feat(ci): split docker platforms speed up docker build time

Author: lockwobr

.github/workflows/operator-ci.yaml

@@ -177,17 +177,60 @@ jobs:
           file: operator/reporting/cover.out
           format: golang
 
-  # Build multi-platform container image and push to registry
-  build-and-push-operator:
+  # Compute image tags and version metadata once for reuse
+  compute-metadata:
     runs-on: ubuntu-latest
-    needs: [tests] # Don't run the build and push if tests fail
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    needs: [tests]
+    outputs:
+      git-sha: ${{ steps.meta.outputs.git-sha }}
+      version: ${{ steps.meta.outputs.version }}
+      tags: ${{ steps.meta.outputs.tags }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Fetch all tags
+        run: git fetch --tags --force
+      - name: Compute metadata
+        id: meta
+        run: |
+          export GIT_SHA=$(git rev-parse --short ${{ github.sha }})
+          echo "git-sha=${GIT_SHA}" >> $GITHUB_OUTPUT
+          
+          case ${{ github.ref_type }} in
+            branch)
+                export VERSION=$(git tag --list 'operator*' --sort=-v:refname | head -n 1 | cut -d/ -f2)+${GIT_SHA}
+                TAGS="${GIT_SHA} $(echo "${VERSION}" | tr + -)"
+                ;;
+            tag)
+                export VERSION=$(echo "${{ github.ref_name }}" | cut -f 2 -d /)
+                TAGS="${GIT_SHA} ${VERSION} latest"
+                ;;
+            *)
+                echo "Unknown ref type: ${{ github.ref_type }}"
+                exit 1
+                ;;
+          esac
+          
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
+          echo "📦 Version: ${VERSION}"
+          echo "🏷️  Tags: ${TAGS}"
+
+  # Build container images on native architecture runners (much faster than QEMU)
+  build-operator:
+    runs-on: ${{ matrix.runner }}
+    needs: [compute-metadata]
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
     permissions:
       contents: read
       packages: write
       attestations: write
       id-token: write
-      # 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -199,60 +242,95 @@ jobs:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      
-      # Setup for multi-platform builds (linux/amd64, linux/arm64)
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      # Build and tag container image based on git ref type
-      - name: Build the operator container image
+      # Build and tag container image for single platform on native hardware
+      - name: Build the operator container image (${{ matrix.platform }})
         id: build
         env:
-          platforms: ${{ env.PLATFORMS }}
+          GIT_SHA: ${{ needs.compute-metadata.outputs.git-sha }}
+          VERSION: ${{ needs.compute-metadata.outputs.version }}
         run: |
-          apt-get update && apt-get install -y make git jq
+          sudo apt-get update && sudo apt-get install -y jq
           cd operator
-          # if this is a tag build, use the tag as the version, otherwise use the sha
-          git fetch --all
-          export GIT_SHA=$(git rev-parse --short ${{ github.sha }})
-          TAGS="-t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${GIT_SHA}"
-          case ${{ github.ref_type }} in
-            branch)
-                # The last tag + current git sha
-                export OPERATOR_VERSION=$(git tag --list 'operator*' --sort=-v:refname | head -n 1 | cut -d/ -f2)+${GIT_SHA}
-                TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:$(echo "${OPERATOR_VERSION}" | tr + -)"
-                ;;
-            tag)
-                # The version part of the tag
-                export OPERATOR_VERSION=$(echo "${{ github.ref_name }}" | cut -f 2 -d /)
-                TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${OPERATOR_VERSION} -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:latest"
-                ;;
-            *)
-                echo "Unkown type ${{ github.ref_type }}"
-                exit 1
-                ;;
-          esac
+          PLATFORM_TAG=$(echo "${{ matrix.platform }}" | tr '/' '-')
+          
+          # Build platform-specific tags for all target tags
+          TAGS=""
+          for TAG in ${{ needs.compute-metadata.outputs.tags }}; do
+            TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${TAG}-${PLATFORM_TAG}"
+          done
+          
           set -x
           docker buildx build \
             --build-arg GIT_SHA=${GIT_SHA} \
-            --build-arg VERSION=${OPERATOR_VERSION} \
-            --build-arg GO_VERSION=${GO_VERSION} \
+            --build-arg VERSION=${VERSION} \
+            --build-arg GO_VERSION=${{ env.GO_VERSION }} \
             --push \
-            --platform ${{ env.PLATFORMS }} \
+            --platform ${{ matrix.platform }} \
+            --provenance=false \
             ${TAGS@L} \
             --metadata-file=metadata.json \
             -f ../containers/operator.Dockerfile .
-          cat metadata.json
+          
           echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
-          cat $GITHUB_OUTPUT
+
+  # Create multi-platform manifest from individual architecture builds
+  create-manifest:
+    runs-on: ubuntu-latest
+    needs: [compute-metadata, build-operator]
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      
+      # Create and push multi-platform manifests, then delete platform-specific tags
+      - name: Create manifests and cleanup
+        id: manifest
+        run: |
+          # Create manifest for each tag combining amd64 and arm64 images
+          for TAG in ${{ needs.compute-metadata.outputs.tags }}; do
+            FULL_TAG="${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${TAG}"
+            echo "📦 Creating manifest for $FULL_TAG"
+            docker manifest create $FULL_TAG \
+              ${FULL_TAG}-linux-amd64 \
+              ${FULL_TAG}-linux-arm64
+            docker manifest push $FULL_TAG
+            echo "✅ Pushed $FULL_TAG"
+          done
+          
+          # Get digest of the main tag (git sha) for attestation
+          MAIN_TAG="${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${{ needs.compute-metadata.outputs.git-sha }}"
+          DIGEST=$(docker manifest inspect $MAIN_TAG | jq -r .manifests[0].digest)
+          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
+          
+          # Clean up platform-specific tags to avoid confusion
+          echo "🗑️  Cleaning up platform-specific tags..."
+          for TAG in ${{ needs.compute-metadata.outputs.tags }}; do
+            for PLATFORM in linux-amd64 linux-arm64; do
+              PLATFORM_TAG="${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${TAG}-${PLATFORM}"
+              echo "Deleting ${PLATFORM_TAG}"
+              docker run --rm quay.io/skopeo/stable:latest delete \
+                --creds ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} \
+                docker://${PLATFORM_TAG} 2>&1 || echo "  (tag may not exist)"
+            done
+          done
+          echo "✅ Cleanup complete"
       
-      # Generate supply chain security attestation
+      # Generate supply chain security attestation for the multi-platform manifest
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@v2
         with:
           subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/operator
-          subject-digest: ${{ steps.build.outputs.digest }}
+          subject-digest: ${{ steps.manifest.outputs.digest }}
           push-to-registry: true