build: cross-compile in docker (#40136)

Building the backend under QEMU takes 46 to 54 minutes per foreign
platform in the nightly image build, against 7 minutes natively. The
backend stage now runs on the build platform and cross-compiles with
`GOOS`/`GOARCH`/`GOARM`, so every platform builds at native speed.

- `go generate` runs once instead of once per platform.
- The PR docker dry run builds all three platforms in a single job, on
any docker-related change.

---------

Signed-off-by: silverwind <me@silverwind.io>

.github/actions/docker-dryrun/action.yml

@@ -1,31 +0,0 @@
-name: docker-dryrun
-description: Composite action that performs the container build steps for a single platform.
-
-inputs:
-  platform:
-    description: "The target platform: linux/amd64, linux/arm64, linux/riscv64."
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
-      with:
-        cache-image: false
-    - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-    - name: Build regular image
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-      with:
-        context: .
-        platforms: ${{ inputs.platform }}
-        push: false
-        file: Dockerfile
-        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-    - name: Build rootless image
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-      with:
-        context: .
-        platforms: ${{ inputs.platform }}
-        push: false
-        file: Dockerfile.rootless
-        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless

.github/workflows/files-changed.yml

@@ -15,8 +15,6 @@ on:
         value: ${{ jobs.detect.outputs.templates }}
       docker:
         value: ${{ jobs.detect.outputs.docker }}
-      dockerfile:
-        value: ${{ jobs.detect.outputs.dockerfile }}
       swagger:
         value: ${{ jobs.detect.outputs.swagger }}
       yaml:
@@ -42,7 +40,6 @@ jobs:
       actions: ${{ steps.changes.outputs.actions }}
       templates: ${{ steps.changes.outputs.templates }}
       docker: ${{ steps.changes.outputs.docker }}
-      dockerfile: ${{ steps.changes.outputs.dockerfile }}
       swagger: ${{ steps.changes.outputs.swagger }}
       yaml: ${{ steps.changes.outputs.yaml }}
       json: ${{ steps.changes.outputs.json }}
@@ -103,16 +100,11 @@ jobs:
 
             docker:
               - ".github/workflows/pull-docker-dryrun.yml"
-              - ".github/actions/docker-dryrun/**"
               - "Dockerfile"
               - "Dockerfile.rootless"
               - "docker/**"
               - "Makefile"
 
-            dockerfile:
-              - "Dockerfile"
-              - "Dockerfile.rootless"
-
             swagger:
               - "templates/swagger/*.json"
               - "Makefile"

.github/workflows/pull-docker-dryrun.yml

@@ -14,34 +14,26 @@ jobs:
   files-changed:
     uses: ./.github/workflows/files-changed.yml
 
-  # QEMU-based build is slow (40-50 minutes), so run arm64 and riscv64 when dockerfile changes.
-  # Run amd64 when any docker-related files change, which is fast (4 minutes).
-  container-amd64:
+  container:
     if: needs.files-changed.outputs.docker == 'true'
     needs: [files-changed]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: ./.github/actions/docker-dryrun
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
         with:
-          platform: linux/amd64
-
-  container-arm64:
-    if: needs.files-changed.outputs.dockerfile == 'true'
-    needs: [files-changed]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: ./.github/actions/docker-dryrun
+          cache-image: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - name: Build regular image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
-          platform: linux/arm64
-
-  container-riscv64:
-    if: needs.files-changed.outputs.dockerfile == 'true'
-    needs: [files-changed]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: ./.github/actions/docker-dryrun
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
+      - name: Build rootless image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
-          platform: linux/riscv64
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          file: Dockerfile.rootless
+          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless