Build amd64 and arm64 natively on their own GitHub runners in
parallel, then stitch the per-arch digests into a tagged multi-arch
manifest. Replaces the previous single-runner pattern which rebuilt
arm64 from scratch on every run because QEMU emulation + unscoped GHA
cache meant no layer reuse across invocations.
Jobs:
build-amd64 — ubuntu-latest, native, runs smoke tests, pushes by
digest
build-arm64 — ubuntu-24.04-arm, native (no QEMU), pushes by digest
merge — stitches both digests into :sha-<sha> (main) or
:<release>
move-latest — unchanged ancestor-check logic, now needs: merge
Preserved:
- per-commit sha-<sha> tags on main (immutable, race-free)
- org.opencontainers.image.revision label on each per-arch image
- dashboard subcommand smoke test (#9153 guard)
- race-safe :latest advancement via move-latest
- top-level cancel-in-progress: false
Changed behavior:
- move-latest flipped to cancel-in-progress: false for
defense-in-depth.
Top-level concurrency already serializes runs for the ref, so the
old
cancel=true on move-latest was dead code. Flipping to false
prevents
any starvation mode if top-level is ever loosened.
Cache scopes separated per-arch (scope=docker-amd64 /
scope=docker-arm64)
so the two runners don't clobber each other in the gha cache backend.
bf80508d65