Build arm64 images

[cigamit]

The arm64 build of Ascender needs an arm64 build of the EE. This should resolve that.

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the release and “latest” build workflows to publish multi-architecture (amd64 + arm64) container images for Ascender EE by building each architecture natively and then combining them into multi-arch manifests in GHCR.

Changes:

• Split image builds into an amd64 + arm64 matrix using native runners and push arch-suffixed tags.
• Add a follow-up job to create/push multi-arch manifests for the release tag (and latest) via docker buildx imagetools create.
• Apply the same pattern for scheduled / main-branch “latest” builds.

File summaries

File	Description
.github/workflows/release.yml	Builds/pushes per-arch release images and then publishes multi-arch release + latest manifests.
.github/workflows/build-latest.yml	Builds/pushes per-arch latest images and then publishes a multi-arch latest manifest.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/build-latest.yml:53

• docker login to GHCR with secrets.GITHUB_TOKEN is expected to use the workflow actor as the username; using github.repository_owner can fail for org-owned repos. Prefer ${{ github.actor }} here.

This issue also appears on line 62 of the same file.

        run: |
         echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
         docker push ghcr.io/${{ github.repository_owner }}/ascender-ee:latest-${{ matrix.arch }}

.github/workflows/release.yml:47

• docker login to GHCR with secrets.GITHUB_TOKEN is expected to use the workflow actor as the username; using github.repository_owner can fail for org-owned repos. Prefer ${{ github.actor }} here.

This issue also appears on line 57 of the same file.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

.github/workflows/build-latest.yml:62

• Same as above: prefer ${{ github.actor }} as the GHCR username when authenticating with secrets.GITHUB_TOKEN.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

.github/workflows/release.yml:57

• Same as above: prefer ${{ github.actor }} as the GHCR username when authenticating with secrets.GITHUB_TOKEN.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Review details

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/release.yml:47

• For GHCR auth with GITHUB_TOKEN, GitHub’s recommended username is ${{ github.actor }} (not the repository owner). Using the owner can fail in org/repo contexts where the token is scoped to the workflow actor/app.

This issue also appears on line 57 of the same file.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

.github/workflows/build-latest.yml:60

• For GHCR auth with GITHUB_TOKEN, use ${{ github.actor }} as the docker login username (GitHub’s documented approach). Using the repository owner can be brittle when the actor is a bot/user different from the owner.

This issue also appears on line 70 of the same file.

         echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

.github/workflows/release.yml:57

• For GHCR auth with GITHUB_TOKEN, use ${{ github.actor }} as the docker login username to match GitHub’s documented pattern and avoid auth edge cases.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

.github/workflows/build-latest.yml:70

• For GHCR auth with GITHUB_TOKEN, use ${{ github.actor }} as the docker login username to align with GitHub’s recommended configuration.

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/release.yml:56

• This job relies on docker buildx imagetools being available on the runner, but the workflow never initializes Buildx. Adding an explicit docker/setup-buildx-action step makes the manifest publish more reliable across runner image changes.

    steps:
      - name: Push multi-arch manifests
        run: |

.github/workflows/build-latest.yml:69

• This job uses docker buildx imagetools create but never sets up Buildx, which can make the manifest publish step brittle if runner images change. Consider initializing Buildx explicitly via docker/setup-buildx-action.

    steps:
      - name: Push multi-arch manifest
        run: |

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite