ci: publish multi-arch Docker image variants

[lelia]

Summary

• Publish socket-basics from native amd64/arm64 builds, merged into multi-arch manifest lists per release tag.
• Add a heavy image variant that bundles socket-basics with the pinned Python Socket CLI release.
• All variants publish to the single socket-basics repository on each registry, distinguished by tag suffix (2.1.0 vs 2.1.0-heavy) — no separate -heavy repo, so existing registry credentials and GHCR package visibility carry over unchanged.
• Keep release publishing explicit and versioned; no floating heavy tag or cross-repo automation.

This follows the direction from #69: prefer native per-arch Docker publishing and keep the image release path simple to maintain.

Closes #69

---

Note

Medium Risk
Touches the production Docker publish path (multi-arch manifests and new variant tags); mitigated by expanded CI matrices, digest validation, and post-publish platform inspection.

Overview
Docker release now builds main and heavy images on native linux/amd64 and linux/arm64 runners, runs smoke/integration per matrix cell, pushes per-arch by digest to GHCR and Docker Hub, then merge-manifests assembles 2.x.y and 2.x.y-heavy tags on the single socket-basics repo (no separate heavy repository).

The reusable _docker-pipeline workflow gains runs_on, arch_label, push_name, checkout ref, and digest artifacts; tagging moves from per-build metadata-action to docker buildx imagetools create. resolve-version validates semver and resolves manual dispatch tags before checkout.

Dockerfile.heavy plus docker-heavy-entrypoint.sh install pinned socketsecurity and dispatch socket-basics / socketcli; smoke CI adds a heavy check set and LICENSE.md is included in image builds.

^{Reviewed by Cursor Bugbot for commit fbf94ea. Configure here.}

[lelia]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Dispatch republish wrong checkout ref
  • Exported the resolved tag ref as a resolve-version output and plumbed it through a new ref input to the reusable pipeline's checkout so build-test-push builds from the specified tag instead of the default branch HEAD.

Or push these changes by commenting:

@cursor push 4d512fb46b

Preview (4d512fb46b)

diff --git a/.github/workflows/_docker-pipeline.yml b/.github/workflows/_docker-pipeline.yml
--- a/.github/workflows/_docker-pipeline.yml
+++ b/.github/workflows/_docker-pipeline.yml
@@ -56,6 +56,11 @@ on:
         type: string
         required: false
         default: "dev"
+      ref:
+        description: "Git ref to check out (e.g. refs/tags/v2.0.3). Empty checks out the caller's default ref — used by the publish workflow to build from the resolved release tag on workflow_dispatch."
+        type: string
+        required: false
+        default: ""
     secrets:
       DOCKERHUB_USERNAME:
         required: false

@@ -56,6 +56,11 @@ on:
         type: string
         required: false
         default: "dev"
+      ref:
+        description: "Git ref to check out (e.g. refs/tags/v2.0.3). Empty checks out the caller's default ref — used by the publish workflow to build from the resolved release tag on workflow_dispatch."
+        type: string
+        required: false
+        default: ""
     secrets:
       DOCKERHUB_USERNAME:
         required: false
@@ -71,6 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref }}
           persist-credentials: false
 
       - name: 🔨 Set up Docker Buildx

@@ -71,6 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref }}
           persist-credentials: false
 
       - name: 🔨 Set up Docker Buildx

diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -43,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.clean }}
+      ref: ${{ steps.version.outputs.ref }}
     steps:
       - name: 🏷️ Resolve version
         id: version

@@ -43,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.clean }}
+      ref: ${{ steps.version.outputs.ref }}
     steps:
       - name: 🏷️ Resolve version
         id: version
@@ -130,6 +131,7 @@ jobs:
       arch_label: ${{ matrix.arch }}
       push: true
       version: ${{ needs.resolve-version.outputs.version }}
+      ref: ${{ needs.resolve-version.outputs.ref }}
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

@@ -130,6 +131,7 @@ jobs:
       arch_label: ${{ matrix.arch }}
       push: true
       version: ${{ needs.resolve-version.outputs.version }}
+      ref: ${{ needs.resolve-version.outputs.ref }}
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

_{You can send follow-ups to the cloud agent here.}

[lelia]

bugbot run

[lelia]

bugbot run

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fbf94ea. Configure here.}