ci: publish linux/amd64+arm64 multi-arch images

.github/workflows/ci.yml

@@ -159,14 +159,35 @@ jobs:
             type=semver,pattern={{version}}
             type=raw,value=latest
 
+      # QEMU registers binfmt_misc handlers so the amd64 GitHub-hosted
+      # runner can emulate arm64 instructions -- required for Buildx to
+      # actually execute the arm64 half of the multi-platform build below.
+      # Installed once here for the whole job; only the API image build
+      # step below opts into platforms: linux/amd64,linux/arm64 -- the
+      # worker image step further down is intentionally left as its
+      # existing single-platform (host/amd64) build, since
+      # ghcr.io/omnibioai/omnibioai-security-audit-worker is not one of
+      # the images this change is scoped to.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # platforms: linux/amd64,linux/arm64 -- emits a single multi-arch
+      # manifest list under each tag from steps.meta.outputs.tags.
+      # requirements.txt (fastapi/uvicorn/redis/pydantic/sqlalchemy/
+      # alembic/pymysql/PyJWT[crypto]) is pure-Python or ships manylinux
+      # aarch64 wheels (pydantic-core, cryptography, PyMySQL has none --
+      # pure Python), and python:3.11-slim publishes an arm64 variant, so
+      # no cross-compilation toolchain is needed for the emulated arm64
+      # leg.
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha