beam-cloud · theonlypal · Jul 18, 2026
diff --git a/.github/workflows/dispatch-gateway-build.yml b/.github/workflows/dispatch-gateway-build.yml
@@ -21,7 +21,53 @@ permissions:
   contents: read
 
 jobs:
-  build_and_release_worker:
+  build_and_release_gateway:
+    environment: Release
+    name: build (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
+
+    steps:
+      - name: Checkout code
+        uses: actions/[email protected]
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_ROLE_GITHUB }}
+          aws-region: us-east-1
+
+      - name: Log in to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        id: login-ecr
+        with:
+          registry-type: public
+          mask-password: 'true'
+
+      - name: Build and push container image to Amazon ECR
+        uses: docker/build-push-action@v5
+        with:
+          file: ./docker/Dockerfile.gateway
+          push: true
+          tags: |
+            ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway:${{ inputs.tag }}-${{ matrix.arch }}
+          target: release
+          platforms: ${{ matrix.platform }}
+
+  publish_gateway_manifest:
+    needs: build_and_release_gateway
     environment: Release
     runs-on: ubuntu-latest
 
@@ -58,12 +104,12 @@ jobs:
           registry-type: public
           mask-password: 'true'
 
-      - name: Build and push container image to Amazon ECR
-        uses: docker/build-push-action@v5
-        with:
-          file: ./docker/Dockerfile.gateway
-          push: true
-          tags: |
-            ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway:${{ inputs.tag }}
-          target: release
-          platforms: linux/amd64
+      - name: Publish multi-platform image manifest
+        env:
+          IMAGE: ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway
+          TAG_NAME: ${{ inputs.tag }}
+        run: |
+          docker buildx imagetools create \
+            --tag "${IMAGE}:${TAG_NAME}" \
+            "${IMAGE}:${TAG_NAME}-amd64" \
+            "${IMAGE}:${TAG_NAME}-arm64"
diff --git a/.github/workflows/dispatcher-runner-build.yml b/.github/workflows/dispatcher-runner-build.yml
@@ -13,19 +13,28 @@ permissions:
   contents: read
 
 jobs:
-  build_and_release_worker:
+  build_and_release_runner:
     environment: Release
-    runs-on: ubuntu-latest
+    name: build (${{ matrix.image }}, ${{ matrix.architecture.platform }})
+    runs-on: ${{ matrix.architecture.runner }}
     strategy:
+      fail-fast: false
       matrix:
-        python-version: ['py38', 'py39', 'py310', 'py311', 'py312']
+        image: ['py38', 'py39', 'py310', 'py311', 'py312']
+        architecture:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4.1.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to Amazon ECR
         uses: aws-actions/amazon-ecr-login@v2
@@ -38,16 +47,47 @@ jobs:
           mask-password: 'true'
           registry-type: public
 
