From 01105f3d593e0468c94b1d864ccc1d076ec206ff Mon Sep 17 00:00:00 2001
From: Lorenzo Corallo <lorenzo.corallo@outlook.it>
Date: Tue, 11 Aug 2026 17:38:21 +0200
Subject: [PATCH 1/4] ci: publish multi-arch container images

---
 .github/workflows/docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b1c7c89..4cd9832 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -27,6 +27,6 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ghcr.io/polinetworkorg/admin:latest

From acba37f9633650e7ad74a916a7e482cc9048e839 Mon Sep 17 00:00:00 2001
From: Lorenzo Corallo <lorenzo.corallo@outlook.it>
Date: Tue, 11 Aug 2026 17:58:46 +0200
Subject: [PATCH 2/4] ci: build admin on native architecture runners

---
 .github/workflows/docker.yml | 42 ++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 4cd9832..b692c3e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,24 +9,52 @@ on:
 
 jobs:
   build:
-    name: Build
+    name: Build ${{ matrix.platform }}
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            suffix: amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            suffix: arm64
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@v2
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build the Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platform }}
           push: true
-          tags: ghcr.io/polinetworkorg/admin:latest
+          tags: ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-${{ matrix.suffix }}
+
+  manifest:
+    name: Publish multi-arch manifest
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish latest manifest
+        run: |
+          docker buildx imagetools create \
+            --tag ghcr.io/polinetworkorg/admin:latest \
+            ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-amd64 \
+            ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-arm64
+          docker buildx imagetools inspect ghcr.io/polinetworkorg/admin:latest

From 84c7a00f5a0714845c59e4baefca6042e5d33ae7 Mon Sep 17 00:00:00 2001
From: Lorenzo Corallo <lorenzo.corallo@outlook.it>
Date: Tue, 11 Aug 2026 18:09:05 +0200
Subject: [PATCH 3/4] ci: publish images only after main updates

---
 .github/workflows/docker.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b692c3e..2194bfb 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,16 +1,14 @@
 name: Docker Image CI
 on:
-  workflow_dispatch:
-  workflow_run:
-    workflows: [Test]
+  push:
     branches: [main]
-    types:
-      - completed
 
 jobs:
   build:
     name: Build ${{ matrix.platform }}
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    permissions:
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -44,6 +42,9 @@ jobs:
     name: Publish multi-arch manifest
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3

From 1ed5b58f309dafea8351cca14c1258c0a57f302f Mon Sep 17 00:00:00 2001
From: Lorenzo Corallo <lorenzo.corallo@outlook.it>
Date: Tue, 11 Aug 2026 18:29:35 +0200
Subject: [PATCH 4/4] ci: serialize container publication

---
 .github/workflows/docker.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2194bfb..b109860 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -3,6 +3,10 @@ on:
   push:
     branches: [main]
 
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build ${{ matrix.platform }}