feat: native multi-platform builds via runner matrix (no QEMU emulation)

action.yml

@@ -66,6 +66,12 @@ inputs:
   cacheTo:
     required: false
     description: Specify the image to cache the built image to
+  platformTag:
+    required: false
+    description: 'Tag suffix for this platform build (e.g., "linux-amd64"). Used in matrix builds to push per-platform images that are later merged.'
+  mergeTag:
+    required: false
+    description: 'Comma-separated list of platform tags to merge into a multi-arch manifest (e.g., "linux-amd64,linux-arm64"). Used in the merge job after matrix builds complete.'
 outputs:
   runCmdOutput:
     description: The output of the command specified in the runCmd input

azdo-task/DevcontainersCi/src/docker.ts

@@ -71,3 +71,17 @@ export async function pushImage(
 		return false;
 	}
 }
+
+export async function createMultiPlatformImage(
+	imageName: string,
+	tag: string,
+	platformTags: string[],
+): Promise<boolean> {
+	try {
+		await docker.createMultiPlatformImage(exec, imageName, tag, platformTags);
+		return true;
+	} catch (error) {
+		task.setResult(task.TaskResult.Failed, `${error}`);
+		return false;
+	}
+}

azdo-task/DevcontainersCi/src/main.ts

@@ -9,14 +9,75 @@ import {
 	DevContainerCliUpArgs,
 } from '../../../common/src/dev-container-cli';
 
-import {isDockerBuildXInstalled, pushImage} from './docker';
+import {
+	isDockerBuildXInstalled,
+	pushImage,
+	createMultiPlatformImage,
+} from './docker';
 import {isSkopeoInstalled, copyImage} from './skopeo';
 import {exec} from './exec';
+import {
+	buildImageNames,
+	mergeMultiPlatformImages,
+} from '../../../common/src/platform';
 
 export async function runMain(): Promise<void> {
 	try {
 		task.setTaskVariable('hasRunMain', 'true');
+
+		const rawMergeTag = task.getInput('mergeTag');
+		const mergeTag = rawMergeTag?.trim() || undefined;
+		const rawPlatformTag = task.getInput('platformTag');
+		const platformTag = rawPlatformTag?.trim() || undefined;
+
+		if (platformTag && /[\s,]/.test(platformTag)) {
+			task.setResult(
+				task.TaskResult.Failed,
+				`Invalid platformTag '${platformTag}' - must not contain whitespace or commas. Use mergeTag to specify multiple platforms.`,
+			);
+			return;
+		}
+
+		if (mergeTag && platformTag) {
+			task.setResult(
+				task.TaskResult.Failed,
+				'mergeTag and platformTag cannot be used together - mergeTag is for the manifest merge job, platformTag is for per-platform build jobs',
+			);
+			return;
+		}
+
 		const buildXInstalled = await isDockerBuildXInstalled();
+
+		if (mergeTag) {
+			const imageName = task.getInput('imageName');
+			if (!imageName) {
+				task.setResult(
+					task.TaskResult.Failed,
+					'imageName is required when using mergeTag',
+				);
+				return;
+			}
+			if (!buildXInstalled) {
+				task.setResult(
+					task.TaskResult.Failed,
+					'docker buildx is required for mergeTag - add a step to set up docker buildx',
+				);
+				return;
+			}
+			const pushOption = task.getInput('push');
+			if (pushOption !== 'always') {
+				task.setResult(
+					task.TaskResult.Failed,
+					"push must be set to 'always' when using mergeTag - the manifest merge job must push the resulting multi-arch image",
+				);
+				return;
+			}
+			console.log(
+				'mergeTag is set - skipping build (manifest merge will run in post step)',
+			);
+			task.setTaskVariable('mergeTag', mergeTag);
+			return;
+		}
 		if (!buildXInstalled) {
 			console.log(
 				'### WARNING: docker buildx not available: add a step to set up with docker/setup-buildx-action - see https://github.com/devcontainers/ci/blob/main/docs/azure-devops-task.md',
@@ -52,7 +113,7 @@ export async function runMain(): Promise<void> {
 		const skipContainerUserIdUpdate =
 			(task.getInput('skipContainerUserIdUpdate') ?? 'false') === 'true';
 
