feat(packages): auto-exclude single-arch images from multi-arch collection

[wuhuizuo]

What

Fix hotfix/ticdc-style builds never producing multi-arch images.

The multi-arch collection is atomic over the images built for both architectures. ticdc release builds four images, but the three test tools (kafka-consumer, pulsar-consumer, storage-consumer) are amd64-only, so the atomic pre-flight never succeeds and even pingcap/ticdc/image gets no multi-arch manifest.

• Derive single-arch images at generation time: when generating the build script for one architecture, also render the same component/router/profile for the other architecture and collect its image repos. Image repos missing there get multi_arch: false.
• The build script then excludes these images from both the atomic pre-flight check and the crane index append collection, so they neither block nor take part in the multi-arch tagging.
• The field is derived, not hand-maintained, so it can not go stale when an artifact's arch condition changes (multi_arch is auto-restored if the other architecture starts building the image).

Related: #1056.

Why not detect at runtime

The collect-multi-arch step runs inside each architecture's own Tekton task (PingCAP-QE/ci:tekton/v1/tasks/pingcap-build-images.yaml). Runtime "does the other-arch image exist" is racy: the first task to finish sees the other arch as missing, and if it did per-image collection it could create partial/duplicate manifests. Deriving the set at generation time preserves the atomic semantics that #1056 introduced.

Changes

• packages/scripts/gen-package-images-with-config.sh: add mark_single_arch_images (cross-arch render + auto mark multi_arch: false).
• packages/scripts/build-package-images.sh.tmpl: skip multi_arch: false images in the pre-flight and collection loops.
• .github/scripts/ci.sh: cover ticdc release image generation and assert cdc participates while the three test tools are excluded.

No packages.yaml.tmpl change is needed.

Verification

• Generated ticdc release v8.5.8 scripts for amd64/arm64 (hotfix tagging): both collect functions only reference pingcap/ticdc/image.
• tidb/tiflow and other multi-arch components: zero images marked as single-arch.
• Ran test_gen_package_images_script and test_gen_package_images_script_freedom_releasing end to end; shellcheck -S error passes.

[ti-chi-bot]

I have already done a preliminary review for you, and I hope to help you do a better job.

Summary
This PR improves multi-architecture image builds by automatically excluding single-arch images (like some test tools in ticdc) from the atomic multi-arch image collection process. It does so by rendering the build configuration for the "other" architecture at generation time and marking images missing there with multi_arch: false, which is then respected during multi-arch manifest creation. The approach is well-structured, keeps the marking in sync with actual image availability, and includes necessary test coverage to validate the new behavior.

---

Critical Issues

• None found.

---

Code Improvements

• mark_single_arch_images function complexity and error handling

  • File: packages/scripts/gen-package-images-with-config.sh, lines 42-105
  • Currently, if gomplate or yq commands fail, the script proceeds silently which may cause silent mis-marking or incomplete data.
  • Suggestion: Add explicit error checks after important commands like gomplate and yq invocations to fail fast and give clear error messages. For example:

    gomplate ... || { echo "❌ Failed to render template for other arch $other_arch"; exit 1; }

  • Also consider capturing and logging any errors from yq when querying .artifacts to aid debugging.

• Repeated use of yq in a loop

  • File: packages/scripts/gen-package-images-with-config.sh, lines 95-105
  • The loop queries .artifacts length and each .artifacts[$index] individually via multiple yq calls, which can be inefficient.
  • Suggestion: Instead, consider extracting all artifact repos and indices in one go (e.g., using yq to output JSON or a list) and iterate in Bash, reducing process calls and improving speed.

• Hardcoded file names and cleanup

  • Temporary files like "release-context-${other_arch}.yaml" and "release-packages-${other_arch}.yaml" are created and removed.
  • It’s safer to use mktemp for generating temporary files to avoid conflicts and ensure proper cleanup, especially in parallel or CI runs.

• extract_multi_arch_body function simplification

  • File: .github/scripts/ci.sh, lines 298-303
  • The awk command may be brittle if the function code changes indentation or structure.
  • Suggestion: Consider using a more robust parsing approach or at least add comments explaining assumptions. Alternatively, grep the function start and use a delimiter to extract the entire function body.

---

Best Practices

• Missing comments and documentation in new functions

  • File: packages/scripts/gen-package-images-with-config.sh
  • The new function mark_single_arch_images and helper other_arch_of lack function-level comments summarizing their purpose, inputs, and outputs.
  • Suggestion: Add concise docstrings for them, e.g.:

    # mark_single_arch_images marks images in the router file as multi_arch: false if they are missing in the other architecture's package definition.
    # Arguments:
    #   $1 - component name
    #   $2 - OS
    #   $3 - architecture
    #   $4 - profile match string
    #   $5 - template file path
    #   $6 - router yaml file path

• Test assertions could include failure messages

  • File: .github/scripts/ci.sh, lines 305-333
  • The assert_image_in_multi_arch and assert_image_excluded_from_multi_arch functions exit on failure but the error message only prints to stdout.
  • Suggestion: Use echo >&2 for error messages to ensure failures are clearly visible in CI logs.

• Shellcheck usage

  • The usage of shellcheck -S error packages/scripts/build-package-images.sh is good.
  • Consider adding similar linting for gen-package-images-with-config.sh to catch possible shell scripting issues early.

• Variable scopes and quoting

  • In the new scripts, ensure all variable expansions are properly quoted to prevent word splitting or globbing issues, e.g.:

    if ! grep -qxF -- "$repo" <<< "$other_repos"; then

    is correct, but verify all expansions in the new code follow this pattern consistently.

---

Overall, the implementation achieves the stated goal in a clean and maintainable way. The above suggestions mostly target robustness, error handling, and maintainability improvements that will enhance long-term stability and debuggability.

[wuhuizuo]

/approve

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wuhuizuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [wuhuizuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment