Updated PR for arm64 Support

.github/actions/build-and-push-image/action.yaml

@@ -4,16 +4,19 @@ inputs:
   image-flavor:
     description: A flavor used to tag the apollo-ci image.
     required: true
+  arch:
+    description: Arch for image build (amd64 or arm64). Leave empty for single-arch amd64 mode without suffix.
+    required: false
 outputs:
   image-tag:
     description: The full image tag that was built and pushed
     value: ${{ steps.build-and-push.outputs.image-tag }}
 runs:
   using: composite
   steps:
-    - name: Build and push image
+    - name: Build and push ${{ inputs.arch }} image
       id: build-and-push
       run: |
         .github/actions/build-and-push-image/build-and-push-image.sh \
-          "${{ inputs.image-flavor }}"
+          "${{ inputs.image-flavor }}" "${{ inputs.arch }}"
       shell: bash

.github/actions/build-and-push-image/build-and-push-image.sh

@@ -4,13 +4,22 @@ set -euo pipefail
 
 build_and_push_image() {
     local image_flavor="$1"
+    local target_arch="$2"
+    local tag_suffix=""
+
+    # Default to amd64 if no architecture specified and do not add arch suffix.
+    if [ -z "${target_arch}" ]; then
+        target_arch="amd64"
+    else
+        tag_suffix="-${target_arch}"
+    fi
 
     docker login -u "$QUAY_STACKROX_IO_RW_USERNAME" --password-stdin <<<"$QUAY_STACKROX_IO_RW_PASSWORD" quay.io
 
-    TAG="$(scripts/get_tag.sh "${image_flavor}")"
+    TAG="$(scripts/get_tag.sh "$image_flavor")${tag_suffix}"
     IMAGE="quay.io/stackrox-io/apollo-ci:${TAG}"
 
-    make "${image_flavor}-image"
+    make TARGETARCH="$target_arch" "$image_flavor"-image
 
     retry 5 true docker push "${IMAGE}"
 

.github/actions/create-multiarch-manifest/action.yml

@@ -0,0 +1,48 @@
+name: Create and push a multiarch manifest
+description: |
+  This action will create a multiarch manifest and push it to a remote registry.
+
+inputs:
+  base-image:
+    description:
+      The base image to used for the manifest
+    required: true
+  image-flavor:
+    description:
+      The image flavor tag to be used for the manifest
+    required: true
+  suffix:
+    description:
+      Optional suffix for the tags used and the manifest
+    default: ''
+  archs:
+    description:
+      Architectures to be included in the final manifest, separated by a space
+    default: 'amd64 arm64'
+outputs:
+  image-tag:
+    description:
+      The full multiarch manifest tag that was created and pushed
+    value: ${{ steps.create-and-push-manifest.outputs.image-tag}}
+
+runs:
+  using: composite
+  steps:
+    - id: create-and-push-manifest
+      shell: bash
+      run: |
+        image_flavor="${{ inputs.image-flavor }}"
+        tag="$(scripts/get_tag.sh ${image_flavor})"
+        read -ra archs <<< "${{ inputs.archs }}"
+        declare -a images=()
+        for arch in "${archs[@]}"; do
+          images+=("${{ inputs.base-image }}:${tag}-${arch}${{ inputs.suffix }}")
+        done
+
+        image_tag="${{ inputs.base-image }}:${tag}${{ inputs.suffix }}"
+
+        docker manifest create "${image_tag}" "${images[@]}"
+        docker manifest push "${image_tag}"
+
+        echo "image-tag=${image_tag}" >> "${GITHUB_OUTPUT}"
+

.github/actions/save-image-info/action.yaml

@@ -0,0 +1,23 @@
+name: Save image info
+description: Save image tag to artifact for later reference
+inputs:
+  image-tag:
+    description: The image tag to save
+    required: true
+  name:
+    description: Base name for both artifact and file (e.g., 'stackrox-build-amd64')
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Save image info
+      run: |
+        mkdir -p image-info
+        echo "${{ inputs.image-tag }}" > "image-info/${{ inputs.name }}.txt"
+      shell: bash
+    - name: Upload image info
+      uses: actions/upload-artifact@v4
+      with:
+        name: image-info-${{ inputs.name }}
+        path: image-info/${{ inputs.name }}.txt
+        retention-days: 1

.github/workflows/build.yaml

@@ -15,75 +15,150 @@ env:
 
 jobs:
 