-		if (platform) {
+		if (platform && !platformTag) {
 			const skopeoInstalled = await isSkopeoInstalled();
 			if (!skopeoInstalled) {
 				console.log(
@@ -61,7 +122,14 @@ export async function runMain(): Promise<void> {
 				return;
 			}
 		}
-		const buildxOutput = platform ? 'type=oci,dest=/tmp/output.tar' : undefined;
+		let buildxOutput: string | undefined;
+		if (platform && !platformTag) {
+			buildxOutput = 'type=oci,dest=/tmp/output.tar';
+		}
+
+		if (platformTag) {
+			task.setTaskVariable('platformTag', platformTag);
+		}
 
 		const log = (message: string): void => console.log(message);
 		const workspaceFolder = path.resolve(checkoutPath, subFolder);
@@ -70,10 +138,9 @@ export async function runMain(): Promise<void> {
 
 		const resolvedImageTag = imageTag ?? 'latest';
 		const imageTagArray = resolvedImageTag.split(/\s*,\s*/);
-		const fullImageNameArray: string[] = [];
-		for (const tag of imageTagArray) {
-			fullImageNameArray.push(`${imageName}:${tag}`);
-		}
+		const fullImageNameArray = imageName
+			? buildImageNames(imageName, imageTagArray, platformTag)
+			: [];
 		if (imageName) {
 			if (fullImageNameArray.length === 1) {
 				if (!noCache && !cacheFrom.includes(fullImageNameArray[0])) {
@@ -98,9 +165,9 @@ export async function runMain(): Promise<void> {
 			workspaceFolder,
 			configFile,
 			imageName: fullImageNameArray,
-			platform,
+			platform: platformTag ? undefined : platform,
 			additionalCacheFroms: cacheFrom,
-			output: buildxOutput,
+			output: platformTag ? undefined : buildxOutput,
 			noCache,
 			cacheTo,
 		};
@@ -192,6 +259,9 @@ export async function runPost(): Promise<void> {
 	const pushOnFailedBuild =
 		(task.getInput('pushOnFailedBuild') ?? 'false') === 'true';
 
+	const mergeTag = task.getTaskVariable('mergeTag');
+	const platformTag = task.getTaskVariable('platformTag');
+
 	// default to 'never' if not set and no imageName
 	if (pushOption === 'never' || (!pushOption && !imageName)) {
 		console.log(`Image push skipped because 'push' is set to '${pushOption}'`);
@@ -259,8 +329,27 @@ export async function runPost(): Promise<void> {
 	}
 	const imageTag = task.getInput('imageTag') ?? 'latest';
 	const imageTagArray = imageTag.split(/\s*,\s*/);
+
+	if (mergeTag) {
+		await mergeMultiPlatformImages(
+			imageName,
+			imageTagArray,
+			mergeTag,
+			createMultiPlatformImage,
+			(msg: string) => console.log(msg),
+		);
+		return;
+	}
+
 	const platform = task.getInput('platform');
-	if (platform) {
+	if (platformTag) {
+		for (const tag of imageTagArray) {
+			console.log(
+				`Pushing platform image '${imageName}:${tag}-${platformTag}'...`,
+			);
+			await pushImage(imageName, `${tag}-${platformTag}`);
+		}
+	} else if (platform) {
 		for (const tag of imageTagArray) {
 			console.log(`Copying multiplatform image '${imageName}:${tag}'...`);
 			const imageSource = `oci-archive:/tmp/output.tar:${tag}`;

