Fixing a buildx related issue with multi platform support

Author: Prakash

.github/workflows/build-and-publish.yml

@@ -12,7 +12,7 @@ env:
   NODE_VERSION: '22'
 
 jobs:
-  test-and-lint:
+  lint-and-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -42,7 +42,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
   build-and-publish:
-    needs: test-and-lint
+    needs: lint-and-test
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
@@ -84,44 +84,38 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Build image locally without pushing
-      - name: Build multi-arch image locally
+      # Build and push to a temporary tag for scanning
+      - name: Build and push multi-arch image (temp)
         uses: docker/build-push-action@v5
         with:
           context: .
           file: package/docker/Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: false
-          load: true
+          push: true
           tags: |
-            ${{ env.IMAGE_NAME }}:local-scan
+            ${{ env.IMAGE_NAME }}:scan-${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      # Scan the local image before pushing
+      # Scan the pushed image
       - name: Scan Docker image for vulnerabilities
         uses: aquasecurity/trivy-action@0.30.0
         with:
-          image-ref: '${{ env.IMAGE_NAME }}:local-scan'
+          image-ref: '${{ env.IMAGE_NAME }}:scan-${{ github.sha }}'
           format: 'table'
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
 
-      # Only push if security scan passes
-      - name: Push multi-arch image
+      # If scan passes, tag the image with final tags
+      - name: Tag image with final tags
         if: success()
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: package/docker/Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ${{ env.IMAGE_NAME }}:latest
-            ${{ env.IMAGE_NAME }}:${{ github.sha }}
-            ${{ env.IMAGE_NAME }}:v${{ steps.package-version.outputs.version }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+        run: |
+          # Tag the scanned image with final tags
+          docker buildx imagetools create \
+            --tag ${{ env.IMAGE_NAME }}:latest \
+            --tag ${{ env.IMAGE_NAME }}:${{ github.sha }} \
+            --tag ${{ env.IMAGE_NAME }}:v${{ steps.package-version.outputs.version }} \
+            ${{ env.IMAGE_NAME }}:scan-${{ github.sha }}
       
       # This step dispatches an event to the utils repo to trigger downstream deployments
       - name: Repository Dispatch