Splitting arm/amd tags for operator and target allocator

[Paramadon]

Split Multi-Architecture Image Builds for Better Security Scanning

Problem

Currently, our operator and target allocator images are built as multi-architecture images, making it difficult to scan individual architecture images

Solution

Split the build process into three parts:

1. Build individual architecture images
2. Create manifest lists
3. Clean up old images

Passing run: https://github.com/aws/amazon-cloudwatch-agent-operator/actions/runs/14673842807/job/41186231945

Flow Change

Before:

graph TD
    A[Build Multi-Arch Image] --> B[Push to ECR]
    B --> C[Release]

Loading

After:

graph TD
    A1[Build AMD64 Image] --> B1[Push AMD64 to ECR]
    A2[Build ARM64 Image] --> B2[Push ARM64 to ECR]
    B1 --> C1[Security Scan AMD64]
    B2 --> C2[Security Scan ARM64]
    C1 --> D[Create Manifest List]
    C2 --> D
    D --> E[Release]

Loading

Changes

1. Split image builds:
   • staging-linux-amd64 for AMD64 architecture
   • staging-linux-arm64 for ARM64 architecture
   • Manifest list pointing to both architectures

Testing

• Built and verified AMD64 images
• Built and verified ARM64 images
• Created and verified manifest lists
• Tested image pulls for both architectures
• Verified security scanning works for individual architectures

Verification

[lisguo]

instead of having a separate workflow just to obtain build args...I was thinking of a workflow to build the operator and it takes in an input for arch or tag.

I'd prefer the previous iteration over this

[Paramadon]

Ahh I see, I reverted it to the previous iteration.

[agarakan]

Docker has a multi-tag feature thats also useful to prevent need for re-building a new image just to add the new tag. Not blocking comment

docker manifest create \
  ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ inputs.tag }} \
  ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ github.sha }} \
  --amend ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ inputs.tag }}-linux-amd64 \
  --amend ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ inputs.tag }}-linux-arm64

docker manifest push ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ inputs.tag }}
docker manifest push ${{ env.ECR_TARGET_ALLOCATOR_STAGING_REPO }}:${{ github.sha }}

[lisguo]

why are we making a /bin directory here?