fix(build): cross-compile Docker images instead of emulating with QEMU (#2339)

The multi-arch release build ran the full Rust release build, the
cgo-linked Go build, and go mod download under QEMU for linux/arm64,
making the docker publish job take hours on an amd64 runner.

Builder stages are now pinned to the build platform and cross-compile
to TARGETARCH: diffgen via rustup target aarch64-unknown-linux-gnu and
the Go binary via GOARCH/CC with the aarch64 cross toolchain. Only the
small final runtime stage runs under emulation.

Also fetch cargo dependencies from the manifests alone so the layer
survives diffgen source changes, and build both release platforms in
the PR workflow so cross-compilation breakage surfaces before release.

Author: adityathebe

.github/workflows/build.yml

@@ -6,7 +6,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
@@ -30,7 +30,12 @@ jobs:
           difference=$((final_space - initial_space))
           echo "Disk space difference (in KB): $difference"
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      # Build both release platforms so PRs catch cross-compilation breakage
+      # before it reaches the release workflow
       - name: Build Container
-        run: make docker
+        run: docker buildx build --platform linux/amd64,linux/arm64 -f build/Dockerfile .
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

build/Dockerfile

@@ -1,29 +1,71 @@
-FROM rust:bookworm@sha256:29fe4376919e25b7587a1063d7b521d9db735fc137d3cf30ae41eb326d209471 AS rust-builder-base
-COPY external/diffgen/ /app/external/diffgen
-RUN cd /app/external/diffgen/ && cargo fetch
+## Builder stages run on the build platform and cross-compile to TARGETARCH,
+## so multi-arch builds don't pay for QEMU emulation of cargo/rustc/go.
+FROM --platform=$BUILDPLATFORM rust:bookworm@sha256:29fe4376919e25b7587a1063d7b521d9db735fc137d3cf30ae41eb326d209471 AS rust-builder-base
+WORKDIR /app/external/diffgen
+COPY external/diffgen/Cargo.toml external/diffgen/Cargo.lock ./
+## cargo fetch only needs the manifests; a stub lib.rs keeps this layer
+## cached across source-only changes
+RUN mkdir -p src && touch src/lib.rs && cargo fetch
 
 FROM rust-builder-base AS rust-builder
+ARG BUILDARCH
+ARG TARGETARCH
+ENV CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc \
+    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
+RUN case "$TARGETARCH" in \
+    amd64) echo x86_64-unknown-linux-gnu > /rust-target ;; \
+    arm64) echo aarch64-unknown-linux-gnu > /rust-target ;; \
+    *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac && \
+    rustup target add "$(cat /rust-target)" && \
+    if [ "$BUILDARCH" != "$TARGETARCH" ]; then \
+    apt-get update && \
+    case "$TARGETARCH" in \
+    amd64) apt-get install -y --no-install-recommends gcc-x86-64-linux-gnu libc6-dev-amd64-cross ;; \
+    arm64) apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu libc6-dev-arm64-cross ;; \
+    esac && \
+    rm -rf /var/lib/apt/lists/*; \
+    fi
+COPY external/diffgen/src ./src
+## cgo links target/release/libdiffgen.a by fixed path, so place the
+## cross-compiled staticlib where a native build would put it
+RUN cargo build --release --target "$(cat /rust-target)" && \
+    mkdir -p target/release && \
+    cp "target/$(cat /rust-target)/release/libdiffgen.a" target/release/libdiffgen.a
+
+FROM --platform=$BUILDPLATFORM golang:1.26-bookworm@sha256:4f4ab2c90005e7e63cb631f0b4427f05422f241622ee3ec4727cc5febbf83e34 AS builder-base
 WORKDIR /app
-COPY Makefile /app
-COPY external/diffgen /app/external/diffgen
-RUN make rust-diffgen
-
-FROM golang:1.26-bookworm@sha256:4f4ab2c90005e7e63cb631f0b4427f05422f241622ee3ec4727cc5febbf83e34 AS builder-base
-WORKDIR /app
-
-ARG VERSION
 
 COPY go.mod /app/go.mod
 COPY go.sum /app/go.sum
 RUN go mod download
 
 FROM builder-base AS builder
 
+ARG VERSION
+ARG BUILDARCH
+ARG TARGETARCH
+RUN if [ "$BUILDARCH" != "$TARGETARCH" ]; then \
+    apt-get update && \
+    case "$TARGETARCH" in \
+    amd64) apt-get install -y --no-install-recommends gcc-x86-64-linux-gnu libc6-dev-amd64-cross ;; \
+    arm64) apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu libc6-dev-arm64-cross ;; \
+    *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; \
+    esac && \
+    rm -rf /var/lib/apt/lists/*; \
+    fi
+
 COPY ./ ./
 
-COPY --from=rust-builder /app/external/diffgen/target ./external/diffgen/target
+COPY --from=rust-builder /app/external/diffgen/target/release ./external/diffgen/target/release
 
-RUN make build-prod
+RUN if [ "$BUILDARCH" != "$TARGETARCH" ]; then \
+    case "$TARGETARCH" in \
+    amd64) export CC=x86_64-linux-gnu-gcc ;; \
+    arm64) export CC=aarch64-linux-gnu-gcc ;; \
+    esac; \
+    fi && \
+    CGO_ENABLED=1 GOOS=linux GOARCH="$TARGETARCH" make build-prod
 
 FROM flanksource/base-image:0.7.1@sha256:5e819e83199855d20ba5b988e8a6f369c6f4332fa6f07c184c99838d06a77cc8