workflows: build a multi-arch tasks container

Build a tasks container for arm64 in addition to amd64.

We do this by splitting the build process into multiple jobs.  For the
arm one, we make use of the arm runners from BuildJet.  At the end, we
write the manifest and upload that with the "public" tag name.

Remove the local infrastructure and rules for pushing the container;
it's not so easy anymore.

Author: allisonkarlitskaya

.github/workflows/build-tasks.yml

@@ -1,21 +1,68 @@
 name: build-tasks
+
 on:
   # this is meant to be run on an approved PR branch for convenience
   workflow_dispatch:
+
+# We derive a unique ID here to make sure that we don't get into a situation
+# where different runners pick different tags (eg: for builds near midnight, or
+# in different time zones).  The manifest job picks the final name.
+env:
+  tag: quay.io/cockpit/tasks
+  tmptag: quay.io/cockpit/tasks-tmp:${{ github.run_id }}.${{ github.run_attempt }}
+
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        build:
+          - label: amd64
+            runner: buildjet-2vcpu-ubuntu-2204
+          - label: arm64
+            runner: buildjet-2vcpu-ubuntu-2204-arm
+
+    runs-on: ${{ matrix.build.runner }}
     environment: quay.io
-    timeout-minutes: 30
+    timeout-minutes: 10
+
     steps:
-      - name: Clone repository
+      # NB: no podman on buildjet arm runners
+      -
+        name: Log in to container registry
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_BOTUSER }}
+          password: ${{ secrets.QUAY_TOKEN }}
+      -
+        name: Checkout
         uses: actions/checkout@v4
+      -
+        name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          tags: ${{ env.tmptag }}-${{ matrix.build.label }}
+          context: tasks/container
+          file: tasks/container/Containerfile
 
-      - name: Log into container registry
-        run: podman login -u ${{ secrets.QUAY_BOTUSER }} -p ${{ secrets.QUAY_TOKEN }} quay.io
+  manifest:
+    needs: build
 
-      - name: Build tasks container
-        run: make tasks-container
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    environment: quay.io
+    timeout-minutes: 5
 
-      - name: Push container to registry
-        run: make tasks-push
+    steps:
+      -
+        name: Login in to container registry
+        run: podman login -u ${{ secrets.QUAY_BOTUSER }} -p ${{ secrets.QUAY_TOKEN }} quay.io
+      -
+        name: Create manifest
+        run: podman manifest create tasks '${{ env.tmptag }}'-{amd,arm}64
+      -
+        name: Push with versioned tag
+        run: podman manifest push tasks "${{ env.tag }}:$(date --iso-8601)"
+      -
+        name: Push :latest tag
+        run: podman manifest push tasks "${{ env.tag }}:latest"

Makefile

@@ -1,7 +1,6 @@
 all:
 	@echo "usage: make containers" >&2
 	@echo "       make tasks-container" >&2
-	@echo "       make tasks-push" >&2
 	@echo "       make check" >&2
 
 check:
@@ -19,8 +18,5 @@ tasks-container:
 	$(DOCKER) build -t quay.io/cockpit/tasks:$(TAG) tasks/container
 	$(DOCKER) tag quay.io/cockpit/tasks:$(TAG) quay.io/cockpit/tasks:latest
 
-tasks-push:
-	./push-container quay.io/cockpit/tasks
-
 tasks-secrets:
 	@cd tasks && ./build-secrets $(TASK_SECRETS)