From 398521dc72a4eb9aea5afbe73336fca9971c8f48 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 13:07:36 +0200
Subject: [PATCH 1/7] chore: streamline GH action usage

---
 .github/workflows/ci.yml       | 74 ++++++++++++++--------------------
 .github/workflows/gh-pages.yml | 29 ++++++-------
 .github/workflows/it.yml       | 22 +++++-----
 3 files changed, 52 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d489b58..5e6069b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,66 +12,56 @@ on:
 
 jobs:
   check-license-headers:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Check license headers
       run: |
         ./hack/check-license-headers.sh
 
   rustfmt:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
-        components: rustfmt
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update --component rustfmt
+        rustup default stable
 
     - name: cargo fmt
-      uses: actions-rs/cargo@v1
-      with:
-        command: fmt
-        args: --all -- --check
+      run: cargo fmt --all -- --check
 
   clippy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
-        components: clippy
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update --component clippy
+        rustup default stable
 
     - name: cargo clippy
-      uses: actions-rs/clippy-check@v1
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        args: --workspace --lib --bins --tests --all-targets -- -Dwarnings
+      run: cargo clippy --workspace --lib --bins --tests --all-targets -- -Dwarnings
 
   yamllint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: yamllint
-      uses: ibiqlik/action-yamllint@v1.0.0
+      run: |
+        pip install yamllint
+        yamllint .
 
   build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: ${{ matrix.continue-on-error }}
 
     strategy:
@@ -97,9 +87,9 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Retrieve cache
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/registry
@@ -107,22 +97,18 @@ jobs:
           target
         key: ${{ runner.os }}-cargo-ci-${{ hashFiles('**/Cargo.lock') }}
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: ${{ matrix.rust }}
-        override: true
+      run: |
+        rustup toolchain install ${{ matrix.rust }} --profile minimal --no-self-update
+        rustup default ${{ matrix.rust }}
+        if [ -n "${{ matrix.target }}" ]; then
+          rustup target add ${{ matrix.target }}
+        fi
 
     - name: cargo build
-      uses: actions-rs/cargo@v1
-      with:
-        command: build
+      run: cargo build
       env:
         TARGET: ${{ matrix.target }}
     - name: cargo test
-      uses: actions-rs/cargo@v1
-      with:
-        command: test
-        args: -- --nocapture
+      run: cargo test -- --nocapture
       env:
         TARGET: ${{ matrix.target }}
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 0c04271c..88dc53d5 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -9,15 +9,15 @@ on:
 
 jobs:
   docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       max-parallel: 1
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Retrieve cache
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/registry
@@ -25,14 +25,14 @@ jobs:
           target
         key: ${{ runner.os }}-cargo-doc-${{ hashFiles('**/Cargo.lock') }}
     - name: Checkout existing gh-pages branch
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         ref: gh-pages
         path: gh-pages
 
     - name: Get latest tag
       id: tag
-      uses: jimschubert/query-tag-action@v1
+      uses: jimschubert/query-tag-action@v2
       with:
         commit-ish: HEAD
     - name: Get a pretty-printed version of the current branch or tag
@@ -46,14 +46,14 @@ jobs:
           echo "No ref available" >&2
           exit 1
         fi
-        echo "::set-output name=value::${REF}"
+        echo "value=${REF}" >> $GITHUB_OUTPUT
     - name: Identify if tag is a prerelease
       id: tag-prerelease
       run: |
         if [[ "${{ steps.branch-or-tag.outputs.value }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          echo "::set-output name=value::false"
+          echo "value=false" >> $GITHUB_OUTPUT
         else
-          echo "::set-output name=value::true"
+          echo "value=true" >> $GITHUB_OUTPUT
         fi
 
     - name: Create/update symlink for `/latest` to latest tag
@@ -63,16 +63,11 @@ jobs:
         ln -sf "${{ steps.tag.outputs.tag }}" gh-pages/latest
 
