ci: use native runners matrix to eliminate QEMU overhead

Thanks to https://github.com/sredevopsorg/multi-arch-docker-github-workflow

Signed-off-by: rizlas <rizlas@users.noreply.github.com>

Author: rizlas

.github/workflows/docker-image.yml

@@ -1,3 +1,4 @@
+# Inspired by https://github.com/sredevopsorg/multi-arch-docker-github-workflow
 name: Docker Image CI
 
 on:
@@ -11,13 +12,22 @@ on:
                 required: false
 
 jobs:
-    build-and-push:
-        runs-on: ubuntu-latest
+    build:
+        runs-on: ${{ matrix.runner }}
 
         permissions:
             contents: read
             packages: write
 
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - platform: linux/amd64
+                      runner: ubuntu-latest
+                    - platform: linux/arm64
+                      runner: ubuntu-24.04-arm
+
         steps:
             - name: Checkout code
               uses: actions/checkout@v6
@@ -32,9 +42,6 @@ jobs:
                   username: ${{ github.actor }}
                   password: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v4
-
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v4
 
@@ -55,13 +62,100 @@ jobs:
                       type=raw,value=latest
                       type=raw,value=${{ steps.tag.outputs.value }},enable=${{ inputs.upstream_tag != '' }}
 
-            - name: Build and push
+            - name: Build and push by digest
+              id: build
               uses: docker/build-push-action@v7
               with:
                   context: .
-                  push: true
-                  platforms: linux/amd64,linux/arm64
-                  tags: ${{ steps.meta.outputs.tags }}
+                  platforms: ${{ matrix.platform }}
                   labels: ${{ steps.meta.outputs.labels }}
-                  cache-from: type=gha
-                  cache-to: type=gha,mode=max
+                  outputs: type=image,name=ghcr.io/${{ github.repository }},push-by-digest=true,name-canonical=true,push=true
+                  cache-from: type=gha,scope=${{ matrix.platform }}
+                  cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
+
+            - name: Export digest
+              run: |
+                  mkdir -p /tmp/digests
+                  touch "/tmp/digests/${DIGEST#sha256:}"
+              env:
+                  DIGEST: ${{ steps.build.outputs.digest }}
+
+            - name: Upload digest
+              uses: actions/upload-artifact@v4
+              with:
+                  name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+                  path: /tmp/digests/*
+                  if-no-files-found: error
+                  retention-days: 1
+
+    merge:
+        runs-on: ubuntu-latest
+        needs: build
+
+        permissions:
+            contents: read
+            packages: write
+
+        steps:
+            - name: Download digests
+              uses: actions/download-artifact@v4
+              with:
+                  path: /tmp/digests
+                  pattern: digests-*
+                  merge-multiple: true
+
+            - name: Log in to GitHub Packages
+              uses: docker/login-action@v4
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v4
+
+            - name: Sanitize upstream tag
+              if: inputs.upstream_tag != ''
+              id: tag
+              run: echo "value=${INPUT_TAG#v}" >> $GITHUB_OUTPUT
+              env:
+                  INPUT_TAG: ${{ inputs.upstream_tag }}
+
+            - name: Extract metadata
+              id: meta
+              uses: docker/metadata-action@v6
+              with:
+                  images: ghcr.io/${{ github.repository }}
+                  tags: |
+                      type=ref,event=tag
+                      type=raw,value=latest
+                      type=raw,value=${{ steps.tag.outputs.value }},enable=${{ inputs.upstream_tag != '' }}
+
+            - name: Get timestamp
+              id: timestamp
+              run: echo "timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
+
+            - name: Create and push manifest
+              id: manifest
+              working-directory: /tmp/digests
+              continue-on-error: true
+              run: |
+                  docker buildx imagetools create \
+                    $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+                    --annotation='index:org.opencontainers.image.description=${{ github.event.repository.description }}' \
+                    --annotation='index:org.opencontainers.image.created=${{ steps.timestamp.outputs.timestamp }}' \
+                    --annotation='index:org.opencontainers.image.url=${{ github.event.repository.url }}' \
+                    --annotation='index:org.opencontainers.image.source=${{ github.event.repository.url }}' \
+                    $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)
+
+            - name: Create and push manifest (without annotations)
+              if: steps.manifest.outcome == 'failure'
+              working-directory: /tmp/digests
+              run: |
+                  docker buildx imagetools create \
+                    $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+                    $(printf 'ghcr.io/${{ github.repository }}@sha256:%s ' *)
+
+            - name: Inspect manifest
+              run: |
+                  docker buildx imagetools inspect 'ghcr.io/${{ github.repository }}:${{ steps.meta.outputs.version }}'