[proxy] Build the UBI image for arm64 and give its CI tags a suffix

The tag-and-push step mapped the UBI proxy image to the same pr-N, main
and sha-* tags as the distroless image, so whichever was pushed last
replaced the other. Keep a -ubi suffix, as the client variants already do.

License collection now takes a list of architectures and unions the Go
modules across them, matching the client script.

.github/workflows/release.yml

@@ -302,10 +302,12 @@ jobs:
           tag_and_push() {
             local src="$1" img_name tag dst variant=""
             img_name="${src%%:*}"
-            # Client variants share a repository, so keep their tag suffixes.
+            # Variants share a repository with their default image, so keep
+            # their tag suffixes. Order matters: the first matching pattern wins.
             case "$src" in
               *-rootless-ubi-amd64) variant="-rootless-ubi" ;;
               *-rootless-amd64) variant="-rootless" ;;
+              *-ubi-amd64) variant="-ubi" ;;
             esac
             for tag in $(resolve_tags); do
               dst="${img_name}:${tag}${variant}"

.goreleaser.yaml

@@ -494,15 +494,15 @@ dockers_v2:
      dockerfile: proxy/Dockerfile.ubi
      platforms:
        - linux/amd64
+       - linux/arm64
      build_args:
        VERSION: "{{ .Version }}"
        RELEASE: "{{ .Timestamp }}"
      hooks:
        pre:
-         - cmd: 'sh proxy/collect-licenses.sh "{{ .ContextDir }}/licenses"'
+         - cmd: 'sh proxy/collect-licenses.sh "{{ .ContextDir }}/licenses" amd64 arm64'
            env:
              - GOOS=linux
-             - GOARCH=amd64
              - CGO_ENABLED=0
      labels:
        "org.opencontainers.image.created": "{{.Date}}"

proxy/collect-licenses.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 set -eu
 
-if [ "$#" -ne 1 ]; then
-	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY" >&2
+if [ "$#" -lt 2 ]; then
+	printf '%s\n' "usage: $0 OUTPUT_DIRECTORY GOARCH..." >&2
 	exit 2
 fi
 
@@ -14,6 +14,7 @@ if [ -z "$output_name" ] || [ "$output_name" = . ] || [ "$output_name" = .. ] ||
 fi
 output_parent=$(CDPATH= cd -- "$(dirname "$1")" && pwd)
 output="$output_parent/$output_name"
+shift
 modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.modules.XXXXXX")
 sorted_modules=$(mktemp "${TMPDIR:-/tmp}/netbird-proxy-licenses.sorted.XXXXXX")
 
@@ -32,8 +33,10 @@ cp "$repo_root/LICENSE" "$staging/BSD-3-Clause.txt"
 node "$repo_root/proxy/web/scripts/third-party-licenses.mjs" >"$staging/Web-THIRD-PARTY-LICENSES"
 
 cd "$repo_root"
-GOOS=${GOOS:-linux} GOARCH=${GOARCH:-amd64} CGO_ENABLED=${CGO_ENABLED:-0} \
-	go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./proxy/cmd/proxy >"$modules"
+for arch in "$@"; do
+	GOOS=${GOOS:-linux} GOARCH="$arch" CGO_ENABLED=${CGO_ENABLED:-0} \
+		go list -deps -f '{{with .Module}}{{if .Replace}}{{.Replace.Path}}{{"\t"}}{{.Replace.Version}}{{"\t"}}{{.Replace.Dir}}{{else}}{{.Path}}{{"\t"}}{{.Version}}{{"\t"}}{{.Dir}}{{end}}{{end}}' ./proxy/cmd/proxy >>"$modules"
+done
 LC_ALL=C sort -u "$modules" >"$sorted_modules"
 
 goroot=$(go env GOROOT)