feat(ci): allow for supporting multi-arch images to be built and shipped

[knechtionscoding]

What type of PR is this?

/kind feature

What this PR does / why we need it:

We want to run Kelos on our ARM nodes as well as AMD. Seeing as this is primarily an interface with k8s and llm APIs and not doing ML work locally this is relatively easy to allow.

Updates the dockerfiles to build the binary as a multi-stage build and then publish all the images properly

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Does this PR introduce a user-facing change?

feat(ci): support running kelos on ARM 

---

Summary by cubic

Enable multi-arch Docker images (linux/amd64, linux/arm64) so Kelos runs on ARM and x86 nodes. Updates Dockerfiles, Makefile, and release workflow to build and push multi-arch images.

• New Features
  • Added make push-multiarch using docker buildx build with DOCKER_PLATFORMS=linux/amd64,linux/arm64.
  • Release workflow uses docker/setup-buildx-action@v3 and pushes multi-arch tags (versioned and latest on releases).
  • Converted images to multi-stage builds that compile kelos-controller, kelos-spawner, and kelos-capture inside Docker for reproducible cross-arch builds.

^{Written for commit 93a11cd. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cursor/Dockerfile">

<violation number="1" location="cursor/Dockerfile:1">
P2: Builder toolchain is decoupled from `GO_VERSION` and uses a floating Go tag, reducing build reproducibility and risking version drift.</violation>
</file>

<file name="cmd/kelos-spawner/Dockerfile">

<violation number="1" location="cmd/kelos-spawner/Dockerfile:1">
P2: New builder base image uses a floating tag (`golang:1.25`), which can cause non-reproducible builds and external version drift.</violation>
</file>

<file name="gemini/Dockerfile">

<violation number="1" location="gemini/Dockerfile:1">
P2: Builder stage uses a floating Go image tag, making release artifacts non-reproducible across rebuilds.</violation>
</file>

<file name="claude-code/Dockerfile">

<violation number="1" location="claude-code/Dockerfile:1">
P2: New builder stage uses an unpinned `golang` image tag, making shipped binary builds non-deterministic and vulnerable to upstream image drift.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Builder toolchain is decoupled from GO_VERSION and uses a floating Go tag, reducing build reproducibility and risking version drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cursor/Dockerfile, line 1:

<comment>Builder toolchain is decoupled from `GO_VERSION` and uses a floating Go tag, reducing build reproducibility and risking version drift.</comment>

<file context>
@@ -1,3 +1,10 @@
+FROM golang:1.25 AS builder
+WORKDIR /workspace
+COPY go.mod go.sum ./
</file context>

[cubic-dev-ai]

P2: New builder base image uses a floating tag (golang:1.25), which can cause non-reproducible builds and external version drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At cmd/kelos-spawner/Dockerfile, line 1:

<comment>New builder base image uses a floating tag (`golang:1.25`), which can cause non-reproducible builds and external version drift.</comment>

<file context>
@@ -1,5 +1,12 @@
+FROM golang:1.25 AS builder
+WORKDIR /workspace
+COPY go.mod go.sum ./
</file context>

Suggested change

	FROM golang:1.25 AS builder
	FROM golang:1.25.0 AS builder

[cubic-dev-ai]

P2: Builder stage uses a floating Go image tag, making release artifacts non-reproducible across rebuilds.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At gemini/Dockerfile, line 1:

<comment>Builder stage uses a floating Go image tag, making release artifacts non-reproducible across rebuilds.</comment>

<file context>
@@ -1,3 +1,10 @@
+FROM golang:1.25 AS builder
+WORKDIR /workspace
+COPY go.mod go.sum ./
</file context>

Suggested change

	FROM golang:1.25 AS builder
	FROM golang:1.25.0 AS builder

[cubic-dev-ai]

P2: New builder stage uses an unpinned golang image tag, making shipped binary builds non-deterministic and vulnerable to upstream image drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At claude-code/Dockerfile, line 1:

<comment>New builder stage uses an unpinned `golang` image tag, making shipped binary builds non-deterministic and vulnerable to upstream image drift.</comment>

<file context>
@@ -1,3 +1,10 @@
+FROM golang:1.25 AS builder
+WORKDIR /workspace
+COPY go.mod go.sum ./
</file context>