From fd84283ecfecc2bc3ca8ff06654edf0f166411f6 Mon Sep 17 00:00:00 2001
From: Will Szumski <will@stackhpc.com>
Date: Thu, 16 Jul 2026 12:54:51 +0100
Subject: [PATCH] Pin all actions, enable multiarch build

---
 .github/workflows/build-and-push-images.yaml | 15 +++++++++++---
 Dockerfile                                   | 21 +++++++++++++-------
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-and-push-images.yaml b/.github/workflows/build-and-push-images.yaml
index dad344c..aab22a0 100644
--- a/.github/workflows/build-and-push-images.yaml
+++ b/.github/workflows/build-and-push-images.yaml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
         if: github.event_name != 'pull_request'
         with:
           registry: ${{ env.REGISTRY }}
@@ -35,7 +35,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -46,10 +46,19 @@ jobs:
             # set latest tag for default branch
             type=raw,value=latest,enable={{is_default_branch}}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: .
+          platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
index 347b822..d4f621a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,8 @@ FROM rockylinux:9
 
 ARG BUILD_DATE
 ARG VCS_REF
-ARG REPO=http://linux.mellanox.com/public/repo/mlnx_ofed/latest-23.10/rhel9.4/mellanox_mlnx_ofed.repo
+ARG TARGETARCH
+ARG VERSION=3.2.3
 
 LABEL \
     org.label-schema.name="jumanjiman/opensm" \
@@ -16,12 +17,18 @@ LABEL \
     org.label-schema.original-repo-url="https://github.com/jumanjihouse/docker-opensm" \
     org.label-schema.modified-by="Tom Clark <tom@stackhpc.com>"
 
-RUN dnf install -y 'dnf-command(config-manager)' \
-    && dnf config-manager --add-repo https://linux.mellanox.com/public/repo/doca/3.2.3/rhel9/x86_64/ \
-    && rpm --import https://linux.mellanox.com/public/repo/doca/3.2.3/rhel9/x86_64/RPM-GPG-KEY-doca \
-    && dnf install -y doca-ofed \
-    && dnf clean all \
-    && rm -rf /var/cache/dnf
+RUN set -eux; \
+    dnf install -y 'dnf-command(config-manager)'; \
+    case "${TARGETARCH}" in \
+      amd64) repo_arch=x86_64 ;; \
+      arm64) repo_arch=arm64-sbsa ;; \
+      *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    dnf config-manager --add-repo "https://linux.mellanox.com/public/repo/doca/${VERSION}/rhel9/${repo_arch}/"; \
+    rpm --import "https://linux.mellanox.com/public/repo/doca/${VERSION}/rhel9/${repo_arch}/RPM-GPG-KEY-doca"; \
+    dnf install -y doca-ofed; \
+    dnf clean all; \
+    rm -rf /var/cache/dnf
 
 # The following environment variables control opensm behavior:
 #