Loading
Publish the regular CI image as a multi-arch manifest list
The regular CI image is published as a single linux/amd64 manifest, while latest-fips is already a manifest list with amd64 and arm64. GitLab Relay needs the regular image on saas-linux-medium-arm64 runners to build its GLAZ-linked container image natively per architecture (cgo, no cross toolchain), and those jobs cannot start today.
This copies the FIPS mechanism to the regular image: per-architecture parallel: matrix builds pushing latest-<arch> and ci-<sha>-<arch>, then a docker manifest create/push job that publishes latest and ci-<sha> as manifest lists. The Duo jobs now need the manifest jobs, because their --pull of the base tag must see the new manifest list. The Dockerfile is unchanged: it already keys the Docker apt repository on TARGETARCH, and debian:13-slim, the apt packages and the mise installer all support arm64.
Verified locally: docker buildx build --platform linux/arm64 of the unmodified Dockerfile succeeds on a native arm64 daemon, and mise install with Relay's mise.toml inside that image resolves all eight tools to native arm64 artifacts (go, golangci-lint, ruby, bazel, buf, cosign, crane, python).