From c77a180b630163aa24cb74a337c97c9b93dcdcb8 Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Fri, 3 Apr 2026 20:10:29 -0500
Subject: [PATCH] try matrix builds

---
 .tangled/workflows/release.yml | 58 +++++++++++++++++++++++++++-------
 1 file changed, 47 insertions(+), 11 deletions(-)

diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index 731a2b0..6e55264 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -1,5 +1,5 @@
 # ATCR Release Pipeline for Tangled.org
-# Triggers on version tags and builds cross-platform binaries using buildah
+# Builds multi-arch container images (amd64 + arm64) and creates manifest lists
 
 when:
   - event: ["push"]
@@ -7,7 +7,7 @@ when:
 
 engine: kubernetes
 image: quay.io/buildah/stable:latest
-architecture: amd64
+architecture: [amd64, arm64]
 
 environment:
   IMAGE_REGISTRY: atcr.io
@@ -23,22 +23,58 @@ steps:
 
   - name: Build and push AppView image
     command: |
+      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
       buildah bud \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME} \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest \
+        --tag "${TAG}" \
         --file ./Dockerfile.appview \
         .
-
-      buildah push \
-        ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest
+      buildah push "${TAG}"
+      mkdir -p /artifacts
+      echo "${TAG}" > /artifacts/appview.txt
 
   - name: Build and push Hold image
     command: |
+      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
       buildah bud \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME} \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest \
+        --tag "${TAG}" \
         --file ./Dockerfile.hold \
         .
+      buildah push "${TAG}"
+      echo "${TAG}" > /artifacts/hold.txt
 
-      buildah push \
-        ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest
+  - name: Build and push Scanner image
+    command: |
+      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/scanner:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
+      buildah bud \
+        --tag "${TAG}" \
+        --file ./Dockerfile.scanner \
+        .
+      buildah push "${TAG}"
+      echo "${TAG}" > /artifacts/scanner.txt
+
+final:
+  architecture: amd64
+  image: quay.io/buildah/stable:latest
+  steps:
+    - name: Login to registry
+      command: |
+        echo "${APP_PASSWORD}" | buildah login \
+          -u "${IMAGE_USER}" \
+          --password-stdin \
+          ${IMAGE_REGISTRY}
+
+    - name: Create and push multi-arch manifests
+      command: |
+        for IMAGE in appview hold scanner; do
+          FULL="${IMAGE_REGISTRY}/${IMAGE_USER}/${IMAGE}"
+
+          AMD64_TAG=$(cat /artifacts/amd64/${IMAGE}.txt)
+          ARM64_TAG=$(cat /artifacts/arm64/${IMAGE}.txt)
+
+          buildah manifest create "${FULL}:${TANGLED_REF_NAME}"
+          buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "docker://${AMD64_TAG}"
+          buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "docker://${ARM64_TAG}"
+          buildah manifest push --all "${FULL}:${TANGLED_REF_NAME}" "docker://${FULL}:${TANGLED_REF_NAME}"
+
+          buildah manifest push --all "${FULL}:${TANGLED_REF_NAME}" "docker://${FULL}:latest"
+        done