ci: build each architecture on its own runner

Emulating the arm64 PHP compile took close to three hours before it was
cancelled. Public repositories get free arm64 runners, so each architecture
now builds natively and the two images are joined into one manifest.

Author: sowahq

.github/workflows/release.yml

@@ -17,23 +17,73 @@ env:
   IMAGE: ghcr.io/${{ github.repository }}
 
 jobs:
-  release:
-    runs-on: ubuntu-latest
-    timeout-minutes: 180
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
 
     steps:
       - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Each architecture builds on a runner of that architecture. Emulating the PHP compile
+      # instead took close to three hours.
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/${{ matrix.arch }}
+          cache-from: type=gha,scope=${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
 
+      - name: Record the digest
+        run: |
+          digest="${{ steps.build.outputs.digest }}"
+          mkdir -p /tmp/digests
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digest-${{ matrix.arch }}
+          path: /tmp/digests/*
+          retention-days: 1
+
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
       - name: Resolve the version
         id: version
         run: |
           tag="${{ inputs.tag || github.ref_name }}"
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
 
-      # PHP is compiled from source inside the image, once per architecture. The arm64 half
-      # runs under emulation, so this job is slow by nature.
-      - uses: docker/setup-qemu-action@v3
+      - uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digest-*
+          merge-multiple: true
+
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3
@@ -42,18 +92,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push the image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ${{ env.IMAGE }}:${{ steps.version.outputs.version }}
-            ${{ env.IMAGE }}:latest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Assemble the multi-architecture tags
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            --tag "${IMAGE}:${{ steps.version.outputs.version }}" \
+            --tag "${IMAGE}:latest" \
+            $(printf "${IMAGE}@sha256:%s " *)
+          docker buildx imagetools inspect "${IMAGE}:${{ steps.version.outputs.version }}"
 
       - name: Extract the binaries
         run: |
@@ -62,10 +108,9 @@ jobs:
             image="${IMAGE}:${{ steps.version.outputs.version }}"
             docker pull --platform "linux/$arch" "$image"
             container=$(docker create --platform "linux/$arch" "$image")
-            docker cp "$container:/usr/local/bin/stoke" "dist/stoke"
+            docker cp "$container:/usr/local/bin/stoke" dist/stoke
             docker rm "$container" > /dev/null
-            tar -czf "dist/stoke-${{ steps.version.outputs.version }}-linux-$arch.tar.gz" \
-              -C dist stoke
+            tar -czf "dist/stoke-${{ steps.version.outputs.version }}-linux-$arch.tar.gz" -C dist stoke
             rm dist/stoke
           done
           ls -la dist