ci: add Linux build image workflow

.github/workflows/build-linux-image.yml

@@ -0,0 +1,155 @@
+name: Build Linux Build Image
+
+on:
+  push:
+    branches:
+      - ci/linux-build-image
+    paths:
+      - .dockerignore
+      - .gitmodules
+      - .github/workflows/build-linux-image.yml
+      - docker/linux-build/**
+      - xmake.lua
+      - xmake/**
+      - thirdparty/**
+      - submodules/xmake.lua
+      - submodules/minirtc
+      - submodules/minirtc/xmake.lua
+      - submodules/minirtc/thirdparty/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: crossdesk/ubuntu22.04
+  STACK_TAG: buildenv-cuda12.6.3-xmake3.0.9-rust1.92.0
+  XMAKE_VERSION: 3.0.9
+  RUST_VERSION: 1.92.0
+  RUSTUP_VERSION: 1.28.2
+
+jobs:
+  build:
+    name: Build candidate (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+            base_image: nvidia/cuda:12.6.3-devel-ubuntu22.04
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            base_image: ubuntu:22.04
+    steps:
+      - name: Set candidate tag
+        id: image
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+          echo "candidate=${CANDIDATE_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: Checkout source
+        uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push candidate
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/linux-build/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          pull: true
+          tags: ${{ steps.image.outputs.candidate }}
+          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:${{ env.STACK_TAG }}
+          cache-to: type=inline
+          provenance: false
+          sbom: false
+          build-args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            XMAKE_VERSION=${{ env.XMAKE_VERSION }}
+            RUST_VERSION=${{ env.RUST_VERSION }}
+            RUSTUP_VERSION=${{ env.RUSTUP_VERSION }}
+
+  verify:
+    name: Verify candidate (${{ matrix.arch }})
+    needs: build
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Set candidate tag
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Verify tools, architecture, and Ubuntu baseline
+        run: |
+          docker pull "${CANDIDATE_TAG}"
+          docker run --rm \
+            --env EXPECTED_ARCH="${{ matrix.arch }}" \
+            "${CANDIDATE_TAG}" \
+            verify-crossdesk-build-image
+
+  publish:
+    name: Publish multi-arch image
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Promote verified candidates
+        run: |
+          AMD64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-amd64"
+          ARM64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-arm64"
+
+          docker buildx imagetools create \
+            --tag "${IMAGE_NAME}:${STACK_TAG}" \
+            --tag "${IMAGE_NAME}:sha-${GITHUB_SHA}" \
+            --tag "${IMAGE_NAME}:latest" \
+            "${AMD64_IMAGE}" \
+            "${ARM64_IMAGE}"
+
+      - name: Inspect published manifest
+        run: |
+          docker buildx imagetools inspect "${IMAGE_NAME}:${STACK_TAG}"

.github/workflows/build.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - "**"
+      - "!ci/linux-build-image"
     tags:
       - "*"
   workflow_dispatch:
@@ -27,13 +28,13 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-22.04
-            image: crossdesk/ubuntu20.04:latest
+            runner: ubuntu-24.04
+            image: crossdesk/ubuntu22.04:buildenv-cuda12.6.3-xmake3.0.9-rust1.92.0
             package_script: ./scripts/linux/pkg_amd64.sh
 
           - arch: arm64
-            runner: ubuntu-22.04-arm
-            image: crossdesk/ubuntu20.04-arm64v8:latest
+            runner: ubuntu-24.04-arm
+            image: crossdesk/ubuntu22.04:buildenv-cuda12.6.3-xmake3.0.9-rust1.92.0
             package_script: ./scripts/linux/pkg_arm64.sh
 
     container:
@@ -99,12 +100,14 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Verify Linux build image
+        run: verify-crossdesk-build-image
+
       - name: Build CrossDesk
         env:
           CUDA_PATH: /usr/local/cuda
           XMAKE_GLOBALDIR: /data
         run: |
-          apt install -y libxft-dev
           xmake f --CROSSDESK_VERSION=${LEGAL_VERSION} --USE_CUDA=true --root -y
           xmake b -vy --root crossdesk
 
@@ -113,6 +116,14 @@ jobs:
           chmod +x ${{ matrix.package_script }}
           ${{ matrix.package_script }} ${LEGAL_VERSION}
 
+      - name: Verify packaged Ubuntu 22.04 glibc baseline
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-linux-${{ matrix.arch }}-${LEGAL_VERSION}.deb"
+          VERIFY_DIR="${RUNNER_TEMP}/crossdesk-glibc-${{ matrix.arch }}"
+          install -d "${VERIFY_DIR}"
+          dpkg-deb --extract "${PACKAGE_FILE}" "${VERIFY_DIR}"
+          verify-crossdesk-glibc-baseline "${VERIFY_DIR}" 2.35
+
       - name: Upload artifact
         uses: actions/upload-artifact@v6
         with:
@@ -189,6 +200,9 @@ jobs:
       - name: Install xmake
         run: brew install xmake
 
+      - name: Update xmake repositories
+        run: xmake repo -u
+
       - name: Checkout code
         uses: actions/checkout@v5
 
@@ -275,6 +289,7 @@ jobs:
         run: |
           Invoke-Expression (Invoke-Webrequest 'https://raw.githubusercontent.com/tboox/xmake/master/scripts/get.ps1' -UseBasicParsing).Content
           echo "C:\Users\runneradmin\xmake" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          xmake repo -u
           xmake create cuda
           Set-Location cuda
           xmake g --theme=plain