ci: multi-arch container build using Buildah on native amd64 + arm64 runners

Builds per-arch images on native GitHub-hosted runners (ubuntu-24.04 and
ubuntu-24.04-arm), then merges into a multi-platform manifest on ghcr.io.
No QEMU emulation needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kpiwko

.github/workflows/container.yaml

@@ -7,19 +7,55 @@ on:
       - 'v*'
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
     permissions:
       contents: read
       packages: write
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Log in to ghcr.io
+      - name: Build image
+        id: build
+        uses: redhat-actions/buildah-build@v2
+        with:
+          image: gmail-mcp-server
+          tags: ${{ github.sha }}-${{ matrix.arch }}
+          containerfiles: ./Containerfile
+          platforms: linux/${{ matrix.arch }}
+
+      - name: Push per-arch image
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: redhat-actions/push-to-registry@v2
+        with:
+          image: ${{ steps.build.outputs.image }}
+          tags: ${{ steps.build.outputs.tags }}
+          registry: ghcr.io/${{ github.repository_owner }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+  manifest:
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    permissions:
+      packages: write
+
+    steps:
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -32,15 +68,15 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/gmail-mcp-server
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
-            type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
 
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+      - name: Create and push multi-arch manifest
+        run: |
+          IMAGE="ghcr.io/${{ github.repository_owner }}/gmail-mcp-server"
+          while IFS= read -r tag; do
+            docker buildx imagetools create \
+              -t "$tag" \
+              "${IMAGE}:${{ github.sha }}-amd64" \
+              "${IMAGE}:${{ github.sha }}-arm64"
+          done <<< "${{ steps.meta.outputs.tags }}"