👷(docker) add arm64 platform support for image builds

[StephanMeijer]

Purpose / Proposal

Adding support for linux/arm64 when building Docker images.

This is important because:

1. It enables to run La Suite on devices like the Raspberry Pi and Mac Mini. It will also make it easier for developers to contribute, as many are using Apple MacBooks with arm64 chips.
2. More and more providers (such as Hetzner) for infrastructure are offering arm64 support.
3. Sustainability is a point of interest (and sometimes condition) for organizations, commercially but specifically also governments, when they are buying infrastructure.

External contributions

• I have read and followed the contributing guidelines
• I have read and agreed to the Code of Conduct
• I have signed off my commits with git commit --signoff (DCO compliance)
• I have signed my commits with my SSH or GPG key (git commit -S)
• My commit messages follow the required format: <gitmoji>(type) title description
• I have added a changelog entry under ## [Unreleased] section (if noticeable change)
• I have added corresponding tests for new features or bug fixes (if applicable)

Testing happens when GitHub Workflows are being executed.

[StephanMeijer]

This PR relates to other PR's, namely:

• calc: 👷(docker) add arm64 platform support for image builds calc#14
• containers: 👷(docker) add arm64 platform support for image builds containers#1
• conversations: 👷(docker) add arm64 platform support for image builds conversations#296
• docs: 👷(docker) add arm64 platform support for image builds #1901
• drive: 👷(docker) add arm64 platform support for image builds drive#551
• e2esdk: 👷(docker) add arm64 platform support for image builds e2esdk#1
• find: 👷(docker) add arm64 platform support for image builds find#54
• meet: 👷(docker) add arm64 platform support for image builds meet#981
• meet-kyutai-moshi-stt: 👷(docker) add arm64 platform support for image builds meet-kyutai-moshi-stt#2
• meet-whisperx: 👷(docker) add arm64 platform support for image builds meet-whisperx#26
• messages: 👷(docker) add arm64 platform support for image builds messages#554
• people: 👷(docker) add arm64 platform support for image builds people#1070

[StephanMeijer]

Some executions of CI steps could show an error.

The actions docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3 are not allowed in suitenumerique/people because all actions must be from a repository owned by suitenumerique, created by GitHub, or match one of the patterns: actions/cache@v4, actions/checkout@v4, actions/deploy-pages@*, actions/setup-node@v4, actions/setup-python@v3, actions/setup-python@v5, actions/setup-python@v6, actions/upload-artifact@v4, aquasecurity/setup-trivy@v0.2.2, aquasecurity/trivy-action@0.29.0, astral-sh/setup-uv@v6, azure/setup-helm@v4, crowdin/github-action@v2, docker/build-push-action@v6, docker/login-action@v3, docker/metadata-action@v5, jsdaniell/create-json@v1.2.3, numerique-gouv/action-argocd-webhook-notification@main, numerique-gouv/action-trivy-cache@main, numerique-gouv/helm-gh-pages@add-overwrite-option, peter-evans/create-pull-request@v7.

The allowed actions list is configured in the organization's GitHub Settings. As I am an external contributor, I do not have access to modify these. I request the reviewer of this pull request to contact one of the people in this list: https://github.com/orgs/suitenumerique/people

This pull request introduces QEMU (for emulation) and buildx (for cross-platform docker builds). These are needed because GitHub Actions runners are linux/amd64. To build Docker images for linux/arm64 on an amd64 runner:

1. QEMU (docker/setup-qemu-action) provides CPU emulation so the runner can execute arm64 instructions
2. Buildx (docker/setup-buildx-action) extends Docker with multi-platform build support, using QEMU under the hood

Without these, the platforms: linux/amd64,linux/arm64 parameter on docker/build-push-action would fail. Therefore docker/setup-qemu-action@v3 and docker/setup-buildx-action@v3 should be whitelisted on organizational level before merging this pull request.

You can read more about it on github.com/docker/build-push-action.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-config-next@​15.5.9
	next@​15.5.9
	convert-stream@​1.0.2
	jest@​30.2.0
	workbox-webpack-plugin@​7.1.0
	lodash@​4.17.23
	crisp-sdk-web@​1.0.27
	vitest@​4.0.17
	clsx@​2.1.1
	express-ws@​5.0.2
	pngjs@​7.0.0
	i18next-parser@​9.3.0
	nodemon@​3.1.11
	cross-env@​10.1.0
	emoji-mart@​5.6.0
	stylelint-prettier@​5.0.3
	ts-node@​10.9.2
	vitest-mock-extended@​3.1.0
	eslint-plugin-react@​7.37.5
	canvg@​4.0.3
	tsc-alias@​1.8.16
	uuid@​13.0.0
	eslint-plugin-import@​2.32.0
	eslint-plugin-jsx-a11y@​6.10.2
	react@​19.2.3
	use-debounce@​10.1.0
	fetch-mock@​9.11.0
	node-fetch@​2.7.0
	luxon@​3.7.2
	react-select@​5.10.2
	react-intersection-observer@​10.0.2
	copy-webpack-plugin@​13.0.1
	yargs@​18.0.0
See 31 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@blocknote/server-util@0.46.2 → npm/i18next-parser@9.3.0 → npm/entities@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report