fix: use buildx imagetools for multi-arch manifest creation

docker manifest create cannot handle OCI image indexes produced by
the docker-container buildx driver. Switch to docker buildx imagetools
create which handles them natively.

Extract manifest logic into reusable docker-manifest composite action.

Author: mchmarny

.github/actions/docker-manifest/action.yml

@@ -0,0 +1,50 @@
+# Copyright (c) 2025, NVIDIA CORPORATION.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: 'Create Docker Multi-Arch Manifest'
+description: 'Combines per-arch images into multi-arch manifests with standard version tags'
+
+inputs:
+  image:
+    description: 'Full image name without tag (e.g. ghcr.io/nvidia/eidos-validator)'
+    required: true
+  tag:
+    description: 'Release tag (e.g. v0.5.11)'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2  # v3.10.0
+
+    - name: Create and push manifests
+      shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        TAG: ${{ inputs.tag }}
+      run: |
+        set -euo pipefail
+
+        # Extract major and minor versions (e.g., v0.5.11 -> v0, v0.5)
+        MAJOR="v$(echo "$TAG" | sed 's/^v//' | cut -d. -f1)"
+        MAJOR_MINOR="v$(echo "$TAG" | sed 's/^v//' | cut -d. -f1-2)"
+
+        for MANIFEST_TAG in "$TAG" "$MAJOR" "$MAJOR_MINOR" "latest"; do
+          docker buildx imagetools create \
+            -t "$IMAGE:$MANIFEST_TAG" \
+            "$IMAGE:$TAG-amd64" \
+            "$IMAGE:$TAG-arm64"
+          echo "Pushed manifest: $IMAGE:$MANIFEST_TAG"
+        done

.github/workflows/on-tag.yaml

@@ -220,31 +220,17 @@ jobs:
       contents: read
       packages: write
     steps:
-      - name: Authenticate to registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+      - name: Checkout Code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Create and push manifests
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
+      - name: Authenticate to registry
+        uses: ./.github/actions/ghcr-login
 
-          # Extract major and minor versions (e.g., v0.5.7 -> v0, v0.5)
-          MAJOR="v$(echo "$TAG" | sed 's/^v//' | cut -d. -f1)"
-          MAJOR_MINOR="v$(echo "$TAG" | sed 's/^v//' | cut -d. -f1-2)"
-
-          # Create and push manifest for each tag
-          for MANIFEST_TAG in "$TAG" "$MAJOR" "$MAJOR_MINOR" "latest"; do
-            docker manifest create --amend "$VALIDATOR_IMAGE:$MANIFEST_TAG" \
-              "$VALIDATOR_IMAGE:$TAG-amd64" \
-              "$VALIDATOR_IMAGE:$TAG-arm64"
-            docker manifest push "$VALIDATOR_IMAGE:$MANIFEST_TAG"
-            echo "Pushed manifest: $VALIDATOR_IMAGE:$MANIFEST_TAG"
-          done
+      - name: Create multi-arch manifest
+        uses: ./.github/actions/docker-manifest
+        with:
+          image: ${{ env.VALIDATOR_IMAGE }}
+          tag: ${{ github.ref_name }}
 
   # =============================================================================
   # Publish: Flip draft release to public after all artifacts are ready