Repository navigation
feat(image): publish linux/amd64 and linux/arm64 - #6
Conversation
Floating major tags can be moved to arbitrary code by whoever controls the action repository. The release job holds packages:write and contents:write, so a retargeted tag would run with the rights to overwrite the published image. Pin each action to the commit of the latest release in the major already in use. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
The image was amd64-only because the Dockerfile hardcoded GOARCH=amd64, so arm64 nodes could not run the proxy at all. cgo stays on: pg_query_go compiles the libpg_query C parser into the binary. The build stage now runs on the build host and cross-compiles with Debian's cross gcc for the target arch instead of building under QEMU, which would compile the whole C parser emulated. The cross toolchain links against bookworm's glibc, the same one the distroless/base-debian12 runtime ships. Release publishes both platforms as one index. CI builds the image for both platforms without pushing, so a change that breaks the arm64 cross-build fails on the pull request instead of at release time. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
IvanHunters
left a comment
IvanHunters
left a comment
There was a problem hiding this comment.
Reviewed statically in a hermetic clone. Verified both stage base images are multi-arch via crane, confirmed every Debian cross-toolchain package exists in bookworm, and checked all 7 GitHub Actions SHA pins match their tags. The real CI run on this head executed the production cross-compile path (amd64 runner, CC=aarch64-linux-gnu-gcc, CGO on) and succeeded. LGTM. Two minor non-blocking notes.
2 participants
What
The proxy image can't run on arm64 nodes today. The Dockerfile hardcodes
GOARCH=amd64, soghcr.io/cozystack/keycloak-kms-proxyis published for amd64 only. With this change the release publishes it as alinux/amd64+linux/arm64index.Why cross-compiling instead of QEMU
cgo has to stay on, because
pg_query_gocompiles the libpg_query C parser into the binary. The build stage now runs on$BUILDPLATFORM. When the target differs from the host, it installs Debian's cross gcc (gcc-aarch64-linux-gnuorgcc-x86-64-linux-gnu) and setsCCfor the target. So the C parser is never compiled under emulation, and the release stays one buildx call on one runner, with nosetup-qemu-action. The cross toolchain links against bookworm's glibc, the same versiondistroless/base-debian12ships, so the runtime base does not change.CI
CI gets an
imagejob that builds both platforms without pushing. A change that breaks the arm64 cross-build fails there, not on tag push. A separate commit pins every action in both workflows to a full commit SHA with a version comment. The release job holdspackages: write, so a moved tag could overwrite the published image.Testing
file).--version, and the amd64 image does the same under emulation.golang:1.26.2-bookwormcontainer withgcc-aarch64-linux-gnu. It builds an AArch64 binary.go vet ./...,go test -race ./...,golangci-lint run(0 issues) andactionlintare clean.