Publish Docker multi-arch natively

Author: Wangnov

.github/workflows/docker.yml

@@ -18,7 +18,49 @@ env:
   IMAGE_NAME: wangnov/codex-asr
 
 jobs:
-  image:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            platform_pair: linux-amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            platform_pair: linux-arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build platform image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.sha }}-${{ matrix.platform_pair }}
+          labels: |
+            org.opencontainers.image.title=codex-asr
+            org.opencontainers.image.description=Unofficial Codex Desktop ASR CLI and local Whisper-compatible REST shim
+            org.opencontainers.image.source=https://github.com/Wangnov/codex-asr
+            org.opencontainers.image.licenses=MIT
+          cache-from: type=gha,scope=${{ matrix.platform_pair }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.platform_pair }}
+
+  manifest:
+    if: github.event_name != 'pull_request'
+    needs: build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -30,12 +72,9 @@ jobs:
           version="$(awk -F '"' '/^version = / { print $2; exit }' Cargo.toml)"
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
-      - uses: docker/setup-qemu-action@v3
-
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -61,13 +100,18 @@ jobs:
             org.opencontainers.image.source=https://github.com/Wangnov/codex-asr
             org.opencontainers.image.licenses=MIT
 
-      - name: Build and publish Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create multi-platform manifest
+        env:
+          METADATA_JSON: ${{ steps.meta.outputs.json }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        shell: bash
+        run: |
+          mapfile -t tags < <(jq -r '.tags[]' <<< "$METADATA_JSON")
+          args=()
+          for tag in "${tags[@]}"; do
+            args+=("-t" "$tag")
+          done
+          docker buildx imagetools create \
+            "${args[@]}" \
+            "$IMAGE:build-${GITHUB_SHA}-linux-amd64" \
+            "$IMAGE:build-${GITHUB_SHA}-linux-arm64"