ci: build arm64 sandbox-api and hub images, submit arm64 mk3 builds

[devin-ai-integration]

Summary

Makes the whole sandbox build chain able to produce ARM sandboxes. amd64 behaviour is unchanged: arm64 is opt-in through a new architectures workflow_dispatch input (amd64 | arm64 | amd64,arm64, default amd64), which becomes a matrix dimension for both hub jobs.

• sandbox-api: the arm64 job existed but ran platforms: linux/arm64 on an amd64 runner with no QEMU and continue-on-error: true, so its digest was usually missing from the manifest list. It now runs on a native ubuntu-24.04-arm runner (the binary is cgo/static-pie linked, so it can't be cross-compiled), is no longer allowed to fail, and the manifest job waits for it. The multi-arch sandbox:develop manifest is what makes the hub FROM ghcr.io/blaxel-ai/sandbox:${SANDBOX_VERSION} stage resolve per-arch for free.

• hub images: built per arch on the matching runner and pushed under an -arm64 suffixed tag (develop-arm64, v1.2.3-arm64, …) rather than merged into one manifest, since the downstream mk3 artifacts are per-arch anyway. GHA cache scope is now per sandbox+arch.

• mk3 build: scripts/mk3-build.sh takes ARCH (default amd64) and derives

  PLATFORM=linux/$ARCH
  ARTIFACT_TAG=$IMAGE_TAG[-arm64]         # S3 key + registered image tag
  IMAGE_REF=$SRC_REGISTRY:$BASE_IMAGE_TAG[-arm64]
  batch command: ["--image", $IMAGE_REF, "--platform", $PLATFORM]
  

  so arm64 artifacts land next to the amd64 ones (s3://…/sbx/<name>/<tag>-arm64) and are registered in PUT /admin/images under the -arm64 tag. The publish-sandbox.sh step (which points the hub store entry at blaxel/<name>:latest) only runs for amd64, so the store keeps advertising the amd64 image.

Requires blaxel-ai/metamorph#81 (arch-aware kernel/wrapper/blfs selection) to be deployed for --platform linux/arm64 builds to produce usable artifacts.

Link to Devin session: https://app.devin.ai/sessions/1f2fece946bb4e74b9bd1d42b5645be7
Requested by: @Joffref

---

Note

^{Cursor Bugbot is generating a summary for commit 9d5ff97. Configure here.}

---

Note

Adds arm64 matrix exclusions for hub images that cannot be built on arm64 (jupyter-server, vibekit-*). The exclusion list is generated as a job output and applied to both build-ghcr-hub and build-s3-hub matrix strategies.

^{Written by Mendral for commit 339a790.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 218b77b. Configure here.}

[mendral-app]

🧪 Testing Guide

What this PR addresses

This PR enables ARM64 (aarch64) builds for the sandbox ecosystem. Previously, the arm64 sandbox-api job ran on an amd64 runner with continue-on-error: true (effectively broken/no-op). This PR:

1. Switches the arm64 sandbox-api build to a native ubuntu-24.04-arm runner and removes continue-on-error.
2. Adds an architectures workflow_dispatch input (amd64 | arm64 | amd64,arm64) so arm64 hub image builds are opt-in.
3. Updates hub Dockerfiles (benchmark, docker-in-sandbox) to use a build-arg-based COPY --from= stage so the correct architecture's sandbox-api binary is pulled.
4. Updates mk3-build.sh to pass --platform and use arch-suffixed tags/S3 paths for arm64 artifacts.

Steps to verify (CI/workflow-level change)

Since this is a CI infrastructure change, there are no local reproduction steps. Instead, validate:

1. Workflow syntax: Confirm the modified .github/workflows/build.yaml passes GitHub Actions' schema validation (the CI check on this PR itself should confirm this).
2. Default behavior unchanged: With the default architectures: amd64 input, verify the matrix does not include arm64 jobs — only existing amd64 builds should run.
3. Arm64 opt-in path: Trigger a manual workflow_dispatch with architectures: amd64,arm64 on a non-main branch and verify:
   • sandbox-api-build-arm64 runs on ubuntu-24.04-arm (not ubuntu-latest).
   • Hub images for arm64 are tagged with an -arm64 suffix (e.g., branch-sha-arm64).
   • Excluded sandboxes (jupyter-server, vibekit-*) are skipped for arm64.
4. Dockerfile correctness: Confirm hub/benchmark/Dockerfile and hub/docker-in-sandbox/Dockerfile still build for amd64 (the SANDBOX_VERSION build-arg defaults to latest which should resolve the correct arch).
5. mk3-build.sh: Verify the script correctly rejects unsupported ARCH values and produces arch-suffixed S3 paths/tags only for non-amd64.

What to verify (expected behavior)

• No regression for amd64: All existing amd64 builds, tags, and publish steps behave identically to before this PR.
• arm64 builds produce valid images: When opted in, the arm64 sandbox-api and hub images are pushed to GHCR with -arm64 suffixed tags.
• sandbox-api manifest job now depends on both arch builds (sandbox-api-build + sandbox-api-build-arm64) and fails properly if either fails (no more continue-on-error silently swallowing arm64 failures).
• GHA cache isolation: Each sandbox×arch combination uses its own cache scope (scope=${{ matrix.sandbox }}-${{ matrix.arch }}), preventing cache collisions between architectures.
• Publish step skipped for arm64: The "Publish sandbox" step in build-s3-hub only runs for matrix.arch == 'amd64', so hub store entries continue pointing at amd64 images.

Note

Posted by PR Testing Guide · Tag @mendral-app with feedback.

[mendral-app]

LGTM

The new commit correctly excludes arm64-incompatible images from the matrix using GitHub Actions' native exclude mechanism. The exclusion JSON structure [{sandbox: ..., arch: "arm64"}] matches the matrix dimension names. The overall PR is solid: native arm64 runner, proper if guard against stale sandbox-api, arch-aware mk3 build, and Dockerfile parameterization all look correct.

_{Tag @mendral-app with feedback or questions. View session}