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update
+        rustup default stable
     - name: cargo doc
-      uses: actions-rs/cargo@v1
-      with:
-        command: doc
-        args: --no-deps
+      run: cargo doc --no-deps
     - name: Move generated docs to the correct location
       run: |
         rm -rf "gh-pages/${{ steps.branch-or-tag.outputs.value }}" || :
diff --git a/.github/workflows/it.yml b/.github/workflows/it.yml
index cd756584..60a87811 100644
--- a/.github/workflows/it.yml
+++ b/.github/workflows/it.yml
@@ -12,13 +12,13 @@ on:
 
 jobs:
   build-test-binary:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Retrieve cache
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/registry
@@ -26,12 +26,10 @@ jobs:
           target
         key: ${{ runner.os }}-cargo-it-${{ hashFiles('**/Cargo.lock') }}
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
-        target: x86_64-unknown-linux-musl
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update
+        rustup default stable
+        rustup target add x86_64-unknown-linux-musl
     - name: Build the test-binary
       run: |
         cp $(
@@ -44,7 +42,7 @@ jobs:
           | jq -r 'select(.profile.test == true) | .executable'
         ) dfw-docker-test
     - name: Store the test-binary as an artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v4
       with:
         name: dfw-docker-test
         path: dfw-docker-test
@@ -81,9 +79,9 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Retrieve the test-binary
-      uses: actions/download-artifact@v2
+      uses: actions/download-artifact@v4
       with:
         name: dfw-docker-test
     - name: Ensure Docker is available

From 6b766fd7d26315956d8f2cb7407403fb8d660443 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 13:15:19 +0200
Subject: [PATCH 2/7] chore: refactor release pipeline

---
 .github/workflows/releases.yml | 136 ++++++++++++++++++++-------------
 1 file changed, 82 insertions(+), 54 deletions(-)

diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index a1a548b9..2125a2fd 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -7,75 +7,114 @@ on:
     - '[0-9]+.[0-9]+.[0-9]+-*'
 
 jobs:
-  build-and-publish:
-    runs-on: ubuntu-latest
+  build-binaries:
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+        - target: x86_64-unknown-linux-musl
+          runner: ubuntu-24.04
+        - target: aarch64-unknown-linux-musl
+          runner: ubuntu-24.04-arm
+        - target: armv7-unknown-linux-musleabihf
+          runner: ubuntu-24.04-arm
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
+
     - name: Retrieve cache
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
           target
-        key: ${{ runner.os }}-cargo-ci-${{ hashFiles('**/Cargo.lock') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.target }}
+
     - name: Install Rust toolchain
-      uses: actions-rs/toolchain@v1
-      with:
-        profile: minimal
-        toolchain: stable
-        override: true
+      run: |
+        rustup toolchain install stable --profile minimal --no-self-update
+        rustup default stable
+        rustup target add ${{ matrix.target }}
+
+    - name: Build release binary
+      run: cargo build --release --target ${{ matrix.target }}
 
-    - name: cargo build --release
-      uses: actions-rs/cargo@v1
-      with:
-        command: build
-        args: --release
-      env:
-        TARGET: x86_64-unknown-linux-musl
     - name: Create checksum
       run: |
-        sha256sum target/release/dfw > target/release/dfw.sha256
+        cd target/${{ matrix.target }}/release
+        sha256sum dfw > dfw.sha256
+
+    - name: Upload binary artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: binary-${{ matrix.target }}
+        path: |
+          target/${{ matrix.target }}/release/dfw
+          target/${{ matrix.target }}/release/dfw.sha256
+        if-no-files-found: error
+        retention-days: 1
+
+  create-release:
+    runs-on: ubuntu-24.04
+    needs: build-binaries
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Download all binary artifacts
+      uses: actions/download-artifact@v4
+      with:
+        path: binaries
+        pattern: binary-*
+        merge-multiple: false
 
