ci: using koci merge for multi arch

Author: Sawangg

.github/workflows/build.yaml

@@ -35,12 +35,6 @@ jobs:
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
     steps:
-      - name: Free disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
-          sudo docker system prune -af
-          df -h
-
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
@@ -70,16 +64,9 @@ jobs:
           CONTAINER_RUNTIME=docker \
           ARCH=${{ matrix.arch }} \
           PUSH=true \
-          LATEST=${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.latest) }} \
-          TAG=${{ steps.tag.outputs.tag }} \
+          TAG=ci \
           just oci
 
-      - name: Build summary
-        run: |
-          echo "### stub (${{ matrix.arch }}) Built" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **Tag:** \`${{ steps.tag.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **Image:** \`${{ env.REGISTRY }}/stub:${{ steps.tag.outputs.tag }}-${{ matrix.arch }}\`" >> "$GITHUB_STEP_SUMMARY"
-
   manifest:
     name: Combine multi-arch manifest
     needs: build
@@ -89,18 +76,14 @@ jobs:
     runs-on: ubuntu-latest
     env:
       REGISTRY: ghcr.io/muak-os
+      CONTAINER_RUNTIME: docker
+      TOOLS: ghcr.io/muak-os/tools:latest
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - uses: docker/setup-buildx-action@v4
-
-      - uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: taiki-e/install-action@just
 
       - name: Determine tag
         id: tag
@@ -115,24 +98,15 @@ jobs:
         env:
           TAG: ${{ steps.tag.outputs.tag }}
           LATEST: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.latest) }}
+          KOCI_REGISTRY_USERNAME: ${{ github.actor }}
+          KOCI_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          docker buildx imagetools create \
-            --tag "${REGISTRY}/stub:${TAG}" \
-            "${REGISTRY}/stub:${TAG}-amd64" \
-            "${REGISTRY}/stub:${TAG}-arm64"
-
-          if [ "${LATEST}" = "true" ]; then
-            docker buildx imagetools create \
-              --tag "${REGISTRY}/stub:latest" \
-              "${REGISTRY}/stub:latest-amd64" \
-              "${REGISTRY}/stub:latest-arm64"
-          fi
+          just merge amd64=ci-amd64 arm64=ci-arm64
 
       - name: Build summary
         run: |
           echo "### Multi-arch manifest created" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **Tag:** \`${{ env.REGISTRY }}/stub:${{ steps.tag.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **Sources:** \`${{ env.REGISTRY }}/stub:${{ steps.tag.outputs.tag }}-amd64\`, \`${{ env.REGISTRY }}/stub:${{ steps.tag.outputs.tag }}-arm64\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **Tag:** \`${REGISTRY}/stub:${{ steps.tag.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
           if [[ "${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.latest) }}" == "true" ]]; then
-            echo "- **Latest:** \`${{ env.REGISTRY }}/stub:latest\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "- **Latest:** \`${REGISTRY}/stub:latest\`" >> "$GITHUB_STEP_SUMMARY"
           fi

Justfile

@@ -1,6 +1,6 @@
 # Muak UEFI boot stub
 #
-# Prerequisites: rustup, docker/podman
+# Prerequisites: rustup, docker/podman, git
 # Run `just --list` for available recipes
 
 set positional-arguments := true
@@ -17,8 +17,10 @@ alpine_version := "3.24"
 rust_version := `grep -oP 'rust-version\s*=\s*"\K[^"]+' Cargo.toml`
 registry := env_var_or_default("REGISTRY", "ghcr.io/muak-os")
 tag := env_var_or_default("TAG", "latest")
+tools := env_var_or_default("TOOLS", "ghcr.io/muak-os/tools:latest")
 push := env_var_or_default("PUSH", "false")
 latest := env_var_or_default("LATEST", "false")
+push_arg := if container_runtime == "podman" { "" } else { if push == "true" { "--push" } else { "" } }
 out := `test -f .git && realpath -m "$(git rev-parse --git-common-dir)/../_out" || realpath -m _out`
 
 # Architecture
@@ -53,6 +55,10 @@ build release="":
     CARGO_BUILD_SBOM=true cargo build {{ release }} -Z sbom --target {{ arch }}-unknown-uefi --features uefi
     printf "{{ green }}Stub built successfully!{{ reset }}\n"
 
+# ─────────────────────────────────────────────────────────────────────────────
+# OCI Images
+# ─────────────────────────────────────────────────────────────────────────────
+
 # Build (and optionally push) the stub OCI image
 [script]
 oci:
@@ -64,14 +70,8 @@ oci:
 
     if [ "{{ container_runtime }}" = "podman" ]; then
         cmd="podman build"
-        push_flags=""
     else
         cmd="docker buildx build --provenance=false"
-        if [ "{{ push }}" = "true" ]; then
-            push_flags="--push"
-        else
-            push_flags=""
-        fi
     fi
 
     printf "{{ cyan }}Building stub image: {{ registry }}/stub (push={{ push }}, latest={{ latest }}){{ reset }}\n"
@@ -81,7 +81,7 @@ oci:
         --build-arg ALPINE_VERSION={{ alpine_version }} \
         --build-arg RUST_VERSION={{ rust_version }} \
         --build-arg SOURCE_DATE_EPOCH=0 \
-        ${push_flags} \
+        {{ push_arg }} \
         $(just _cache-from stub) $(just _cache-to stub) \
         ${tags} \
         --file Dockerfile \
@@ -92,6 +92,22 @@ oci:
         if [ "{{ latest }}" = "true" ]; then {{ container_runtime }} push "{{ registry }}/stub:latest{{ oci_suffix }}"; fi
     fi
 
+# Merge per-platform images into a multi-arch OCI index
+[script]
+merge *sources:
+    tags=""
+    if [ "{{ latest }}" = "true" ]; then
+        tags="--tag latest"
+    fi
+    {{ container_runtime }} run --rm --network=host \
+        -e KOCI_REGISTRY_USERNAME -e KOCI_REGISTRY_PASSWORD \
+        {{ tools }} \
+        /koci merge \
+            --image "{{ registry }}/stub" \
+            --tag "{{ tag }}" \
+            ${tags} \
+            {{ sources }}
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Testing
 # ─────────────────────────────────────────────────────────────────────────────