runner: Build containers for both Ubuntu Focal and Ubuntu Noble

We can now pass a custom UBUNTU_VERSION value to build a specific version of the container.
The name of the container needs to be changed to account for the version name.

Signed-off-by: Manu Bretelle <[email protected]>

.github/workflows/publish.yml

@@ -39,6 +39,8 @@ jobs:
       id-token: write
     strategy:
       matrix:
+        ubuntu_version: [focal, noble]
+        arch: [s390x, aarch64, x86_64]
         include:
           - arch: s390x
             dockerfile: s390x.Dockerfile
@@ -89,7 +91,7 @@ jobs:
           flavor: |
             latest=auto
             prefix=
-            suffix=-${{ matrix.arch }}
+            suffix=-${{ matrix.ubuntu_version }}-${{ matrix.arch }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
@@ -103,6 +105,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ matrix.platform }}
+          build-args: UBUNTU_VERSION=${{ matrix.ubuntu_version }}
 
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker

s390x.Dockerfile

@@ -2,8 +2,10 @@
 ARG UBUNTU_VERSION=focal
 # Temporary image: amd64 dependencies.
 FROM amd64/ubuntu:${UBUNTU_VERSION} as ld-prefix
+# Redefining UBUNTU_VERSION without a value inherits the global default
+ARG UBUNTU_VERSION
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get -y install ca-certificates libicu66 libssl1.1
+RUN apt-get update && apt-get -y install ca-certificates $(test ${UBUNTU_VERSION} = "focal" && echo libicu66 libssl1.1 || echo libicu74 libssl)
 
 # Main image.
 FROM s390x/ubuntu:${UBUNTU_VERSION}