ci: add multi-arch Docker image test workflow

[Komzpa]

Overview

This PR is a cleaned-up follow-up to the earlier multi-architecture work in #432 and the ImreSamu/docker-postgis-test prototype.

The practical problem is that Docker PostGIS has accumulated several ARM-related PRs and comments, but the hard part is not only "build an arm64 image". The publish workflow also has to prove that both architectures were tested, assemble the manifest list from the correct per-platform digests, and avoid accidentally publishing a partial tag when one side of the matrix failed.

This PR keeps that risk contained by adding a separate trial workflow, .github/workflows/test.yml, while leaving the existing .github/workflows/main.yml untouched.

What This Adds

• Builds release Docker images on both ubuntu-24.04 and ubuntu-24.04-arm.
• Runs the same docker-library/official-images tests used by the existing workflow before any publish-capable step.
• Uses digest-based image pushes, then assembles Docker manifest lists from those tested platform images.
• Verifies that pushed manifest tags contain the expected platforms, currently linux/amd64 and linux/arm64.
• Accepts Docker's ARM64 variant spelling, for example linux/arm64/v8, when the expected platform is the generic linux/arm64.
• Re-pulls the final published manifest tag on both amd64 and arm64 runners and reruns the official-images tests against the resolved image.
• Updates the Docker Hub description only after the published images pass those post-publish tests.

Safety Model

PR runs are test-only. They build and test images, but they do not push Docker Hub tags or update the Docker Hub description.

The publish-capable path is gated to non-PR runs on canonical master. Even there, it publishes to the configured test repository, postgis/docker-postgis-test, not directly to the production postgis/postgis repository.

The workflow also uses run-id and run-attempt-scoped image/artifact names, plus per-tag manifest concurrency, so reruns do not collide with older artifacts or with another run assembling the same tag.

Matrix Generation

The workflow uses a generated matrix.yml so the CI target list follows the image directories instead of being hand-maintained in the workflow file.

update.sh now regenerates that matrix. The current generated matrix includes the active release targets from the repository, including PostgreSQL 19 beta targets and current Alpine/PostGIS tags, while skipping placeholder or development-only targets such as the 17-3.6 Debian placeholder and *-master entries for the required release matrix.

Local Validation

• bash -n update.sh ci/matrix.sh ci/test-image.sh ci/push-manifest.sh ci/prepare-dockerhub-readme.sh
• shellcheck ci/matrix.sh ci/test-image.sh ci/push-manifest.sh ci/prepare-dockerhub-readme.sh
• RUNNER_PLATFORMS_JSON='["ubuntu-24.04","ubuntu-24.04-arm"]' bash ci/matrix.sh
• Ruby YAML parse for .github/workflows/test.yml and matrix.yml
• git diff --check
• actionlint .github/workflows/*.yml
• jq smoke checks for manifest-platform verification, including linux/arm64/v8 satisfying expected linux/arm64
• Earlier local smoke build and official-images test for 17-3.5:
  • docker build -t postgis/postgis:ci-local-17-3.5-default 17-3.5
  • bash ci/test-image.sh postgis/postgis:ci-local-17-3.5-default
  • observed postgres-basics, postgres-initdb, and postgis-basics passing

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f0b1ef2c40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9481ec294

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".