Merge pull request #538 from slashdevops/fix/container-build-qemu-setup

fix(ci): restore multi-arch container builds in release workflow

Author: christiangda

.github/workflows/container-image.yml

@@ -15,6 +15,11 @@ jobs:
   build:
     name: Build and Publish Container Images
     runs-on: ubuntu-latest
+    defaults:
+      # pipefail so `make ... | tee $GITHUB_STEP_SUMMARY` propagates the
+      # upstream make exit code instead of being swallowed by tee's exit 0.
+      run:
+        shell: bash -eo pipefail {0}
     permissions:
       contents: read
       packages: write
@@ -23,10 +28,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Install Podman
+      - name: Install Podman and cross-arch emulation
+        # qemu-user-static + binfmt-support register QEMU user-mode handlers
+        # in /proc/sys/fs/binfmt_misc so podman can RUN steps inside arm64
+        # images on this amd64 runner (the Containerfile's `apk add` step
+        # otherwise dies with "exec /bin/sh: Exec format error").
         run: |
           sudo apt-get update
-          sudo apt-get install -y podman
+          sudo apt-get install -y podman qemu-user-static binfmt-support
 
       - name: Tools and versions
         run: |

docs/Whats-New.md

@@ -4,6 +4,19 @@ This document tracks notable changes, new features, and bug fixes across release
 
 ## Unreleased
 
+### CI fix: restore multi-arch container builds in the release workflow
+
+Fixes the `Publish Container Images` job (failing since v0.44.1, surfaced again on the v0.45.0 release as ["Could not resolve digest for ghcr.io/slashdevops/idp-scim-sync:v0.45.0"](https://github.com/slashdevops/idp-scim-sync/actions/runs/26356807875/job/77585211704)).
+
+**Root cause.** When the workflow was migrated from Docker to Podman in `ab22744`, the `docker/setup-qemu-action` step was removed on the assumption that pre-built binaries no longer required cross-compilation. They don't — but every `RUN` line in `Containerfile` (notably `apk add ca-certificates`) still has to execute under the target architecture. On the `amd64` runner, building the `arm64` variant therefore needs QEMU user-mode emulation registered with `binfmt_misc`. Without it, `podman build --platform linux/arm64` died with `exec /bin/sh: Exec format error`, the `arm64` image was never created, `podman manifest add` then failed, no manifest was pushed, and `cosign sign` finally failed with "Could not resolve digest". The two upstream `make` failures were not surfaced as red steps because `make ... | tee $GITHUB_STEP_SUMMARY` runs under bash without `pipefail`, so `tee`'s exit 0 masked the make exit 1.
+
+**Changes in `.github/workflows/container-image.yml`:**
+
+* Install `qemu-user-static` and `binfmt-support` alongside `podman` so the kernel can run arm64 binaries during the build.
+* Set `defaults.run.shell: bash -eo pipefail {0}` at the job level so future `cmd | tee` failures fail the step instead of being silently swallowed.
+
+No code changes; release artifacts and signing flow are unchanged.
+
 ### SCIM members sync — major security & performance improvement (closes [#520](https://github.com/slashdevops/idp-scim-sync/issues/520))
 
 > [!IMPORTANT]