ci: Compile arm64 natively on the ubuntu-arm64 runner

The arm64 build cross-compiled with the Rust target triple inside an
amd64 container and copied the binary out, deliberately avoiding Docker
emulation because arm64 emulation is unreliable on some BuildKit
instances.

A dedicated Ubuntu VM on an M4 Mac Mini is now available under the
ubuntu-arm64 label. Each matrix entry carries its own runner label and a
native flag, so builds can be moved between runners or between build
modes without changing the workflow structure.

Where native is set, the build-native action compiles on the host and
assembles the artefact tree, leaving Docker to package it. It builds
into a target directory outside the per-run workspace so cargo can reuse
artefacts between runs. The Dockerfile's ARTIFACTS argument selects
whether artefacts come from the builder stage or from out/ in the build
context; prepper and the final image are unchanged. Libraries are
resolved where the binary was linked, so arm64 images carry Ubuntu's
rather than Debian's.

Architecture flags are split into TARGET_MARCH, which feeds -march for
the C and C++ compilers, and TARGET_RUSTFLAGS, which is appended to
RUSTFLAGS. amd64 passes haswell to both as before; arm64 passes +crc,
which rustc does not enable by default. TARGET_CPU still drives the tag
and artefact suffix.

.forgejo/workflows/release-image.yml

@@ -30,7 +30,7 @@ env:
 jobs:
   build-release:
     name: "Build ${{ matrix.slug }} (release)"
-    runs-on: dind
+    runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
@@ -41,14 +41,29 @@ jobs:
         include:
           - platform: "linux/amd64"
             slug: "linux-amd64"
+            runner: "dind"
+            march: ""
+            rust_cpu_flags: ""
           - platform: "linux/arm64"
             slug: "linux-arm64"
+            runner: "ubuntu-arm64"
+            native: true
+            march: "armv8-a+crc"
+            rust_cpu_flags: "-C target-feature=+crc"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+      - name: Compile on the runner host
+        if: matrix.native
+        uses: ./.forgejo/actions/build-native
+        with:
+          profile: "release"
+          features: "default"
+          march: ${{ matrix.march }}
+          rust-cpu-flags: ${{ matrix.rust_cpu_flags }}
       - name: Prepare Docker build environment
         id: prepare
         uses: ./.forgejo/actions/prepare-docker-build
@@ -73,8 +88,11 @@ jobs:
             GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
             CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
             TARGET_CPU=
+            TARGET_MARCH=${{ matrix.march }}
+            TARGET_RUSTFLAGS=${{ matrix.rust_cpu_flags }}
             RUST_PROFILE=release
             CARGO_FEATURES=default
+            ARTIFACTS=${{ matrix.native && 'artifacts-prebuilt' || 'artifacts-builder' }}
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.prepare.outputs.metadata_labels }}
           annotations: ${{ steps.prepare.outputs.metadata_annotations }}
@@ -115,7 +133,7 @@ jobs:
 
   build-maxperf:
     name: "Build ${{ matrix.slug }} (max-perf)"
-    runs-on: dind
+    runs-on: ${{ matrix.runner }}
     needs: build-release
     permissions:
       contents: read
@@ -128,15 +146,30 @@ jobs:
           - platform: "linux/amd64"
             slug: "linux-amd64"
             target_cpu: "haswell"
+            runner: "dind"
+            march: "haswell"
+            rust_cpu_flags: "-C target-cpu=haswell"
           - platform: "linux/arm64"
             slug: "linux-arm64"
             target_cpu: ""
+            runner: "ubuntu-arm64"
+            native: true
+            march: "armv8-a+crc"
+            rust_cpu_flags: "-C target-feature=+crc"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+      - name: Compile on the runner host
+        if: matrix.native
+        uses: ./.forgejo/actions/build-native
+        with:
+          profile: "release-max-perf"
+          features: "default,release_max_log_level"
+          march: ${{ matrix.march }}
+          rust-cpu-flags: ${{ matrix.rust_cpu_flags }}
       - name: Prepare max-perf Docker build environment
         id: prepare
         uses: ./.forgejo/actions/prepare-docker-build
@@ -161,8 +194,11 @@ jobs:
             GIT_REMOTE_COMMIT_URL=${{github.event.head_commit.url }}
             CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
             TARGET_CPU=${{ matrix.target_cpu }}
+            TARGET_MARCH=${{ matrix.march }}
+            TARGET_RUSTFLAGS=${{ matrix.rust_cpu_flags }}
             RUST_PROFILE=release-max-perf
             CARGO_FEATURES=default,release_max_log_level
+            ARTIFACTS=${{ matrix.native && 'artifacts-prebuilt' || 'artifacts-builder' }}
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.prepare.outputs.metadata_labels }}
           annotations: ${{ steps.prepare.outputs.metadata_annotations }}