[SteveGilvarry]

The arm64 images were built under QEMU on an amd64 runner. The ZoneMinder install step alone took about 11 minutes there, and only amd64 ran the smoke test. GitHub's free ubuntu-24.04-arm runners remove both problems.

images.yml now has three jobs, following Docker's multi-runner pattern:

• prep, per channel: resolves the ZoneMinder version and tags once, then passes them on as an artifact. Both architectures install the same build. The nightly still uses the version pin from Fix the nightly multi-arch push #103.
• build, per channel and architecture, 4 jobs: runs tests/smoke.sh natively, so arm64 is now smoke-tested too. On master it then pushes zm, zm-es and pyzm-serve untagged, by digest. Each architecture has its own build cache scope.
• merge, per channel: joins the two digests into one multi-arch index under every tag, in both zoneminder/zoneminder and zoneminderhq/zoneminder. It runs even if the other channel failed, so a broken nightly doesn't hold back latest. If a channel is missing a digest, its own merge fails.

The QEMU setup step is gone. #106's daily no-cache rebuild stays, and it now costs about a minute on arm64 instead of 11.

Tested:

• actionlint passes, shellcheck included.
• On a throwaway local registry on warlock, I ran the merge step's script as written, against per-arch push-by-digest builds. Every tag got one index with amd64, arm64 and their attestations. The zoneminderhq copy holds both architectures with the right image in each. With a digest removed, the merge fails with the error message.
• This PR's CI runs the smoke test on both architectures for both channels.
• Not yet run: the real push and merge to Docker Hub. It runs on merge, or earlier through workflow_dispatch with test_push, which pushes to the -test repos.

Fix found by the first run: the arm64 nightly job failed. zmrepo had nightly build .212 for amd64 but not yet for arm64, because each architecture's nightly is built separately. The old QEMU push would have failed the same way. zm-version.sh now accepts amd64,arm64 and returns the newest build that both have (here .210), plus the apt pin. I tested it under dash for nightly and release on trixie and noble, plus an architecture zmrepo doesn't have, which fails with a clear message.

Pushing to Docker Hub also leaves untagged per-arch manifests in zoneminder/zoneminder and zoneminder/pyzm-serve, because the merged tags point at them. This is the standard pattern.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CKoPm5qySMSsCYJmCo8r2J