ci: multi-arch docker image

Author: githubflyideas

.github/workflows/docker.yml

@@ -0,0 +1,53 @@
+# 放到 .github/workflows/docker.yml
+# 需要：仓库 Variables 里设 DOCKERHUB_USER；Secrets 里设 DOCKERHUB_TOKEN（Docker Hub Access Token）
+name: docker
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write   # 推 GHCR 用
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            docker.io/${{ vars.DOCKERHUB_USER }}/json-ping
+            ghcr.io/${{ github.repository_owner }}/json-ping
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: VERSION=${{ github.ref_name }}
+          provenance: false   # 避免部分平台（如 RouterOS）解析 manifest 时遇到 attestation 条目
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -0,0 +1,34 @@
+# syntax=docker/dockerfile:1
+# JSON-PING multi-arch image: linux/amd64, linux/arm64, linux/arm/v7
+# Go 交叉编译在构建机原生架构上完成，不走 QEMU 模拟，速度快。
+
+ARG GO_VERSION=1.26          # 与 go.mod 保持一致
+
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build
+ARG TARGETOS TARGETARCH TARGETVARIANT
+ARG VERSION=dev
+WORKDIR /src
+COPY . .
+# TARGETVARIANT 形如 v7 → GOARM=7；amd64/arm64 时为空，无影响
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GOARM=${TARGETVARIANT#v} \
+    go build -trimpath -tags timetzdata \
+      -ldflags="-s -w -X main.version=${VERSION}" \
+      -o /out/json-ping . \
+ && mkdir -p /out/data
+
+FROM scratch
+# HTTPS 告警（webhook）需要 CA 证书；时区数据已通过 timetzdata 编进二进制
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /out/json-ping /json-ping
+# scratch 里无法 mkdir/chown，数据目录在构建阶段建好再带权限拷入
+COPY --from=build --chown=65532:65532 /out/data /data
+
+VOLUME /data
+EXPOSE 8080
+USER 65532:65532
+
+# scratch 没有 curl/wget，需要二进制自带 healthcheck 子命令
+HEALTHCHECK --interval=30s --timeout=3s CMD ["/json-ping", "healthcheck"]
+
+ENTRYPOINT ["/json-ping"]
+CMD ["-data", "/data", "-listen", ":8080"]