ci: fix arm64 build

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
-name: Test fast (no changes to Dockerfile)
-
+name: Test
 on:
   pull_request:
   merge_group:
@@ -11,73 +10,33 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
-jobs:
-  check-container:
-    runs-on: ubuntu-latest
-    outputs:
-      exists: ${{ steps.check.outputs.exists }}
-    steps:
-      - name: Check if Docker image exists
-        id: check
-        run: |
-          if docker manifest inspect cometbft/cometbft-db-testing:v1.0.3 &>/dev/null; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
 
+jobs:
   test-fast:
-    needs: check-container
-    if: needs.check-container.outputs.exists == 'true'
-    runs-on: ubuntu-latest
-    container: cometbft/cometbft-db-testing:v1.0.3
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Configure Git Safe Directory
-        run: git config --global --add safe.directory /__w/cometbft-db/cometbft-db
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: test & coverage report creation
-        run: |
-          NON_INTERACTIVE=1 make test-all-with-coverage
-
-      - uses: codecov/codecov-action@v4
-        with:
-          file: ./coverage.txt
-
-  test-slow:
-    needs: check-container
-    if: needs.check-container.outputs.exists == 'false'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Build
-        uses: docker/setup-buildx-action@v3.8.0
-        with:
-          driver: docker
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Build Docker image (arm64) to ensure it works
-        uses: docker/build-push-action@v6
-        with:
-          context: ./tools
-          file: ./tools/Dockerfile.arm64
-          platforms: linux/arm64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - name: Build Docker image (amd64) to be used in the next step
+      - name: Build and load
         uses: docker/build-push-action@v6
         with:
-          context: ./tools
+          platforms: ${{ matrix.platform }}
           file: ./tools/Dockerfile
-          tags: "cometbft/cometbft-db-testing:latest"
-          platforms: linux/amd64
+          tags: "${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest"
           load: true
 
       - name: test & coverage report creation

.github/workflows/codeql.yml

@@ -10,7 +10,6 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
-
 on:
   workflow_dispatch:  # allow running workflow manually
   push:

.github/workflows/conventional-pr-title.yml

@@ -1,5 +1,4 @@
 name: "Conventional PR Title"
-
 on:
   pull_request_target:
     types:

.github/workflows/docker.yml

@@ -1,62 +1,88 @@
-# This workflow builds and pushes a new version of the build container image
-# when the tools directory changes on main. Edit tools/Dockerfile.
-#
-# This workflow does not push a new image until it is merged, so tests that
-# depend on changes in this image will not pass until this workflow succeeds.
-# For that reason, changes here should be done in a separate PR in advance of
-# work that depends on them.
-#
-# To build the test image locally, run:
-#   make docker-test-image
-
-name: Docker testing image
+name: Build Docker Image
 on:
-  workflow_dispatch:  # allow running workflow manually
+  workflow_dispatch:
     inputs:
-      refName:
-        description: 'Git ref name'
+      tag:
+        description: "The tag of the image to build"
         required: true
-        default: 'main'
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"               # Push events to matching v*, i.e. v1.0, v20.15.10
-      - "v[0-9]+.[0-9]+.[0-9]+-alpha.[0-9]+"  # e.g. v0.37.0-alpha.1, v0.38.0-alpha.10
-      - "v[0-9]+.[0-9]+.[0-9]+-beta.[0-9]+"   # e.g. v0.37.0-beta.1, v0.38.0-beta.10
-      - "v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+"      # e.g. v0.37.0-rc1, v0.38.0-rc10
+        type: string
+      is_latest:
+        description: "Push as latest?"
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
+  GIT_TAG: "${{ inputs.tag }}"
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  build-image-at-tag:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    outputs:
+      digest-${{ matrix.platform }}: ${{ steps.build.outputs.digest }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: "${{ env.GIT_TAG }}"
+          fetch-depth: 0
 
-      - name: Set up Docker Build
-        uses: docker/setup-buildx-action@v3.8.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Publish to Docker Hub (amd64)
+      - name: Build and push image
+        id: build
         uses: docker/build-push-action@v6
         with:
-          context: ./tools
+          platforms: ${{ matrix.platform }}
           file: ./tools/Dockerfile
-          platforms: linux/amd64
-          push: true
           tags: |
-            cometbft/cometbft-db-testing:latest
-            cometbft/cometbft-db-testing:${{ github.event.inputs.refName }}
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ env.GIT_TAG }}
+          push: true
 
