perf(ci): cross-compile validator images to skip QEMU on arm64

The GB200 UAT path builds validator images multi-arch (linux/amd64,
linux/arm64) on an amd64 runner. Running go build inside the target-arch
builder stage emulated the arm64 compile under QEMU (~15 min/image, ~53 min
total). Pin the builder to $BUILDPLATFORM and cross-compile via $TARGETARCH
so the compile stays native; the distroless stage is COPY-only and needs no
emulation. Verified ~8x faster (1061s -> 126s) on a fork build probe.

Signed-off-by: Nathan Hensley <nhensley@nvidia.com>

Author: njhensley

validators/conformance/Dockerfile

@@ -12,8 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Pin the builder stage to the build host's native arch ($BUILDPLATFORM) and
+# cross-compile to the requested $TARGETARCH with Go's own toolchain, rather
+# than running an emulated (QEMU) builder for foreign platforms. Multi-arch
+# GB200 UAT builds (linux/amd64,linux/arm64 on an amd64 runner) previously
+# executed the arm64 `go build` under emulation (~15 min); cross-compiling on
+# the native builder brings it back to native speed. The final distroless stage
+# is a COPY-only layer, so it needs no emulation for the target arch.
 ARG GO_VERSION=1.26.3
-FROM golang:${GO_VERSION}-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -22,7 +29,8 @@ COPY pkg/ pkg/
 COPY validators/ validators/
 COPY recipes/ recipes/
 
-RUN CGO_ENABLED=0 go build -o /out/conformance ./validators/conformance
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /out/conformance ./validators/conformance
 
 FROM nvcr.io/nvidia/distroless/static:v4.0.0@sha256:d90158b69e250d2018f32622b5c622925202ee97224a990a54b63811cb1e3d69
 

validators/deployment/Dockerfile

@@ -20,8 +20,15 @@
 # v1alpha1.Test AST and dispatches assert/error to kyverno-json's
 # checks.Check engine, so the external binary is no longer needed.
 
+# Pin the builder stage to the build host's native arch ($BUILDPLATFORM) and
+# cross-compile to the requested $TARGETARCH with Go's own toolchain, rather
+# than running an emulated (QEMU) builder for foreign platforms. Multi-arch
+# GB200 UAT builds (linux/amd64,linux/arm64 on an amd64 runner) previously
+# executed the arm64 `go build` under emulation (~15 min); cross-compiling on
+# the native builder brings it back to native speed. The final distroless stage
+# is a COPY-only layer, so it needs no emulation for the target arch.
 ARG GO_VERSION=1.26.3
-FROM golang:${GO_VERSION}-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -30,7 +37,8 @@ COPY pkg/ pkg/
 COPY recipes/ recipes/
 COPY validators/ validators/
 
-RUN CGO_ENABLED=0 go build -o /out/deployment ./validators/deployment
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /out/deployment ./validators/deployment
 
 FROM nvcr.io/nvidia/distroless/static:v4.0.0@sha256:d90158b69e250d2018f32622b5c622925202ee97224a990a54b63811cb1e3d69
 

validators/performance/Dockerfile

@@ -12,8 +12,15 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Pin the builder stage to the build host's native arch ($BUILDPLATFORM) and
+# cross-compile to the requested $TARGETARCH with Go's own toolchain, rather
+# than running an emulated (QEMU) builder for foreign platforms. Multi-arch
+# GB200 UAT builds (linux/amd64,linux/arm64 on an amd64 runner) previously
+# executed the arm64 `go build` under emulation (~15 min); cross-compiling on
+# the native builder brings it back to native speed. The final distroless stage
+# is a COPY-only layer, so it needs no emulation for the target arch.
 ARG GO_VERSION=1.26.3
-FROM golang:${GO_VERSION}-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bookworm AS builder
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -22,7 +29,8 @@ COPY pkg/ pkg/
 COPY validators/ validators/
 COPY recipes/ recipes/
 
-RUN CGO_ENABLED=0 go build -o /out/performance ./validators/performance
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /out/performance ./validators/performance
 
 FROM nvcr.io/nvidia/distroless/static:v4.0.0@sha256:d90158b69e250d2018f32622b5c622925202ee97224a990a54b63811cb1e3d69