azdo-task/DevcontainersCi/task.json

@@ -128,6 +128,18 @@
       "type": "multiLine",
       "label": "Specify the image to cache the built image to",
       "required": false
+    },
+    {
+      "name": "platformTag",
+      "type": "string",
+      "label": "Tag suffix for this platform build (e.g., 'linux-amd64'). Used in matrix builds to push per-platform images that are later merged.",
+      "required": false
+    },
+    {
+      "name": "mergeTag",
+      "type": "string",
+      "label": "Comma-separated list of platform tags to merge into a multi-arch manifest (e.g., 'linux-amd64,linux-arm64'). Used in the merge job after matrix builds complete.",
+      "required": false
     }
   ],
   "outputVariables": [{

common/__tests__/docker.test.ts

@@ -1,4 +1,5 @@
-import {parseMount} from '../src/docker';
+import {parseMount, createMultiPlatformImage} from '../src/docker';
+import {ExecFunction, ExecResult} from '../src/exec';
 
 describe('parseMount', () => {
 	test('handles type,src,dst', () => {
@@ -58,3 +59,127 @@ describe('parseMount', () => {
 		expect(result.target).toBe('/my/dest');
 	});
 });
+
+describe('createMultiPlatformImage', () => {
+	test('should call docker buildx imagetools create with correct args for two platforms', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', ['linux-amd64', 'linux-arm64']);
+
+		expect(mockExec).toHaveBeenCalledTimes(1);
+		expect(mockExec).toHaveBeenCalledWith(
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:v1.0.0',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-amd64',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-arm64',
+			],
+			{},
+		);
+	});
+
+	test('should throw when docker command returns non-zero exit code', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 1, stdout: '', stderr: 'error'});
+
+		await expect(
+			createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', ['linux-amd64', 'linux-arm64']),
+		).rejects.toThrow('manifest creation failed with exit code 1: error');
+	});
+
+	test('should handle a single platform tag', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'latest', ['linux-amd64']);
+
+		expect(mockExec).toHaveBeenCalledTimes(1);
+		expect(mockExec).toHaveBeenCalledWith(
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:latest',
+				'ghcr.io/my-org/my-image:latest-linux-amd64',
+			],
+			{},
+		);
+	});
+
+	test('should handle multiple image tags', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', ['linux-amd64']);
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'latest', ['linux-amd64']);
+
+		expect(mockExec).toHaveBeenCalledTimes(2);
+		expect(mockExec).toHaveBeenNthCalledWith(
+			1,
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:v1.0.0',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-amd64',
+			],
+			{},
+		);
+		expect(mockExec).toHaveBeenNthCalledWith(
+			2,
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:latest',
+				'ghcr.io/my-org/my-image:latest-linux-amd64',
+			],
+			{},
+		);
+	});
+
+	test('should trim whitespace from platform tags', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', [' linux-amd64 ', 'linux-arm64']);
+
+		expect(mockExec).toHaveBeenCalledWith(
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:v1.0.0',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-amd64',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-arm64',
+			],
+			{},
+		);
+	});
+
+	test('should filter out empty platform tags', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', ['linux-amd64', '', ' ']);
+
+		expect(mockExec).toHaveBeenCalledWith(
+			'docker',
+			[
+				'buildx', 'imagetools', 'create',
+				'-t', 'ghcr.io/my-org/my-image:v1.0.0',
+				'ghcr.io/my-org/my-image:v1.0.0-linux-amd64',
+			],
+			{},
+		);
+	});
+
+	test('should throw when all platform tags are empty', async () => {
+		const mockExec = jest.fn<Promise<ExecResult>, Parameters<ExecFunction>>()
+			.mockResolvedValue({exitCode: 0, stdout: '', stderr: ''});
+
+		await expect(
+			createMultiPlatformImage(mockExec, 'ghcr.io/my-org/my-image', 'v1.0.0', ['', ' ']),
+		).rejects.toThrow('platformTags must contain at least one non-empty entry');
+
+		expect(mockExec).not.toHaveBeenCalled();
+	});
+});