Automate multi-arch Docker releases for Ubuntu 24.04 and 26.04

[Sythos]

What this does

This adds an automated Docker release workflow for every strictly increasing stable version tag.

The workflow:

• validates release metadata, tag ordering, and that the tag commit is reachable from main;
• runs lint, production dependency audit, and CodeQL before any release promotion;
• builds Ubuntu 24.04 and Ubuntu 26.04 images;
• targets both linux/amd64 and linux/arm64;
• keeps the pinned Node.js 18.19.1 runtime on Ubuntu 24.04 for compatibility;
• uses the supported pinned Node.js 24.19.0 runtime on Ubuntu 26.04 and in the primary CI/release gates;
• verifies the official Node.js archive checksum independently for every base and architecture;
• publishes versioned images to GHCR only after the full build and smoke-test matrix passes;
• promotes the moving tags only after the resulting manifests contain both architectures;
• creates the GitHub release and source archive after image promotion.

Published image tags

For each stable vX.Y.Z tag:

• <version>-ubuntu24.04 and ubuntu24.04;
• <version>-ubuntu26.04 and ubuntu26.04;
• <version> and latest, both pointing to the Ubuntu 26.04 image.

Every published tag is a multi-platform manifest for AMD64 and ARM64. Pull requests and branch pushes build and smoke-test the images without publishing them.

Why

The previous release workflow performed a native Docker build without declaring the target platforms. This made the published architecture depend on the runner and did not provide a reliable Ubuntu LTS or ARM64 release path.

This keeps Ubuntu 24.04 available with its requested Node.js 18.19.1 compatibility runtime while adding Ubuntu 26.04 with supported Node.js 24.19.0. Node.js 18 is EOL, so new deployments should prefer the Ubuntu 26.04 image; its compatibility check is intentionally non-blocking and does not weaken the Node 24 security/release gates.

Validation

• npm ci --ignore-scripts
• npm run check
• npm audit --omit=dev --audit-level=high
• SemVer increment, duplicate-tag, invalid-tag, and current-workflow-tag checks
• Node.js compatibility checks for 18.19.1 and 24.19.0
• CI push run external tank object #10 for commit 8738f85: green in 3m 14s
• PR run #49 for commit 8738f85: green in 3m 16s
• The runs use a GitHub Free account, so the QEMU-backed ARM64 jobs are expected to be slower

The branch remains ready for review.

[Sythos]

Imho should be targeted directly 26.04... or ask for node backport as requirement (18 is REALLY EOL)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Sythos]

Follow-up: Node.js runtime alignment

I moved the container and CI runtime to the current supported Node.js LTS after GitHub's security checks rejected the Ubuntu 24.04 Node.js 18.19.1 line as EOL.

Both Ubuntu images now pin Node.js 24.19.0 from the official architecture-specific tarballs, with SHA-256 verification for x64 and arm64. setup-node uses the same 24.19.0 version for lint, audit, compatibility, and release-gate jobs, and the container smoke tests assert that both Ubuntu bases expose that exact runtime.

This keeps the two Ubuntu base images separate while removing an EOL runtime from the release path. The update is in commit d536ada; the local checks and the GitHub CI run are being rerun against it.

[Sythos]

Follow-up: the first Node 24 switch exposed stale Ubuntu 24.04 checksum values in the real Docker build. I corrected them to the official Node.js 24.19.0 x64/arm64 hashes in 1f36934.

The requested compatibility split is now explicit: Ubuntu 24.04 uses pinned Node.js 18.19.1, while Ubuntu 26.04 stays on supported Node.js 24.19.0. The primary lint, audit, CodeQL, and release gates remain on Node 24; the Node 18 compatibility lane is non-blocking, and both image smoke tests assert the base-specific runtime.

One small confession: - node-compatibility is exactly the kind of thing in code and security checks that goes against my religion, but we’ll let it slide this time :D