fix: Add Cross.toml for aarch64 sysroot, OCI labels for GHCR, metadata-action for proper tagging

Author: rahulbsw

.github/workflows/release.yml

@@ -65,18 +65,28 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             asset_name: streamforge-linux-x86_64
-          - os: ubuntu-22.04
+
+          - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu
             asset_name: streamforge-linux-aarch64
+
           - os: macos-latest
             target: aarch64-apple-darwin
             asset_name: streamforge-macos-aarch64
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install system dependencies (Linux)
-        if: runner.os == 'Linux'
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install system dependencies (Linux x86_64)
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -100,23 +110,17 @@ jobs:
           echo "OPENSSL_DIR=$(brew --prefix openssl@3)" >> $GITHUB_ENV
           echo "PKG_CONFIG_PATH=$(brew --prefix openssl@3)/lib/pkgconfig:$(brew --prefix cyrus-sasl)/lib/pkgconfig" >> $GITHUB_ENV
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
+      - name: Build (native — x86_64 and macOS)
+        if: matrix.target != 'aarch64-unknown-linux-gnu'
+        run: cargo build --release --locked --target ${{ matrix.target }}
 
-      - name: Build release binary
-        run: |
-          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
-            cross build --release --locked --target ${{ matrix.target }}
-          else
-            cargo build --release --locked --target ${{ matrix.target }}
-          fi
+      - name: Build (cross — Linux aarch64)
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        env:
+          PKG_CONFIG_ALLOW_CROSS: "1"
+        run: cross build --release --locked --target ${{ matrix.target }}
 
-      - name: Strip binary
+      - name: Strip binary (native only)
         if: matrix.target != 'aarch64-unknown-linux-gnu'
         run: strip target/${{ matrix.target }}/release/streamforge
 
@@ -132,6 +136,9 @@ jobs:
     name: Build and Push Docker Images
     runs-on: ubuntu-latest
     continue-on-error: true
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
 
@@ -148,11 +155,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version
-        id: version
-        run: |
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_OUTPUT
+      - name: Extract metadata (tags and labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}},value=${{ github.event.inputs.tag || github.ref_name }}
+            type=raw,value=latest
 
       - name: Build and push multi-arch Docker image
         uses: docker/build-push-action@v5
@@ -161,16 +171,18 @@ jobs:
           file: ./Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
-          tags: |
-            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.VERSION }}
-            ghcr.io/${{ github.repository }}:latest
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
   build-operator-image:
     name: Build and Push Operator Image
     runs-on: ubuntu-latest
     continue-on-error: true
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
 
@@ -187,11 +199,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract version
-        id: version
-        run: |
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_OUTPUT
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}-operator
+          tags: |
+            type=semver,pattern={{version}},value=${{ github.event.inputs.tag || github.ref_name }}
+            type=raw,value=latest
 
       - name: Build and push Operator image
         uses: docker/build-push-action@v5
@@ -200,8 +215,7 @@ jobs:
           file: ./operator/Dockerfile
           push: true
           platforms: linux/amd64,linux/arm64
-          tags: |
-            ghcr.io/${{ github.repository }}-operator:${{ steps.version.outputs.VERSION }}
-            ghcr.io/${{ github.repository }}-operator:latest
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

Cross.toml

@@ -0,0 +1,11 @@
+[target.aarch64-unknown-linux-gnu]
+pre-build = [
+    "dpkg --add-architecture $CROSS_DEB_ARCH",
+    "apt-get update && apt-get install -y --no-install-recommends libssl-dev:$CROSS_DEB_ARCH libsasl2-dev:$CROSS_DEB_ARCH libzstd-dev:$CROSS_DEB_ARCH libcurl4-openssl-dev:$CROSS_DEB_ARCH pkg-config"
+]
+
+[build.env]
+passthrough = [
+    "PKG_CONFIG_ALLOW_CROSS",
+    "CARGO_TERM_COLOR"
+]

Dockerfile

@@ -35,6 +35,10 @@ RUN touch src/main.rs && \
 # Stage 2: Runtime
 FROM cgr.dev/chainguard/rust:latest
 
+LABEL org.opencontainers.image.source="https://github.com/rahulbsw/streamforge"
+LABEL org.opencontainers.image.description="High-performance Kafka streaming toolkit"
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
 # Copy binary from builder
 COPY --from=builder /build/target/release/streamforge /usr/local/bin/streamforge