     - name: Identify if tag is a prerelease
       id: tag
       run: |
         if [[ "${{ github.ref }}" =~ ^refs/tags/(.+)$ ]]; then
-          echo "::set-output name=value::${BASH_REMATCH[1]}"
+          echo "value=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
         else
           echo "::error ::Expected a tag"
           exit 1
         fi
 
         if [[ "${{ github.ref }}" =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          echo "::set-output name=is-prerelease::false"
+          echo "is-prerelease=false" >> $GITHUB_OUTPUT
         else
-          echo "::set-output name=is-prerelease::true"
+          echo "is-prerelease=true" >> $GITHUB_OUTPUT
         fi
+
     - name: Extract current changelog
       id: changelog
-      run:
-        |
+      run: |
         changelog="$(hack/extract-current-changelog.py CHANGELOG.md)"
         # https://github.community/t/set-output-truncates-multiline-strings/16852/3
         changelog="${changelog//'%'/'%25'}"
         changelog="${changelog//$'\n'/'%0A'}"
         changelog="${changelog//$'\r'/'%0D'}"
+        echo "value=$changelog" >> $GITHUB_OUTPUT
 
-        echo "::set-output name=value::$changelog"
-
-    - name: Prepare release
-      id: prepare-release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Prepare release binaries
+      run: |
+        mkdir -p release-assets
+        for target_dir in binaries/binary-*; do
+          target=$(basename "$target_dir" | sed 's/binary-//')
+          cp "$target_dir/dfw" "release-assets/dfw-$target"
+          cp "$target_dir/dfw.sha256" "release-assets/dfw-$target.sha256"
+        done
+        ls -lah release-assets/
+
+    - name: Create GitHub release
+      uses: softprops/action-gh-release@v2
       with:
-        tag_name: ${{ github.ref }}
-        release_name: v${{ github.ref }}
         draft: true
         prerelease: ${{ steps.tag.outputs.is-prerelease }}
+        files: release-assets/*
         body: |
           # Summary
 
@@ -87,37 +126,26 @@ jobs:
 
           ## Installation
 
-          While you can use Cargo to install `dfw` as a binary, using the Docker image is the preferred way to go, especially if you don't want to install Rust and Cargo on your host:
+          ### Docker Image (recommended)
 
           ```console
-          $ docker pull pitkley/dfw:${{ steps.tag.outputs.value }}
+          $ docker pull ghcr.io/pitkley/dfw:${{ steps.tag.outputs.value }}
           $ docker run -d \
                 --name=dfw \
                 --restart=unless-stopped \
                 -v /var/run/docker.sock:/var/run/docker.sock:ro \
                 -v /path/to/your/config:/config \
                 --net host --cap-add=NET_ADMIN \
-                pitkley/dfw:${{ steps.tag.outputs.value }} --config-path /config
+                ghcr.io/pitkley/dfw:${{ steps.tag.outputs.value }} --config-path /config
           ```
 
-          This will download a lightweight image, coming in at around 20 MB, and subsequently run it using your configuration.
+          This will download a lightweight image and subsequently run it using your configuration.
           The image supports multiple architectures: `amd64`, `arm64`, `armv7` (specifically `armhf`).
 
-    - name: Upload static DFW binary
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.prepare-release.outputs.upload_url }}
-        asset_path: target/release/dfw
-        asset_name: dfw-x86_64-unknown-linux-musl
-        asset_content_type: application/octet-stream
-    - name: Upload static DFW binary checksum
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.prepare-release.outputs.upload_url }}
-        asset_path: target/release/dfw.sha256
-        asset_name: dfw-x86_64-unknown-linux-musl.sha256
-        asset_content_type: application/octet-stream
+          ### Pre-built binaries
+
+          Pre-built static binaries are available below for the following platforms:
+
+          * `dfw-x86_64-unknown-linux-musl` - Linux x86_64 (amd64)
+          * `dfw-aarch64-unknown-linux-musl` - Linux ARM64 (aarch64)
+          * `dfw-armv7-unknown-linux-musleabihf` - Linux ARMv7 (armhf, for 32-bit Raspberry Pi OS)

