Merge remote-tracking branch 'upstream/main' into use-ls-rust

Author: davidlion

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/actions/clp-build-runtime-image/action.yaml

@@ -21,6 +21,10 @@ inputs:
     description: "Platform VERSION_ID / VERSION_CODENAME of the container
       (e.g. jammy, focal, etc.)"
     required: false
+  arch:
+    description: "Target architecture (amd64 or arm64)"
+    default: "amd64"
+    required: false
 
 runs:
   using: "composite"
@@ -29,7 +33,7 @@ runs:
       uses: "docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2"
 
     - name: "Login to Image Registry"
-      uses: "docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772"
+      uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
       with:
         registry: "${{inputs.image_registry}}"
         username: "${{inputs.image_registry_username}}"
@@ -61,13 +65,32 @@ runs:
       with:
         images: "${{inputs.image_registry}}/${{steps.sanitization.outputs.REPOSITORY}}\
           /${{steps.compute-meta.outputs.IMAGE_NAME}}"
+        flavor: |
+          suffix=-${{inputs.arch}}
+
+    - name: "Map arch to Docker platform"
+      id: "map-arch"
+      shell: "bash"
+      run: |
+        if [ "${{inputs.arch}}" = "arm64" ]; then
+          echo "platform=linux/arm64" >> "$GITHUB_OUTPUT"
+        elif [ "${{inputs.arch}}" = "amd64" ]; then
+          echo "platform=linux/amd64" >> "$GITHUB_OUTPUT"
+        else
+          echo >&2 "ERROR: Unsupported arch '${{inputs.arch}}'. Must be 'amd64' or 'arm64'."
+          exit 1
+        fi
 
     - name: "Build and Push"
       if: "github.event_name != 'pull_request' && github.ref == 'refs/heads/main'"
       uses: "docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4"
       with:
         context: "./"
         file: "${{steps.compute-meta.outputs.DOCKERFILE}}"
+        platforms: "${{steps.map-arch.outputs.platform}}"
+        # Disable provenance to create a simple image instead of a manifest list.
+        # This allows `docker manifest create` to combine the per-arch images later.
+        provenance: false
         push: true
         tags: "${{steps.extract-gh-meta.outputs.tags}}"
         labels: "${{steps.extract-gh-meta.outputs.labels}}"