ci(release-tag): shared reusable multi-platform build

.github/workflows/release-pullrequest.yaml

@@ -1,72 +1,28 @@
+# PR CI via shared reusable workflows (krateo-platformops/.github): a validate-only multi-platform
+# image build (component-image-build, push: false) + Go checks (component-go-checks: unit tests)
+# run from the repo-root module. One source of truth, and go/-fold-safe.
 name: release-pullrequest
 
 on:
   pull_request:
     branches:
       - main
 
-env:
-  GHCR_REPO: ghcr.io/${{ github.repository }}
-
 jobs:
   build:
-    name: Build and Push
-    strategy:
-      matrix:
-        runner: [ubuntu-22.04-arm, ubuntu-22.04]
-        include:
-          - runner: ubuntu-22.04-arm
-            platform: linux/arm64
-          - runner: ubuntu-22.04
-            platform: linux/amd64
-    runs-on: ${{ matrix.runner }}
-
+    uses: krateo-platformops/.github/.github/workflows/component-image-build.yaml@main
     permissions:
       contents: read
       packages: write
-
-    steps:
-      - name: Prepare
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ${{ env.GHCR_REPO }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build and NOT push
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          platforms: ${{ matrix.platform }}
-          push: false
-          labels: ${{ steps.meta.outputs.labels }}
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: 'stable'
-      - name: Gather dependencies
-        run: go mod download
-      - name: Run coverage
-        run: go test -race -tags=unit,integration -p 1 -timeout 30m -coverprofile=coverage.txt -covermode=atomic ./... -coverpkg=./...
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v6
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+    with:
+      context: .
+      push: false
+
+  checks:
+    uses: krateo-platformops/.github/.github/workflows/component-go-checks.yaml@main
+    with:
+      module: .
+      crd_drift: false
+      test_args: >-
+        -race -tags=unit,integration -p 1 -timeout 30m -coverprofile=coverage.txt -covermode=atomic ./... -coverpkg=./...
+    secrets: inherit

.github/workflows/release-tag.yaml

@@ -1,10 +1,10 @@
-# Canonical Krateo COMPONENT (code-repo) release workflow — THE single way every krateo-*
-# code repo builds & pushes its image and (if it owns CRDs) publishes them. Identical
-# byte-for-byte across ALL component repos (no per-repo config); everything is derived from
-# the repo itself.
+# Krateo COMPONENT (code-repo) release workflow. The `build` job now calls the SHARED reusable
+# multi-platform image build (krateo-platformops/.github) — one source of truth, no per-repo drift
+# (the multi-arch build can never regress to a single-arch image again). The `crds` job stays
+# component-specific.
 #
-#   • build  — ONE multi-platform image (linux/amd64 + linux/arm64) via docker/build-push-action@v7
-#              (QEMU + buildx), tagged from the pushed git tag. Image = ghcr.io/<this repo>.
+#   • build  — ONE multi-platform image (linux/amd64 + linux/arm64) via the shared reusable
+#              workflow. Image = ghcr.io/<this repo>.
 #   • crds   — only acts for CRD-owning repos: runs `make generate` (the single agnostic entry
 #              point each CRD repo exposes; repos without it skip cleanly), then opens a PR into
 #              the component's chart repo (braghettos/<repo>-chart) refreshing crds-subchart/,
@@ -15,50 +15,16 @@ on:
   push:
     tags: ["[0-9]+.[0-9]+.[0-9]+"]
 
-env:
-  GHCR_REPO: ghcr.io/${{ github.repository }}
-
 jobs:
   build:
-    name: Build & push image (multi-platform)
-    runs-on: ubuntu-latest
+    # Shared multi-platform build (linux/amd64 + linux/arm64) — see
+    # krateo-platformops/.github/.github/workflows/component-image-build.yaml
+    uses: krateo-platformops/.github/.github/workflows/component-image-build.yaml@main
     permissions:
       contents: read
       packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ${{ env.GHCR_REPO }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      # ONE job, multi-platform manifest list built with buildx (arm64 via QEMU emulation).
-      - name: Build and push (linux/amd64, linux/arm64)
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Inspect image
-        run: docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }}
+    with:
+      context: .
 
   crds:
     name: Generate & publish crds-subchart