feat: arm64 xgoreleaser docker image

[aeneasr]

No description provided.

[Copilot]

Pull request overview

Adds arm64 support for the oryd/xgoreleaser Docker image by making the image build architecture-aware, updating the embedded toolchains, and extending CI to build/test/publish for both amd64 and arm64.

Changes:

• Update the Dockerfile to download the correct GoReleaser binaries per target architecture and install arch-specific musl toolchains.
• Adjust build.tmpl.yml to use explicitly prefixed compilers for amd64 (glibc + musl) builds.
• Update GitHub Actions workflows to build/test on amd64 + arm64 and publish multi-arch images via a manifest job.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
build.tmpl.yml	Switches amd64 CC values to explicit, prefixed toolchain binaries.
Dockerfile	Makes GoReleaser/toolchain setup depend on TARGETARCH and adds arm64-specific musl sysroot/compiler setup.
.github/workflows/docker-test.yml	Runs PR build/test on both amd64 and arm64 runners.
.github/workflows/docker-publish.yml	Builds/pushes per-arch images and creates/pushes multi-arch manifests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

arch="${{ matrix.platform##*/}}" is not valid GitHub Actions expression syntax (the ##*/ parameter expansion is Bash-only). This will fail workflow parsing or produce an empty value, resulting in incorrect tags. Compute arch in Bash from ${{ matrix.platform }} (e.g., assign the platform string first, then use shell parameter expansion), or define arch as a separate matrix field.

Suggested change

	arch="${{ matrix.platform##*/}}"
	platform="${{ matrix.platform }}"
	arch="${platform##*/}"

[Copilot]

The Dockerfile now hard-fails if TARGETARCH is unset. TARGETARCH is only guaranteed when building with BuildKit/buildx; if someone builds with the legacy builder (or with BuildKit disabled), ${TARGETARCH} will be empty and the case will exit 1. Consider adding a robust fallback (e.g., derive the arch from dpkg --print-architecture/uname -m) or defaulting safely so local docker build keeps working.

Suggested change

	RUN case "${TARGETARCH}" in \
	amd64) GR_ARCH=x86_64 ;; \
	arm64) GR_ARCH=arm64 ;; \
	*) echo "Unsupported TARGETARCH: ${TARGETARCH}"; exit 1 ;; \
	esac \
	&& curl -LO https://github.com/goreleaser/goreleaser/releases/download/v${GORELEASER_VERSION}/goreleaser_Linux_${GR_ARCH}.tar.gz \
	&& mkdir -p goreleaser_Linux_${GR_ARCH} \
	&& tar -xvf goreleaser_Linux_${GR_ARCH}.tar.gz -C goreleaser_Linux_${GR_ARCH} \
	&& mv goreleaser_Linux_${GR_ARCH}/goreleaser /usr/local/bin/goreleaser-oss \
	&& rm -rf goreleaser_Linux_${GR_ARCH}.* goreleaser_Linux_${GR_ARCH}/
	RUN case "${TARGETARCH}" in \
	amd64) GR_ARCH=x86_64 ;; \
	arm64) GR_ARCH=arm64 ;; \
	*) echo "Unsupported TARGETARCH: ${TARGETARCH}"; exit 1 ;; \
	esac \
	RUN ARCH="${TARGETARCH}" \
	&& if [ -z "${ARCH}" ]; then \
	if command -v dpkg >/dev/null 2>&1; then \
	ARCH="$(dpkg --print-architecture)"; \
	else \
	ARCH="$(uname -m)"; \
	fi; \
	fi \
	&& case "${ARCH}" in \
	amd64|x86_64) GR_ARCH=x86_64 ;; \
	arm64|aarch64) GR_ARCH=arm64 ;; \
	*) echo "Unsupported architecture: ${ARCH}"; exit 1 ;; \
	esac \
	&& curl -LO https://github.com/goreleaser/goreleaser/releases/download/v${GORELEASER_VERSION}/goreleaser_Linux_${GR_ARCH}.tar.gz \
	&& mkdir -p goreleaser_Linux_${GR_ARCH} \
	&& tar -xvf goreleaser_Linux_${GR_ARCH}.tar.gz -C goreleaser_Linux_${GR_ARCH} \
	&& mv goreleaser_Linux_${GR_ARCH}/goreleaser /usr/local/bin/goreleaser-oss \
	&& rm -rf goreleaser_Linux_${GR_ARCH}.* goreleaser_Linux_${GR_ARCH}/
	RUN ARCH="${TARGETARCH}" \
	&& if [ -z "${ARCH}" ]; then \
	if command -v dpkg >/dev/null 2>&1; then \
	ARCH="$(dpkg --print-architecture)"; \
	else \
	ARCH="$(uname -m)"; \
	fi; \
	fi \
	&& case "${ARCH}" in \
	amd64|x86_64) GR_ARCH=x86_64 ;; \
	arm64|aarch64) GR_ARCH=arm64 ;; \
	*) echo "Unsupported architecture: ${ARCH}"; exit 1 ;; \
	esac \

[Copilot]

The curl commands here download goreleaser binaries from GitHub and immediately extract and install them without any checksum or signature verification. If an attacker compromises DNS/TLS, the release assets, or the GitHub repository, they could serve a malicious binary that runs in the build environment and compromises all produced artifacts. Add integrity verification (e.g., pinned checksums or GPG signature verification) for the goreleaser archives before extraction, or vendor the binaries, to ensure only trusted code is executed.