Cuts Docker Hub publish time from ~40 min to ~3 min on warm cache (and ~13 min on cold cache) by splitting the per-arch builds onto native runners and restructuring the Python dep install into a cache-friendly layer.

Before: one ubuntu-latest job built both arches via QEMU emulation. Every main push took 38-45 min, with arm64 eating ~80% of the wall clock because it ran under emulation and shared a gha cache scope with amd64, so the two arches clobbered each other's layer cache between runs.

After: three jobs run in parallel — build-amd64 on ubuntu-latest, build-arm64 on ubuntu-24.04-arm (GitHub's free native arm64 runner, no QEMU), and merge that stitches the per-arch digests into a single multi-arch manifest using docker buildx imagetools create. Cache scopes are separated per-arch (scope=docker-amd64 / scope=docker-arm64), and the Dockerfile's Python dep install was hoisted above COPY . . so source-only commits skip the ~4-5 min dep resolve entirely.

All existing safety behavior is preserved: per-commit sha-<sha> tags, the org.opencontainers.image.revision OCI label, the dashboard subcommand smoke test (#9153 regression guard), and the race-safe :latest advancement via the move-latest job.

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• .github/workflows/docker-publish.yml — replaced the single build-and-push job with four: build-amd64 (native, runs smoke tests + dashboard --help regression guard, pushes by digest), build-arm64 (native on ubuntu-24.04-arm, pushes by digest), merge (stitches digests into :sha-<sha> on main or :<release_tag> on release), and move-latest (unchanged ancestor-check logic, now gated on needs: merge). Cache scoped per-arch. Top-level cancel-in-progress: false preserved.
• .github/workflows/docker-publish.yml — flipped move-latest's own concurrency to cancel-in-progress: false for defense-in-depth. The top-level concurrency group already serializes runs for the ref, so the old cancel=true on move-latest was dead code; if top-level is ever loosened, queued move-latests will now run serially in arrival order instead of cancelling each other. Updated the comment block to describe the real serialization source honestly.
• Dockerfile — split the Python dep install into a cached layer above COPY . .. Before: uv pip install -e ".[all]" ran after COPY . ., so every .py change re-resolved ~258 packages. After: uv sync --frozen --no-install-project --extra all runs on just pyproject.toml + uv.lock, then uv pip install --no-cache-dir --no-deps -e "." creates the editable link in ~1s after the source copy. Uses --extra all (the composite extra intended for production) rather than --all-extras (would pull in [rl], [yc-bench], [termux-all] — git-cloned RL libs, benchmarks, Android redundancy that don't belong in the published image).
• .github/workflows/uv-lockfile-check.yml — new blocking CI check that runs uv lock --check on PRs touching pyproject.toml / uv.lock. Since the Docker build now uses uv sync --frozen, a stale lockfile would fail the docker-publish workflow on main ~15 min into the build with no published image. This check catches that in ~10s at PR time, with a step summary telling the dev exactly which commands to run locally to fix it.
• uv.lock — refreshed to match pyproject.toml (separate commit, pre-existing drift picked up by the new check).

How to Test

Verified via five manual workflow_dispatch runs on this branch (a temporary dispatch trigger + dryrun-<sha> tag scheme was used during development; both were dropped from the final history). All five runs succeeded end-to-end, produced a valid multi-arch manifest, and correctly skipped move-latest (workflow_dispatch can't touch :latest — triple-gated via event_name == 'push' + ref == 'refs/heads/main' + the pushed_sha_tag output which only gets set on push-to-main).

Run 3 surfaced the --all-extras bloat bug — caught in dry-run before merge. Run 5 is the target steady state: on a source-only commit (no pyproject.toml change, cache populated), the whole pipeline finishes in ~3 minutes.

Post-merge verification steps:

1. Wait for the first real push to main that triggers this workflow. Confirm total wall clock is in the 12-18 min range on cold cache (new cache scopes will be empty at first).
2. After that lands, the next push with source-only changes should complete in <5 min.
3. Verify :latest points at the merge commit:

   docker buildx imagetools inspect nousresearch/hermes-agent:latest \
     --format '{{ json (index .Image "linux/amd64") }}' \
     | jq -r '.config.Labels."org.opencontainers.image.revision"'

4. Pull and smoke-test both platforms on hosts that have them:

   docker pull --platform linux/amd64 nousresearch/hermes-agent:latest
   docker run --rm nousresearch/hermes-agent:latest hermes --help
   docker pull --platform linux/arm64 nousresearch/hermes-agent:latest
   docker run --rm nousresearch/hermes-agent:latest hermes --help

5. Test the new uv-lockfile-check job by opening a throwaway PR that adds a dep to pyproject.toml without regenerating uv.lock. The check should fail with a clear step summary.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — N/A (CI-only change, no Python runtime code touched; the test suite doesn't exercise GitHub Actions workflows)
• I've added tests for my changes (required for bug fixes, strongly encouraged for features) — N/A, but verified via 5 live dry-run workflow executions (see timing table above)
• I've tested on my platform: GitHub-hosted ubuntu-latest + ubuntu-24.04-arm runners (verified via workflow_dispatch on this branch)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A, workflow and Dockerfile comments are thorough
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A (no architectural change; CI workflow modification only)
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — N/A (CI-only change, targets GitHub's Linux runners; the published image already supported amd64 + arm64)
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Dry-run workflow runs on this branch (workflow_dispatch trigger + dryrun-<sha> tag scheme dropped from final history):

Multi-arch manifest from run 4 (pre-squash dryrun tag, same schema production will produce):

$ skopeo inspect --raw docker://docker.io/nousresearch/hermes-agent:dryrun-1174fd4ff4a5bd022846f1c7ee6277221a7c2059
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "manifests": [
    { "digest": "sha256:883a7ea8...", "platform": { "architecture": "arm64", "os": "linux" } },
    { "digest": "sha256:5dbc97bc...", "platform": { "architecture": "unknown", "os": "unknown" },
      "annotations": { "vnd.docker.reference.type": "attestation-manifest" } },
    { "digest": "sha256:a95c86b7...", "platform": { "architecture": "amd64", "os": "linux" } },
    { "digest": "sha256:e80bfea6...", "platform": { "architecture": "unknown", "os": "unknown" },
      "annotations": { "vnd.docker.reference.type": "attestation-manifest" } }
  ]
}

Both linux/amd64 and linux/arm64 sub-manifests are present, plus SLSA build attestations for each.

Note: a handful of dryrun-<sha> tags exist on Docker Hub from the dry runs. They're immutable digest-addressed images, harmless to leave but safe to delete after merge if desired.