ci: build the image for linux/amd64 and linux/arm64

.github/workflows/release.yml

@@ -3,7 +3,9 @@
 # Dockerfile 的基础镜像默认就是公开镜像（python:3.12-slim），这里不需要传任何
 # build-arg 覆盖。
 #
-# 只构建 amd64：目前没有 arm64 的使用需求，需要时再加（届时要补 QEMU 步骤）。
+# Built for linux/amd64 and linux/arm64; arm64 is built under QEMU emulation.
+# A pull request builds both platforms without logging in or pushing, so a change
+# that breaks either build shows up before a release tag does.
 #
 # 凭据来自组织级 secrets：DOCKERHUB_USERNAME 和 DOCKERHUB_TOKEN。
 name: Release
@@ -12,6 +14,7 @@ on:
   push:
     tags:
       - 'v[0-9]*'
+  pull_request:
 
 permissions: {}
 
@@ -36,6 +39,11 @@ jobs:
         id: tags
         run: |
           set -eu
+          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
+            # build-only run: a placeholder tag, never pushed
+            { echo "t0<<T_EOF"; echo "${IMAGE_0}:pr-${{ github.event.number }}"; echo "T_EOF"; } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           version="${GITHUB_REF_NAME#v}"
           case "$version" in
             *-*) echo "prerelease ${version}: not tagging latest" ;;
@@ -50,10 +58,14 @@ jobs:
             echo "T_EOF"
           } >> "$GITHUB_OUTPUT"
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+
       - name: Set up Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to Docker Hub
+        if: github.event_name == 'push'
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -64,6 +76,6 @@ jobs:
         with:
           context: .
           file: Dockerfile
-          platforms: linux/amd64
-          push: true
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name == 'push' }}
           tags: ${{ steps.tags.outputs.t0 }}