# ===============================================================
# Multiplatform Docker Build Workflow
# ===============================================================
#
# This workflow builds container images for multiple architectures:
# - linux/amd64 (native on ubuntu-latest)
# - linux/arm64 (native on ubuntu-24.04-arm)
# - linux/s390x (QEMU emulation on ubuntu-latest)
#
# Pipeline:
# 1. Build platform images in parallel
# 2. Create multiplatform manifest
# 3. Sign and attest with Cosign (keyless OIDC)
#
# Linting and security scanning are handled by docker-scan.yml
#
# ===============================================================
name: Multiplatform Docker Build
on:
push:
branches: ["main"]
paths:
- 'Containerfile.lite'
- 'mcpgateway/**'
- 'plugins/**'
- 'pyproject.toml'
- '.github/workflows/docker-multiplatform.yml'
pull_request:
branches: ["main"]
paths:
- 'Containerfile.lite'
- 'mcpgateway/**'
- 'plugins/**'
- 'pyproject.toml'
- '.github/workflows/docker-multiplatform.yml'
schedule:
- cron: "17 18 * * 2" # Weekly rebuild (Tuesday 18:17 UTC) for CVE patches
workflow_dispatch:
inputs:
platforms:
description: 'Platforms to build (comma-separated)'
required: false
default: 'linux/amd64,linux/arm64,linux/s390x'
permissions:
contents: read
packages: write
actions: read
id-token: write
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
# ---------------------------------------------------------------
# Build each platform in parallel
# ---------------------------------------------------------------
build:
name: Build ${{ matrix.suffix }}
strategy:
fail-fast: false
matrix:
include:
- platform: linux/amd64
runner: ubuntu-latest
suffix: amd64
- platform: linux/arm64
runner: ubuntu-24.04-arm
suffix: arm64
- platform: linux/s390x
runner: ubuntu-latest
suffix: s390x
qemu: true
runs-on: ${{ matrix.runner }}
steps:
- name: Checkout code
uses: actions/checkout@v5
- name: Set image name lowercase
run: |
IMAGE_NAME_LC=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
echo "IMAGE_NAME_LC=${IMAGE_NAME_LC}" >> $GITHUB_ENV
- name: Set up QEMU
if: matrix.qemu
uses: docker/setup-qemu-action@v3
with:
platforms: ${{ matrix.platform }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to GHCR
if: github.event_name != 'pull_request'
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
tags: |
type=raw,value=${{ matrix.suffix }}-${{ github.sha }}
- name: Build and push
id: build
uses: docker/build-push-action@v6
with:
context: .
file: Containerfile.lite
platforms: ${{ matrix.platform }}
push: ${{ github.event_name != 'pull_request' }}
load: ${{ github.event_name == 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha,scope=build-${{ matrix.suffix }}
cache-to: type=gha,mode=max,scope=build-${{ matrix.suffix }}
provenance: false
- name: Export digest
if: github.event_name != 'pull_request'
run: |
mkdir -p /tmp/digests
digest="${{ steps.build.outputs.digest }}"
touch "/tmp/digests/${digest#sha256:}"
echo "Digest for ${{ matrix.suffix }}: $digest"
- name: Upload digest
if: github.event_name != 'pull_request'
uses: actions/upload-artifact@v4
with:
name: digest-${{ matrix.suffix }}
path: /tmp/digests/*
if-no-files-found: error
retention-days: 1
# ---------------------------------------------------------------
# Create multiplatform manifest
# ---------------------------------------------------------------
manifest:
name: Create Manifest
needs: build
runs-on: ubuntu-latest
if: github.event_name != 'pull_request'
steps:
- name: Set image name lowercase
run: |
IMAGE_NAME_LC=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
echo "IMAGE_NAME_LC=${IMAGE_NAME_LC}" >> $GITHUB_ENV
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Create and push manifest
run: |
SHA=${{ github.sha }}
IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
echo "Creating multiplatform manifest..."
docker buildx imagetools create \
--tag "${IMAGE}:${SHA}" \
--tag "${IMAGE}:latest" \
"${IMAGE}:amd64-${SHA}" \
"${IMAGE}:arm64-${SHA}" \
"${IMAGE}:s390x-${SHA}"
echo "Manifest created successfully"
- name: Inspect manifest
run: |
IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
echo "Inspecting multiplatform manifest..."
docker buildx imagetools inspect "${IMAGE}:latest"
# ---------------------------------------------------------------
# Sign images with Cosign (keyless OIDC)
# ---------------------------------------------------------------
sign:
name: Sign Images
needs: manifest
runs-on: ubuntu-latest
if: github.event_name != 'pull_request'
steps:
- name: Set image name lowercase
run: |
IMAGE_NAME_LC=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
echo "IMAGE_NAME_LC=${IMAGE_NAME_LC}" >> $GITHUB_ENV
- name: Install Cosign
uses: sigstore/cosign-installer@v3
- name: Log in to GHCR
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Pull image for SBOM generation
run: |
docker pull --platform linux/amd64 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:latest
- name: Generate SBOM (Syft)
uses: anchore/sbom-action@v0
with:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:latest
output-file: sbom.spdx.json
- name: Sign and attest multiplatform image
env:
COSIGN_EXPERIMENTAL: "1"
run: |
IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
SHA=${{ github.sha }}
for REF in "${IMAGE}:latest" "${IMAGE}:${SHA}"; do
echo "Signing ${REF}"
cosign sign --recursive --yes "${REF}"
echo "Attesting SBOM for ${REF}"
cosign attest --yes \
--predicate sbom.spdx.json \
--type spdxjson \
"${REF}"
done
echo "Images signed and attested successfully"
