[jsokol]

Why

The minimal publish takes about 88 minutes: 3 PHP variants x {amd64, arm64} built one after another in a single job, with arm64 emulated by QEMU. Per-step timings from the 2026-10-27 run (publish-testing, run 40561303824) show where it goes. For one variant:

	amd64 (native)	arm64 (QEMU)
docker-php-ext-configure/install (PHP extension compile)	1.6 min	24.3 min
apt-get update/install	0.4 min	2.7 min
all steps summed	~2.4 min	~27.5 min

A native arm64 leg should take about the amd64 time (~2.5 min of build work plus export and runner setup). Estimate: ~10-15 min total instead of 88; not measured on a real arm runner yet.

What changes (publish-testing.yml only)

• build-minimal: matrix {php83, php84, php85} x {amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm}. Each leg builds only its own architecture, no QEMU, and pushes by digest (no tag), uploading the digest as an artifact.
• merge-minimal: per variant, docker buildx imagetools create points the real tags at one multi-arch index, then fails unless every tag carries both linux/amd64 and linux/arm64.
• scan-minimal: one Grype leg per variant (same action, same published-minimal-php8x labels; fail-fast: false so all three reports upload).
• promote: needs all three scans, then the same single SSM write as before. A critical finding still blocks the promote.
• grype_report now depends on scan-minimal and publish-full.
• New workflow_dispatch input dry_run: builds, merges and scans under <VERSION>-nativetest-php8x only. It never moves the bare <VERSION> tag or :testing and skips the promote.

Unchanged

Triggers, concurrency group, the tag set (<VERSION>-php83/-php84/-php85, bare <VERSION> and :testing on php85), the bundle fetch + sha256 verification, the context assembly, the full-stack job, and the published image shape (amd64 + arm64 + 2 attestation manifests). It is still one tag per image: the per-arch images exist only as untagged digests referenced by the index, and GA still promotes the index digest.

Verification

• actionlint: clean.
• The merge-and-verify commands, run verbatim against a local registry with two single-arch images built with the same attestation setting: all three tags resolve to the same index digest, each lists linux/amd64 + linux/arm64, and the index has 2 attestation manifests, matching simplerisk/simplerisk-minimal:20261020-001-php85 on Docker Hub.
• Not run: a real build on ubuntu-24.04-arm, the Grype matrix, or the dry-run path. Nothing here has executed in Actions yet.

Open questions / risks

• Is ubuntu-24.04-arm available to this repo? The repo is public, so GitHub's free arm runners should apply, but org runner settings were not readable to confirm.
• The testing environment only admits the testing branch, so the first run cannot happen from this branch. Plan: merge, then dispatch from testing with dry_run=true and check the -nativetest- tags (both architectures, scans green), then let the next normal push be the first live run. This PR stays a draft until that is agreed.
• Cache scopes are now per architecture, so the first native run starts cold.
• The 3 build matrices fail fast: one failed leg cancels the rest and nothing is merged or promoted.
• Reverting is a single revert of this PR.

Follow-up (not in this PR)

An arm64 smoke test after the merge (for example, exercising set_db_ssl_flags against the arm64 image's own mysql) would have caught the MariaDB-client flag problem fixed in #180.

🤖 Generated with Claude Code