAGE: ${{ needs.merge.outputs.image }}
+      DOCKER_APP_IMAGE_ARM64: ${{ needs.merge.outputs.build-image-arm64 }}
+      DOCKER_APP_IMAGE_X64: ${{ needs.merge.outputs.build-image-x64 }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -192,6 +202,5 @@ jobs:
 
       - name: Retag and push the image
         run: |
-          docker pull "$DOCKER_APP_IMAGE"
-          echo "$DOCKER_METADATA_OUTPUT_TAGS" | tr ' ' '\n' | xargs -n1 docker tag "$DOCKER_APP_IMAGE"
-          docker push --all-tags "$(echo "$DOCKER_APP_IMAGE" | cut -f1 -d:)"
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("--tag " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") $DOCKER_APP_IMAGE_ARM64 $DOCKER_APP_IMAGE_X64

.github/workflows/release.yml

@@ -37,24 +37,25 @@ jobs:
         env:
           BASE_IMAGE: ${{ steps.get-base-image.outputs.tags }}
         run: |
-          docker pull "$BASE_IMAGE"
+          docker manifest inspect "$BASE_IMAGE"
 
       - name: Produce release tags
         id: tag-meta
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository }}
-          flavor: latest=auto
+          flavor: latest=false
           tags: |
             type=ref,event=tag
             type=match,pattern=\d+
             type=match,pattern=\d+\.\d+
             type=match,pattern=\d+\.\d+\.\d+
             type=match,pattern=.*
 
-      - name: Retag the pulled image
+      - name: Retag and push image
         env:
           BASE_IMAGE: ${{ steps.get-base-image.outputs.tags }}
         run: |
-          echo "$DOCKER_METADATA_OUTPUT_TAGS" | tr ' ' '\n' | xargs -n1 docker tag "$BASE_IMAGE"
-          docker push --all-tags "$(echo "$BASE_IMAGE" | cut -f1 -d:)"
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("--tag " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            "$(echo "$BASE_IMAGE" | cut -f1 -d:)"