From 96390e7842d8befa56d549b60c9ca77d775bdf17 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 13:43:43 +0200
Subject: [PATCH 3/7] chore: refactor Docker pipeline

- Migrate from self-hosted ARM runner to GH-hosted runner.
- Build architectures separately, merge later.
---
 .github/workflows/docker.yml | 191 +++++++++++++++++++++++++----------
 1 file changed, 136 insertions(+), 55 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0a5c5359..b9a84169 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -10,81 +10,162 @@ on:
     branches:
     - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
-  build-and-push-docker-image:
+  build-per-architecture:
     if: github.repository_owner == 'pitkley' && github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+        - platform: linux/amd64
+          runner: ubuntu-24.04
+          arch: amd64
+        - platform: linux/arm64
+          runner: ubuntu-24.04-arm
+          arch: arm64
+        - platform: linux/arm/v7
+          runner: ubuntu-24.04-arm
+          arch: armv7
 
     steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Set up QEMU
+      if: matrix.arch == 'armv7'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: arm
+
     - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v1
+      uses: docker/setup-buildx-action@v3
 
-    - name: Setup connection to arm64-capable runner
-      run: |
-        echo "::group::ssh-agent: launch and export"
-        eval "$(ssh-agent)"
-        echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> $GITHUB_ENV
-        echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> $GITHUB_ENV
-        echo "::endgroup::"
-
-        echo "::group::ssh-agent: load private key"
-        ssh-add - <<< "${{ secrets.ARMRUNNER1_SSH_PRIVATE_KEY }}"
-        echo "::endgroup::"
-
-        echo "::group::ssh: pin runner public key"
-        mkdir ~/.ssh && chmod 0700 ~/.ssh || :
-        echo "[${{ secrets.ARMRUNNER1_HOSTNAME }}]:${{ secrets.ARMRUNNER1_SSH_PORT }} ${{ secrets.ARMRUNNER1_SSH_HOSTKEY }}" > ~/.ssh/known_hosts
-        echo "::endgroup::"
-
-    - name: Register arm64-capable runner with Buildx
-      env:
-        DOCKER_HOST: ssh://github-actions@${{ secrets.ARMRUNNER1_HOSTNAME }}:${{ secrets.ARMRUNNER1_SSH_PORT }}
-      run: docker buildx create --append --name ${{ steps.buildx.outputs.name }} --bootstrap
+    - name: Login to ghcr.io
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ github.token }}
 
-    - name: Checkout
-      uses: actions/checkout@v2
+    - name: Build and push by digest to GHCR
+      id: build
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        platforms: ${{ matrix.platform }}
+        outputs: type=image,name=ghcr.io/pitkley/dfw,push-by-digest=true,name-canonical=true,push=true
+        cache-from: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
+        cache-to: type=gha,scope=${{ github.repository }}-${{ github.ref_name }}-${{ matrix.platform }}
 
-    - name: Prepare Docker image tags
-      id: docker-image-tags
-      uses: haya14busa/action-cond@v1
+    - name: Export digest
+      run: |
+        mkdir -p /tmp/digests
+        digest="${{ steps.build.outputs.digest }}"
+        touch "/tmp/digests/${digest#sha256:}"
+
+    - name: Upload digest
+      uses: actions/upload-artifact@v4
       with:
-        cond: ${{ github.event_name == 'push' }}
-        if_true: |
-          pitkley/dfw
-          ghcr.io/pitkley/dfw
-        if_false: |
-          ghcr.io/pitkley/dfw
-    - name: Prepare Docker image metadata
-      id: meta
-      uses: docker/metadata-action@v3
+        name: digests-${{ matrix.arch }}
+        path: /tmp/digests/*
+        if-no-files-found: error
+        retention-days: 1
+
+  merge-manifests:
+    if: github.repository_owner == 'pitkley' && github.actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    runs-on: ubuntu-24.04
+    needs: build-per-architecture
+
+    steps:
+    - name: Download digests
+      uses: actions/download-artifact@v4
       with:
-        images: ${{ steps.docker-image-tags.outputs.value }}
-        tags: |
-          type=ref,event=branch
-          type=ref,event=pr
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
+        path: /tmp/digests
+        pattern: digests-*
+        merge-multiple: true
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
       if: github.event_name == 'push'
-      uses: docker/login-action@v1
+      uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_ACCESSTOKEN }}
+
     - name: Login to ghcr.io
-      uses: docker/login-action@v1
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
         password: ${{ github.token }}
 
