Stop building the web image's frontend under QEMU (#24)

The Web Build & Push job for 633f641 on main was cancelled at GitHub's
six-hour limit. Dockerfile.web built its builder stage once per target
platform, so the arm64 leg ran `pnpm install` and `pnpm build` under
QEMU. Node crashed there with SIGILL ("qemu: uncaught target signal 4")
40 seconds into the install; the step never exited, and the job sat
idle until GitHub killed it.

dist/ is static files, identical for every architecture. The builder
stage now runs on $BUILDPLATFORM, so it is built once, natively, and
only the COPY-only nginx stage is produced per architecture: nothing
executes under emulation. Emulated, `pnpm build` alone took 260s
against 23s natively.

The job also gets a 20-minute timeout, so a hang fails in minutes
instead of holding a runner for six hours.

release.yml builds each architecture on its own native runner, where
$BUILDPLATFORM already equals the target, so release images are built
exactly as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: fylorn

.github/workflows/ci.yml

@@ -232,13 +232,20 @@ jobs:
             $(printf "${IMAGE}@sha256:%s " *)
 
   # ---------------------------------------------------------------------------
-  # Docker Web: static files are arch-independent, single buildx with QEMU
+  # Docker Web: static files are arch-independent. Dockerfile.web builds them
+  # once on this runner's own platform and copies them into each arch's nginx
+  # image, so no build step runs under emulation.
   # ---------------------------------------------------------------------------
   docker-web:
     name: Web Build & Push
     runs-on: ubuntu-latest
     needs: [rust, frontend]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # A healthy run takes minutes. With no limit, a hung build holds the
+    # runner for GitHub's six-hour maximum — which is what happened when
+    # Node crashed under QEMU in the old per-arch build and the step never
+    # exited.
+    timeout-minutes: 20
     permissions:
       contents: read
       packages: write

CHANGELOG.md

@@ -11,6 +11,18 @@ target.
 
 ## [Unreleased]
 
+### Fixed
+
+- **CI** — the `main` push that merged #23 never produced its web image.
+  `Dockerfile.web` built the frontend once per architecture, Node crashed
+  with SIGILL in the QEMU-emulated arm64 build, and the build step hung
+  until GitHub cancelled the job at the six-hour limit. The static files
+  are identical on every architecture, so they are now built once,
+  natively, and copied into each architecture's nginx image — emulated,
+  `pnpm build` alone took 260s against 23s. The job also times out after
+  20 minutes. Image contents are unchanged; release builds already ran on
+  native runners.
+
 ## [1.0.2] — 2026-09-13
 
 The shared gateway layer moves out into its own repository, and OIDC

deploy/docker/Dockerfile.web

@@ -1,5 +1,12 @@
 # Stage 1: Build
-FROM node:24-alpine AS builder
+#
+# Runs on the building machine's own platform rather than once per target.
+# dist/ is static files, identical for every architecture, so it is built
+# once, natively, and stage 2 only copies it. Built per target, arm64 ran
+# `pnpm install` and `pnpm build` under QEMU: the build alone took 260s
+# against 23s natively, and when Node crashed there with SIGILL the step
+# never exited — the CI job sat idle until GitHub's six-hour limit.
+FROM --platform=$BUILDPLATFORM node:24-alpine AS builder
 
 # Pin pnpm to a known-good 11.x. The workspace YAML's `allowBuilds`
 # field requires pnpm 11+ (see web/pnpm-workspace.yaml top comment).