-      - name: Build and push Docker image for ${{ matrix.python-version }}
-        uses: docker/build-push-action@v4
+      - name: Build and push Docker image for ${{ matrix.image }}
+        uses: docker/build-push-action@v5
         with:
           context: .
           file: ./docker/Dockerfile.runner
           push: true
-          tags:  ${{ secrets.ECR_REGISTRY }}/beta9-runner:${{ matrix.python-version }}-${{ inputs.tag }}
-          target: ${{ matrix.python-version }}
+          tags: ${{ secrets.ECR_REGISTRY }}/beta9-runner:${{ matrix.image }}-${{ inputs.tag }}-${{ matrix.architecture.arch }}
+          target: ${{ matrix.image }}
+          platforms: ${{ matrix.architecture.platform }}
           load: false
-          registry: ${{ steps.login-ecr.outputs.registry }}
-          repository: ${{ steps.login-ecr.outputs.registry }}/beta9-runner
-          add_git_labels: true
-          tag_with_ref: true
+
+  publish_runner_manifests:
+    needs: build_and_release_runner
+    environment: Release
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ['py38', 'py39', 'py310', 'py311', 'py312']
+
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        id: login-ecr
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+        with:
+          mask-password: 'true'
+          registry-type: public
+
+      - name: Publish multi-platform image manifest
+        env:
+          IMAGE: ${{ secrets.ECR_REGISTRY }}/beta9-runner
+          IMAGE_TAG: ${{ matrix.image }}-${{ inputs.tag }}
+        run: |
+          docker buildx imagetools create \
+            --tag "${IMAGE}:${IMAGE_TAG}" \
+            "${IMAGE}:${IMAGE_TAG}-amd64" \
+            "${IMAGE}:${IMAGE_TAG}-arm64"
diff --git a/.github/workflows/release-gateway.yml b/.github/workflows/release-gateway.yml
@@ -18,6 +18,62 @@ jobs:
   build_and_release_gateway:
     if: startsWith(github.ref, 'refs/tags/gateway-') || inputs.app_version != ''
     environment: Release
+    name: build (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-24.04-arm
+
+    steps:
+      - name: Checkout code
+        uses: actions/[email protected]
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set version
+        id: set-version
+        run: |
+          if [[ ! -z "${{ inputs.app_version }}" ]]; then
+            echo "app_version=${{ inputs.app_version }}" >> $GITHUB_OUTPUT
+          else
+            echo "app_version=${GITHUB_REF_NAME#gateway-}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_ROLE_GITHUB }}
+          aws-region: us-east-1
+
+      - name: Log in to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        id: login-ecr
+        with:
+          registry-type: public
+          mask-password: 'true'
+
+      - name: Build and push gateway container image to Amazon ECR
+        uses: docker/build-push-action@v5
+        with:
+          file: ./docker/Dockerfile.gateway
+          push: true
+          tags: |
+            ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway:${{ steps.set-version.outputs.app_version }}-${{ matrix.arch }}
+          target: release
+          platforms: ${{ matrix.platform }}
+
+  publish_gateway_manifest_and_chart:
+    if: startsWith(github.ref, 'refs/tags/gateway-') || inputs.app_version != ''
+    needs: build_and_release_gateway
+    environment: Release
     runs-on: ubuntu-latest
 
     steps:
@@ -35,7 +91,7 @@ jobs:
       - name: Set version
         id: set-version
         run: |
-          if [[ ! -z "${{ inputs.app_version }}" ]]; then
+          if [[ -n "${{ inputs.app_version }}" ]]; then
             echo "app_version=${{ inputs.app_version }}" >> $GITHUB_OUTPUT
           else
             echo "app_version=${GITHUB_REF_NAME#gateway-}" >> $GITHUB_OUTPUT
@@ -62,16 +118,20 @@ jobs:
           registry-type: public
           mask-password: 'true'
 
-      - name: Build and push gateway container image to Amazon ECR
-        uses: docker/build-push-action@v5
-        with:
-          file: ./docker/Dockerfile.gateway
-          push: true
-          tags: |
-            ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway:${{ steps.set-version.outputs.app_version }}
-            ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway:latest
-          target: release
-          platforms: linux/amd64
+      - name: Publish multi-platform image manifests
+        env:
+          IMAGE: ${{ steps.login-ecr.outputs.registry }}/n4e0e1y0/beta9-gateway
+          TAG_NAME: ${{ steps.set-version.outputs.app_version }}
+        run: |
+          docker buildx imagetools create \
+            --tag "${IMAGE}:${TAG_NAME}" \
+            "${IMAGE}:${TAG_NAME}-amd64" \
+            "${IMAGE}:${TAG_NAME}-arm64"
+
+          docker buildx imagetools create \
+            --tag "${IMAGE}:latest" \
+            "${IMAGE}:${TAG_NAME}-amd64" \
+            "${IMAGE}:${TAG_NAME}-arm64"
 
       - name: Package and push Helm chart to Amazon ECR
         env: