fix(ci): build the operator image natively for multi-arch

Pin the Dockerfile builder stage to $BUILDPLATFORM so a buildx --platform=linux/amd64,linux/arm64 build cross-compiles via GOARCH instead of running go build under emulation; without it the arm64 leg fails with exec format error on an amd64 runner with no QEMU. Add a no-QEMU multi-arch build-only CI job that fails closed if the pin regresses.

Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

Author: lllamnyp

.github/workflows/ci.yml

@@ -7,6 +7,20 @@ on:
     branches: [ main ]
 
 jobs:
+  image-multiarch:
+    # Build-only assertion that the operator image builds for every published
+    # platform. Deliberately sets up buildx WITHOUT QEMU: the Dockerfile builder
+    # is pinned to $BUILDPLATFORM and Go cross-compiles via GOARCH, so both legs
+    # must build natively on this amd64 runner with no emulation. If the
+    # --platform=$BUILDPLATFORM pin regresses, the arm64 leg fails here (exec
+    # format error) instead of silently breaking the tag-release publish.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3.3.0
+      - name: Build multi-arch image (no push, no QEMU)
+        run: docker buildx build --platform linux/amd64,linux/arm64 -t etcd-operator:buildtest .
+
   verify:
     runs-on: ubuntu-latest
     steps:

Dockerfile

@@ -1,5 +1,10 @@
-# Build the manager binary
-FROM golang:1.25.10 AS builder
+# Build the manager binary.
+# Pin the builder to the BUILD platform so a multi-arch `buildx --platform`
+# build runs the builder natively (no QEMU) and Go cross-compiles via the
+# GOARCH=${TARGETARCH} below. Without this, buildx instantiates the builder as
+# the target arch and `go build` runs under emulation — which fails the arm64
+# leg on an amd64 runner that has no binfmt registered.
+FROM --platform=$BUILDPLATFORM golang:1.25.10 AS builder
 ARG TARGETOS
 ARG TARGETARCH