fix: block single-arch images from reaching production

.github/workflows/deploy.yml

@@ -20,6 +20,24 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Verify image provides linux/amd64
+        run: |
+          image="${{ env.IMAGE }}:${{ inputs.image_tag || 'latest' }}"
+          # multi-platform tags publish an index; single-platform tags publish a
+          # bare manifest, for which the index template fails and we fall back
+          platforms=$(docker buildx imagetools inspect "$image" \
+              --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}} {{end}}' 2>/dev/null) \
+            || platforms=$(docker buildx imagetools inspect "$image" \
+              --format '{{.Image.OS}}/{{.Image.Architecture}}')
+          echo "$image provides: $platforms"
+          case " $platforms " in
+            *" linux/amd64 "*) ;;
+            *)
+              echo "::error::$image has no linux/amd64 manifest. Container Apps nodes are amd64, so every replica would fail with ImagePullBackOff. Publish via the 'Publish Docker' workflow instead of pushing by hand."
+              exit 1
+              ;;
+          esac
+
       - uses: azure/login@v2
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}

Makefile

@@ -1,9 +1,11 @@
 DOCKER_IMAGE ?= evcc/optimizer
 DOCKER_TAG ?= latest
+# Container Apps nodes are amd64; an arm64-only tag takes production down
+DOCKER_PLATFORMS ?= linux/amd64,linux/arm64
 
 RESOURCE_GROUP ?= rg-optimizer-prod
 
-default: build docker-build
+default: build docker-build-local
 
 build::
 	go generate ./...
@@ -31,16 +33,19 @@ loadtest::
 	uv run locust --host http://localhost:7050 --headless -t 30s -u 2 --only-summary
 	uv run locust --host http://localhost:7050 --headless -t 30s -u 4 --only-summary
 
-docker: docker-build docker-push docker-run
+docker: docker-build docker-run
 
+# Buildx cannot load a manifest list into the local image store, so a
+# multi-platform tag only exists once pushed to the registry.
 docker-build::
-	docker buildx build . --tag $(DOCKER_IMAGE)
+	docker buildx build . --platform $(DOCKER_PLATFORMS) --tag $(DOCKER_IMAGE):$(DOCKER_TAG) --push
 
-docker-run::
-	docker run -p 7050:7050 -it $(DOCKER_IMAGE)
+# Host architecture only, loaded locally for docker-run. Never push this.
+docker-build-local::
+	docker buildx build . --tag $(DOCKER_IMAGE):$(DOCKER_TAG) --load
 
-docker-push::
-	docker push $(DOCKER_IMAGE)
+docker-run:: docker-build-local
+	docker run -p 7050:7050 -it $(DOCKER_IMAGE):$(DOCKER_TAG)
 
 fly::
 	fly deploy --local-only