workflows: build a multi-arch tasks container

Build a tasks container for arm64 in addition to amd64.

We do this by splitting the build process into multiple jobs.  For the
arm one, we make use of the arm runners from BuildJet.  At the end, we
write the manifest and upload that with the "public" tag name.

.github/workflows/build-tasks.yml

@@ -1,21 +1,70 @@
 name: build-tasks
+
 on:
   # this is meant to be run on an approved PR branch for convenience
   workflow_dispatch:
+
+# We derive a unique ID here to make sure that we don't get into a situation
+# where different runners pick different tags (eg: for builds near midnight, or
+# in different time zones).  The manifest job picks the final name.
+env:
+  tag: quay.io/cockpit/tasks
+  runid: ${{ github.run_id }}.${{ github.run_attempt }}
+
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        build:
+          - label: amd64
+            runner: buildjet-2vcpu-ubuntu-2204
+          - label: arm64
+            runner: buildjet-2vcpu-ubuntu-2204-arm
+
+    runs-on: ${{ matrix.build.runner }}
     environment: quay.io
     timeout-minutes: 30
+
     steps:
-      - name: Clone repository
+      -
+        name: Log in to container registry
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_BOTUSER }}
+          password: ${{ secrets.QUAY_TOKEN }}
+      -
+        name: Checkout
         uses: actions/checkout@v4
+      -
+        name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          tags: ${{ env.tag }}:${{ env.runid }}-${{ matrix.build.label }}
+          context: tasks/container
+          file: tasks/container/Containerfile
 
-      - name: Log into container registry
-        run: podman login -u ${{ secrets.QUAY_BOTUSER }} -p ${{ secrets.QUAY_TOKEN }} quay.io
+  manifest:
+    needs: build
 
-      - name: Build tasks container
-        run: make tasks-container
+    runs-on: buildjet-2vcpu-ubuntu-2204
+    environment: quay.io
+    timeout-minutes: 30
 
-      - name: Push container to registry
-        run: make tasks-push
+    steps:
+      -
+        name: Log in to container registry
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_BOTUSER }}
+          password: ${{ secrets.QUAY_TOKEN }}
+      -
+        name: Create manifest
+        run: |
+          TAG="${{ env.tag }}:$(date --iso-8601)"
+          docker manifest create "${TAG}" \
+              '${{ env.tag }}:${{ env.runid }}-amd64' \
+              '${{ env.tag }}:${{ env.runid }}-arm64'
+          docker manifest push "${TAG}"