-  build-and-push-builder-images:
+  multiarch-build-images:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: ./.github/actions/build-and-push-image
+        id: build-and-push-image
+        with:
+          image-flavor: "stackrox-build"
+          arch: ${{ matrix.arch }}
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.build-and-push-image.outputs.image-tag }}
+          name: stackrox-build-${{ matrix.arch }}
+
+  multiarch-test-images:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    needs:
+      - multiarch-build-images
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: ./.github/actions/build-and-push-image
+        id: build-and-push-image
+        with:
+          image-flavor: "stackrox-test"
+          arch: ${{ matrix.arch }}
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.build-and-push-image.outputs.image-tag }}
+          name: stackrox-test-${{ matrix.arch }}
+
+  multiarch-manifests:
+    runs-on: ubuntu-latest
+    needs:
+      - multiarch-build-images
+      - multiarch-test-images
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Login to quay.io/stackrox-io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
+          password: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
+
+      - uses: ./.github/actions/create-multiarch-manifest
+        id: stackrox-build-manifest
+        with:
+          base-image: quay.io/stackrox-io/apollo-ci
+          image-flavor: stackrox-build
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.stackrox-build-manifest.outputs.image-tag }}
+          name: stackrox-build-multiarch
+
+      - uses: ./.github/actions/create-multiarch-manifest
+        id: stackrox-test-manifest
+        with:
+          base-image: quay.io/stackrox-io/apollo-ci
+          image-flavor: stackrox-test
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.stackrox-test-manifest.outputs.image-tag }}
+          name: stackrox-test-multiarch
+
+  amd64-build-images:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         image-flavor:
           - scanner-build
-          - stackrox-build
           - stackrox-ui-test
           - jenkins-plugin
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-and-push-image
         id: build-and-push-image
         with:
           image-flavor: "${{ matrix.image-flavor }}"
-      - name: Save image info
-        run: |
-          mkdir -p image-info
-          echo "${{ steps.build-and-push-image.outputs.image-tag }}" > "image-info/${{ matrix.image-flavor }}.txt"
-      - name: Upload image info
-        uses: actions/upload-artifact@v4
-        with:
-          name: image-info-${{ matrix.image-flavor }}
-          path: image-info/${{ matrix.image-flavor }}.txt
-          retention-days: 1
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.build-and-push-image.outputs.image-tag }}
+          name: ${{ matrix.image-flavor }}
 
-  build-and-push-test-images:
-    needs: build-and-push-builder-images
+  amd64-test-images:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        image-flavor:
-          - stackrox-test
-          - scanner-test
-      fail-fast: false
+    needs:
+      - amd64-build-images
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: ./.github/actions/build-and-push-image
         id: build-and-push-image
         with:
-          image-flavor: "${{ matrix.image-flavor }}"
-      - name: Save image info
-        run: |
-          mkdir -p image-info
-          echo "${{ steps.build-and-push-image.outputs.image-tag }}" > "image-info/${{ matrix.image-flavor }}.txt"
-      - name: Upload image info
-        uses: actions/upload-artifact@v4
-        with:
-          name: image-info-${{ matrix.image-flavor }}
-          path: image-info/${{ matrix.image-flavor }}.txt
-          retention-days: 1
+          image-flavor: "scanner-test"
+      - uses: ./.github/actions/save-image-info
+        with:
+          image-tag: ${{ steps.build-and-push-image.outputs.image-tag }}
+          name: scanner-test
 
   test-cci-export:
     runs-on: ubuntu-latest
     needs:
-      - build-and-push-builder-images
-      - build-and-push-test-images
+      - amd64-build-images
+      - amd64-test-images
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
@@ -95,8 +170,11 @@ jobs:
   comment-build-images:
     runs-on: ubuntu-latest
     needs:
-      - build-and-push-builder-images
-      - build-and-push-test-images
+      - multiarch-build-images
+      - multiarch-test-images
+      - multiarch-manifests
+      - amd64-build-images
+      - amd64-test-images
     steps:
       - name: Download all image info artifacts
         uses: actions/download-artifact@v4

Makefile

@@ -4,12 +4,22 @@ endif
 QUAY_REPO=stackrox-io
 
 STACKROX_BUILD_TAG=$(shell scripts/get_tag.sh "stackrox-build")
+TARGETARCH?=amd64
+
+ifeq ($(TARGETARCH),amd64)
+  TARGETARCH_ALT = x86_64
+else ifeq ($(TARGETARCH),arm64)
+  TARGETARCH_ALT = aarch64
+else
+  TARGETARCH_ALT = $(TARGETARCH)
+endif
 
 .PHONY: stackrox-build-image
 stackrox-build-image:
 	$(DOCKER) build \
-		--platform linux/amd64 \
+		--platform linux/$(TARGETARCH) \
 		-t quay.io/$(QUAY_REPO)/apollo-ci:$(STACKROX_BUILD_TAG) \
+		-t quay.io/$(QUAY_REPO)/apollo-ci:$(STACKROX_BUILD_TAG)-$(TARGETARCH) \
 		-f images/stackrox-build.Dockerfile \
 		images/
 
@@ -18,9 +28,11 @@ STACKROX_TEST_TAG=$(shell scripts/get_tag.sh "stackrox-test")
 .PHONY: stackrox-test-image
 stackrox-test-image:
 	$(DOCKER) build \
-		--platform linux/amd64 \
+		--platform linux/$(TARGETARCH) \
 		-t quay.io/$(QUAY_REPO)/apollo-ci:$(STACKROX_TEST_TAG) \
-		--build-arg BASE_TAG=$(STACKROX_BUILD_TAG) \
+		-t quay.io/$(QUAY_REPO)/apollo-ci:$(STACKROX_TEST_TAG)-$(TARGETARCH) \
+		--build-arg BASE_TAG=$(STACKROX_BUILD_TAG)-$(TARGETARCH) \
+		--build-arg TARGETARCH_ALT=$(TARGETARCH_ALT) \
 		-f images/stackrox-test.Dockerfile \
 		images/
 
@@ -40,7 +52,7 @@ test-cci-export:
 	$(DOCKER) build \
 		--platform linux/amd64 \
 		-t test-cci-export \
-		--build-arg BASE_TAG=$(STACKROX_TEST_TAG) \
+		--build-arg BASE_TAG=$(STACKROX_TEST_TAG)-amd64 \
 		-f images/test.cci-export.Dockerfile \
 		images/
 	$(DOCKER) run \