-    - name: Build and push Docker image
-      uses: docker/build-push-action@v2
+    - name: Prepare Docker image metadata
+      id: meta
+      uses: docker/metadata-action@v5
       with:
-        context: .
-        platforms: linux/amd64,linux/arm64,linux/arm/v7
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
+        images: |
+          ${{ github.event_name == 'push' && 'pitkley/dfw' || '' }}
+          ghcr.io/pitkley/dfw
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=semver,pattern={{major}}
+
+    - name: Get execution timestamp with RFC3339 format
+      id: timestamp
+      run: |
+        echo "timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_OUTPUT
+
+    - name: Create manifest list and push to GHCR
+      working-directory: /tmp/digests
+      run: |
+        docker buildx imagetools create \
+          $(jq -cr '.tags | map(select(startswith("ghcr.io"))) | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          --annotation='index:org.opencontainers.image.description=${{ github.event.repository.description }}' \
+          --annotation='index:org.opencontainers.image.created=${{ steps.timestamp.outputs.timestamp }}' \
+          --annotation='index:org.opencontainers.image.source=${{ github.event.repository.html_url }}' \
+          $(printf 'ghcr.io/pitkley/dfw@sha256:%s ' *)
+
+    - name: Inspect GHCR image
+      run: |
+        docker buildx imagetools inspect ghcr.io/pitkley/dfw:${{ steps.meta.outputs.version }}
+
+    - name: Copy multi-arch image from GHCR to Docker Hub
+      if: github.event_name == 'push'
+      run: |
+        # Extract all Docker Hub tags from metadata
+        dockerhub_tags=$(jq -cr '.tags | map(select(startswith("pitkley/dfw"))) | .[]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+
+        # Copy the merged image from GHCR to Docker Hub for each tag
+        for tag in $dockerhub_tags; do
+          echo "Copying to $tag"
+          docker buildx imagetools create \
+            --tag "$tag" \
+            ghcr.io/pitkley/dfw:${{ steps.meta.outputs.version }}
+        done
+
+    - name: Inspect Docker Hub image
+      if: github.event_name == 'push'
+      run: |
+        docker buildx imagetools inspect pitkley/dfw:${{ steps.meta.outputs.version }}

From d775844d3fdb3a6fa6f592902d0e09c771b336d2 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 14:06:16 +0200
Subject: [PATCH 4/7] chore: address smaller lint errors

---
 build.rs      | 4 ++++
 src/errors.rs | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/build.rs b/build.rs
index ab1fe59f..387e2fbd 100644
--- a/build.rs
+++ b/build.rs
@@ -16,4 +16,8 @@ fn main() {
         r#"cargo:rustc-cfg=crate_major_version="{}""#,
         crate_version.part(0).unwrap()
     );
+    println!(
+        r#"cargo::rustc-check-cfg=cfg(crate_major_version, values("{}"))"#,
+        crate_version.part(0).unwrap()
+    );
 }
diff --git a/src/errors.rs b/src/errors.rs
index ed347571..f89c97ab 100644
--- a/src/errors.rs
+++ b/src/errors.rs
@@ -11,7 +11,7 @@
 //!
 //! [failure]: https://crates.io/crates/failure
 