-      - name: Publish to Docker Hub (arm64)
-        uses: docker/build-push-action@v6
+  merge:
+    runs-on: ubuntu-latest
+    needs: build-image-at-tag
+    steps:
+      - name: Get sanitized Docker tag
+        run: echo "DOCKER_TAG=$(echo $GIT_TAG | sed 's/[^a-zA-Z0-9\.]/-/g')" >> $GITHUB_ENV
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
         with:
-          context: ./tools
-          file: ./tools/Dockerfile.arm64
-          platforms: linux/arm64
-          push: true
-          tags: |
-            cometbft/cometbft-db-testing:latest
-            cometbft/cometbft-db-testing:${{ github.event.inputs.refName }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Create Multi-Arch Manifest
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.ORG }}/${{ env.IMAGE_NAME }}:${{ env.DOCKER_TAG }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/amd64 }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/arm64 }}
+
+      - name: Tag and Push Latest (if applicable)
+        if: ${{ inputs.is_latest == true }}
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/amd64 }} \
+            ${{ env.ORG }}/${{ env.IMAGE_NAME }}@${{ needs.build-image-at-tag.outputs.digest-linux/arm64 }}

.github/workflows/lint.yml

@@ -1,5 +1,4 @@
 name: Lint
-
 on:
   pull_request:
   merge_group:
@@ -11,23 +10,27 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+env:
+  ORG: cometbft
+  IMAGE_NAME: cometbft-db-testing
+
 jobs:
   golangci:
-    # We need to run the linter on the same image we use for building, since it
-    # needs the C libraries installed for the dependencies to typecheck.
     runs-on: ubuntu-latest
-    container: cometbft/cometbft-db-testing
     steps:
       - uses: actions/checkout@v4
 
-      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - uses: actions/setup-go@v5
+      - name: Build and load
+        uses: docker/build-push-action@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          platforms: ${{ matrix.platform }}
+          file: ./tools/Dockerfile
+          tags: "${{ env.ORG }}/${{ env.IMAGE_NAME }}:latest"
+          load: true
 
-      - uses: golangci/golangci-lint-action@v6.2.0
-        with:
-          args: --timeout 10m
-          version: latest
-          github-token: ${{ secrets.github_token }}
+      - name: lint
+        run: |
+          NON_INTERACTIVE=1 make docker-lint

Makefile

@@ -91,6 +91,15 @@ docker-test:
 		make test-all-with-coverage
 .PHONY: docker-test
 
+docker-lint:
+	@docker run $(DOCKER_TEST_INTERACTIVE_FLAGS) --rm --name cometbft-db-test \
+		-v `pwd`:/cometbft \
+		-w /cometbft \
+		--entrypoint "" \
+		$(DOCKER_TEST_IMAGE):$(DOCKER_TEST_IMAGE_VERSION) \
+		make lint
+.PHONY: docker-lint
+
 #? tools: Install tools
 tools:
 	go get -v $(GOTOOLS)

RELEASES.md

@@ -11,5 +11,7 @@ DB.
    branch.
 5. Create a [GitHub release] from the new tag, and include a link from the
    description to the heading associated with the new version in the changelog.
+6. Build and push the Docker image associated with the new release by running
+   `Build Docker Image` GH action with the newly created tag `vX.X.X`.
 
 [GitHub release]: https://docs.github.com/en/github/administering-a-repository/releasing-projects-on-github/managing-releases-in-a-repository#creating-a-release

tools/Dockerfile

@@ -1,15 +1,3 @@
-# This file defines the container image used to build and test tm-db in CI.
-# The CI workflows use the latest tag of cometbft/cometbft-db-testing built
-# from these settings.
-#
-# The jobs defined in the Build & Push workflow will build and update the image
-# when changes to this file are merged.  If you have other changes that require
-# updates here, merge the changes here first and let the image get updated (or
-# push a new version manually) before PRs that depend on them.
-
-# PLEASE BUMP THE VERSION OF THE IMAGE IN `.github/workflows/ci.yml` WHEN YOU
-# MODIFY THIS FILE.
-
 FROM golang:1.23.6
 
 ENV LD_LIBRARY_PATH=/usr/local/lib