From de3ff04d190ea8386acc6384054daf41c7338633 Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Mon, 17 Aug 2026 17:22:10 -0500 Subject: [PATCH] ci: build and publish linux/amd64+arm64 multi-arch images Adds docker/setup-qemu-action and platforms: linux/amd64,linux/arm64 to the existing docker/build-push-action step so the GHCR tag becomes a real multi-arch manifest list instead of an amd64-only image. No changes to image names, tag scheme (metadata-action config untouched), GHCR auth, or job triggers -- only the build step gains QEMU emulation support and the platforms list. All of this Dockerfile's runtime dependencies are pure-Python or ship prebuilt manylinux aarch64 wheels, and the base image already publishes an arm64 variant, so no other Dockerfile changes were needed. Validated locally with docker buildx build --platform linux/amd64,linux/arm64 against this Dockerfile before this change. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cf9ebe4..3434087 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -159,14 +159,35 @@ jobs: type=semver,pattern={{version}} type=raw,value=latest + # QEMU registers binfmt_misc handlers so the amd64 GitHub-hosted + # runner can emulate arm64 instructions -- required for Buildx to + # actually execute the arm64 half of the multi-platform build below. + # Installed once here for the whole job; only the API image build + # step below opts into platforms: linux/amd64,linux/arm64 -- the + # worker image step further down is intentionally left as its + # existing single-platform (host/amd64) build, since + # ghcr.io/omnibioai/omnibioai-security-audit-worker is not one of + # the images this change is scoped to. + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + # platforms: linux/amd64,linux/arm64 -- emits a single multi-arch + # manifest list under each tag from steps.meta.outputs.tags. + # requirements.txt (fastapi/uvicorn/redis/pydantic/sqlalchemy/ + # alembic/pymysql/PyJWT[crypto]) is pure-Python or ships manylinux + # aarch64 wheels (pydantic-core, cryptography, PyMySQL has none -- + # pure Python), and python:3.11-slim publishes an arm64 variant, so + # no cross-compilation toolchain is needed for the emulated arm64 + # leg. - name: Build and push uses: docker/build-push-action@v5 with: context: . push: true + platforms: linux/amd64,linux/arm64 tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha