ci: native dual-arch build on luxfi runners (GHCR)

.github/workflows/build.yml

@@ -1,34 +1,62 @@
-# Per-repo CI: build + push  image to GAR
-# On success, fires repository_dispatch to /universe
-# which updates the manifest and deploys.
-
 name: Build
 
 on:
   push:
     branches: [main, test, dev]
-    paths:
-      - 'cmd/**'
-      - 'pkg/**'
-      - 'go.mod'
-      - 'go.sum'
-      - 'Dockerfile'
   workflow_dispatch:
 
 permissions:
   contents: read
   packages: write
-  id-token: write
 
 jobs:
-  build:
-    uses: /universe/.github/workflows/build-service.yml@main
-    with:
-      service_key: mpc
-      app_name: mpc
-      app_type: backend
-      dockerfile: Dockerfile
-    secrets:
-      TOKEN_GITHUB_CICD: ${{ secrets.TOKEN_GITHUB_CICD }}
-      KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
-      KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
+  docker:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: luxfi-build-amd64
+          - arch: arm64
+            runner: luxfi-build-arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}-${{ matrix.arch }}
+          cache-from: type=gha,scope=${{ matrix.arch }}
+          cache-to: type=gha,scope=${{ matrix.arch }},mode=max
+
+  manifest:
+    needs: [docker]
+    if: always() && contains(needs.docker.result, 'success')
+    runs-on: luxfi-build-amd64
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/setup-buildx-action@v3
+      - run: |
+          IMAGE="ghcr.io/${{ github.repository }}"
+          BRANCH="${{ github.ref_name }}"
+          SOURCES=""
+          for ARCH in amd64 arm64; do
+            if docker buildx imagetools inspect "${IMAGE}:${BRANCH}-${ARCH}" >/dev/null 2>&1; then
+              SOURCES="${SOURCES} ${IMAGE}:${BRANCH}-${ARCH}"
+            fi
+          done
+          [ -z "$SOURCES" ] && exit 1
+          for TAG in "${BRANCH}" latest; do
+            docker buildx imagetools create -t "${IMAGE}:${TAG}" ${SOURCES}
+          done