Address pr feedback.

Author: fnando

.github/workflows/docker.yml

@@ -2,8 +2,6 @@
 name: Docker
 
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
     inputs:
       ref:
@@ -23,11 +21,9 @@ jobs:
     strategy:
       matrix:
         include:
-          - platform: linux/amd64
-            runs-on: ubuntu-latest
+          - runs-on: ubuntu-latest
             arch: amd64
-          - platform: linux/arm64
-            runs-on: ubuntu-24.04-arm
+          - runs-on: ubuntu-24.04-arm
             arch: arm64
     runs-on: ${{ matrix.runs-on }}
     permissions:
@@ -43,61 +39,15 @@ jobs:
       - name: Build binary
         run: cargo build --package stellar-cli --release
 
-      - name: Copy binary for Docker context
-        run: cp target/release/stellar stellar
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-
-      - name: Log in to Docker Hub
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      # Validation only — build without pushing.
-      - name: Build
-        if: github.event_name == 'push'
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          push: false
-          cache-from: type=gha,scope=${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
-
-      # Publish — push by digest so the merge job can assemble the manifest.
-      - name: Build and push by digest
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
-        id: build
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,name=stellar/cli,push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
-
-      - name: Upload digest
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-
-      - name: Upload digest artifact
-        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
+      - name: Upload binary
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: digest-${{ matrix.arch }}
-          path: /tmp/digests/*
-          if-no-files-found: error
+          name: stellar-${{ matrix.arch }}
+          path: target/release/stellar
           retention-days: 1
 
-  merge:
+  docker:
     needs: build
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -107,6 +57,30 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.ref }}
           fetch-depth: 0
 
+      - name: Download binaries
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: stellar-*
+          merge-multiple: false
+
+      - name: Stage binaries for Docker context
+        run: |
+          mv stellar-amd64/stellar stellar-amd64
+          mv stellar-arm64/stellar stellar-arm64
+          chmod +x stellar-amd64 stellar-arm64
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       # Compute Docker tags from the ref.
       # - Version tag (e.g. v1.2.3): push versioned + latest tags.
       # - Any other ref: push a tag for the resolved commit SHA.
@@ -125,30 +99,10 @@ jobs:
             echo "DOCKER_TAGS=stellar/cli:${commit}" >> $GITHUB_ENV
           fi
 
-      - name: Download digests
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-        with:
-          path: /tmp/digests
-          pattern: digest-*
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
+      - name: Build and push
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Create and push manifest
-        working-directory: /tmp/digests
-        run: |
-          tag_args=""
-          IFS=',' read -ra tag_list <<< "$DOCKER_TAGS"
-          for tag in "${tag_list[@]}"; do
-            tag_args+=" --tag ${tag}"
-          done
-
-          docker buildx imagetools create $tag_args \
-            $(printf 'stellar/cli@sha256:%s ' *)
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ env.DOCKER_TAGS }}

Dockerfile

@@ -6,7 +6,8 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends dbus gnome-keyring libdbus-1-3 libudev1 libssl3 && \
     rm -rf /var/lib/apt/lists/*
 
-COPY stellar /usr/local/bin/stellar
+ARG TARGETARCH
+COPY stellar-${TARGETARCH} /usr/local/bin/stellar
 
 ENV STELLAR_CONFIG_HOME=/config
 ENV STELLAR_DATA_HOME=/data