-#![allow(missing_docs)]
+#![allow(missing_docs, non_local_definitions)]
 
 use failure::{Error, Fail};
 

From 83bf2a283174d70e941d190485b0308f20a998a8 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 13:55:33 +0200
Subject: [PATCH 5/7] chore: upgrade time to 0.3.36 to fix build errors

---
 Cargo.lock | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d1d4479e..87c2f5a4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -892,6 +892,12 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-traits"
 version = "0.2.17"
@@ -1482,13 +1488,14 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
  "libc",
+ "num-conv",
  "num_threads",
  "powerfmt",
  "serde",
@@ -1504,10 +1511,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 

From a1c4999a3151246d3dadbb610eda56a2e1bb1630 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 18:38:45 +0200
Subject: [PATCH 6/7] chore: migrate IT testing to use `docker compose`

---
 .github/workflows/it.yml |  4 ++--
 tests/dfw.rs             | 16 +++++++++-------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/it.yml b/.github/workflows/it.yml
index 60a87811..e644b137 100644
--- a/.github/workflows/it.yml
+++ b/.github/workflows/it.yml
@@ -56,9 +56,9 @@ jobs:
       matrix:
         include:
         - dind-image: docker:24.0-dind
-          runs-on: ubuntu-latest
+          runs-on: ubuntu-24.04
         - dind-image: docker:23.0-dind
-          runs-on: ubuntu-latest
+          runs-on: ubuntu-24.04
         - dind-image: docker:20.10-dind
           runs-on: ubuntu-20.04
         - dind-image: docker:19.03-dind
diff --git a/tests/dfw.rs b/tests/dfw.rs
index 01f3181f..a8fd1527 100644
--- a/tests/dfw.rs
+++ b/tests/dfw.rs
@@ -107,32 +107,34 @@ where
     F: UnwindSafe,
 {
     // Create and start environment
-    let mut child = Command::new("docker-compose")
+    let mut child = Command::new("docker")
+        .args(&["compose"])
         .args(&["--project-name", project_name])
         .args(&["--file", compose_path])
         .args(&["up", "-d"])
         .spawn()
-        .expect("failed to setup Docker environment using docker-compose");
+        .expect("failed to setup Docker environment using docker compose");
 
-    let up_exit_code = child.wait().expect("failed to wait on docker-compose");
+    let up_exit_code = child.wait().expect("failed to wait on docker compose");
 
     if !up_exit_code.success() {
-        panic!("docker-compose did not exit successfully");
+        panic!("docker compose did not exit successfully");
     }
 
     // Run the body, catching any potential panics
     let panic_result = panic::catch_unwind(body);
 
     // Cleanup started environment
-    let mut child = Command::new("docker-compose")
+    let mut child = Command::new("docker")
+        .args(&["compose"])
         .args(&["--project-name", project_name])
         .args(&["--file", compose_path])
         .args(&["down", "--volumes"])
         .args(&["--rmi", "local"])
         .spawn()
-        .expect("failed to stop Docker environment using docker-compose");
+        .expect("failed to stop Docker environment using docker compose");
 
-    child.wait().expect("failed to wait on docker-compose");
+    child.wait().expect("failed to wait on docker compose");
 
     // Resume unwinding potential panics
     if let Err(err) = panic_result {

From 965fcfbf3800401579c89af8edc300c6b2a2acc5 Mon Sep 17 00:00:00 2001
From: Pit Kleyersburg <pitkley@googlemail.com>
Date: Sat, 25 Oct 2025 18:39:08 +0200
Subject: [PATCH 7/7] TEMP

---
 .github/workflows/docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b9a84169..1126d70f 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -36,7 +36,7 @@ jobs:
           runner: ubuntu-24.04-arm
           arch: arm64
         - platform: linux/arm/v7
-          runner: ubuntu-24.04-arm
+          runner: ubuntu-24.04 #-arm
           arch: armv7
 
     steps: