BanManagement / BanManager-WebUI / 24660962798

72%

push

github

ci(docker): publish multi-arch image with native runners (#1768)

* ci(docker): build linux/arm64 on a native runner instead of qemu

The publish workflow has been broken since the Node 24 bump (#1767). The
arm64 leg ran under qemu-user on the amd64 runner and crashed with
SIGILL (exit 132) inside `npm ci` - V8 13's JIT emits Arm v8.x
instructions that the runner's binfmt qemu cannot decode.

Switch to the docker/build-push-action multi-platform pattern:
  - Matrix per architecture, each on its native runner. amd64 stays on
    `ubuntu-latest`; arm64 moves to the free `ubuntu-24.04-arm` runner
    GitHub now provides for public repos. Both per-arch jobs push
    blob-only `push-by-digest` images so they never compete for shared
    tags.
  - A `merge` job downloads both digests and stitches them into the
    `:latest` and `:<sha>` manifest list with `docker buildx imagetools
    create`, reproducing the previous tag set.

Also add per-arch GHA cache scopes so the two legs do not invalidate
each other.

Temporarily includes `chore/native-arm-publish` in the push trigger so
the workflow can be validated end-to-end before the entry is removed
and the change is opened for review.

* ci(docker): drop temp branch trigger and keep raw SHA tag format

Validation run on chore/native-arm-publish (run 24660044323) succeeded
end-to-end - both per-arch builds passed on their native runners and the
merge job pushed the manifest list to Docker Hub. Remove the temporary
push trigger so the workflow only runs on master, and override the
metadata-action sha prefix so the SHA tag stays bare (matching the
previous github.sha tag format).

* ci(docker): pin docker/* actions to commit SHAs

SonarCloud's githubactions:S7637 ("Use full commit SHA hash for this
dependency") flagged the three docker/* uses in the new merge job
introduced by this PR. Pin all docker/setup-buildx-action,
docker/login-action, docker/metadata-action, and docker/build-push-action
invocations in both... (continued)

1833 of 2948 branches covered (62.18%)

Branch coverage included in aggregate %.

3797 of 4894 relevant lines covered (77.58%)

716.95 hits per line