feat(ci): allow for supporting multi-arch images to be built and shipped

[knechtionscoding]

What type of PR is this?

/kind feature

What this PR does / why we need it:

We want to run Kelos on our ARM nodes as well as AMD. Seeing as this is primarily an interface with k8s and llm APIs and not doing ML work locally this is relatively easy to allow.

Updates the dockerfiles to build the binary as a multi-stage build and then publish all the images properly

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Does this PR introduce a user-facing change?

feat(ci): support running kelos on ARM 

---

Summary by cubic

Adds multi-arch Docker images and switches defaults to public ECR, plus webhook-based task discovery (GitHub and Linear) with a new CRD and receiver. Also includes Bedrock credentials with IRSA support and Helm/CI updates.

• New Features

  • Multi-arch builds via docker buildx and make push-multiarch (linux/amd64, linux/arm64) with cache.
  • Default image registry moved to public.ecr.aws/anomalo/kelos (Makefile, defaults, Helm values, CI).
  • Webhook system: WebhookEvent CRD, kelos-webhook-receiver service (HMAC validation), and new TaskSpawner triggers when.githubWebhook and when.linearWebhook.
  • Linear webhook support with state/label filters; GitHub webhook support with label filters.
  • Agent and binaries now built in multi-stage Dockerfiles for reproducible cross-arch images.
  • New bedrock and none credential types; IRSA support for Bedrock (region and SA fields), centralized env var injection.
  • Dev tooling: Codespaces .devcontainer, pre-commit secrets check hook.
  • Docs and examples for webhooks (GitHub/Linear) and Helm chart templates/RBAC for the receiver.

• Migration

  • Update deployments/Helm values to use public.ecr.aws/anomalo/kelos/* images.
  • Enable the webhook receiver in Helm (.Values.webhook.enabled=true), set GITHUB_WEBHOOK_SECRET / LINEAR_WEBHOOK_SECRET, and expose endpoints per docs.
  • Use when.githubWebhook or when.linearWebhook in TaskSpawner specs as needed.
  • For Bedrock via IRSA: set credentials type bedrock, region, and the service account; omit secretRef.

^{Written for commit 9ba75ee. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cursor/Dockerfile">

<violation number="1" location="cursor/Dockerfile:1">
P2: Builder toolchain is decoupled from `GO_VERSION` and uses a floating Go tag, reducing build reproducibility and risking version drift.</violation>
</file>

<file name="cmd/kelos-spawner/Dockerfile">

<violation number="1" location="cmd/kelos-spawner/Dockerfile:1">
P2: New builder base image uses a floating tag (`golang:1.25`), which can cause non-reproducible builds and external version drift.</violation>
</file>

<file name="gemini/Dockerfile">

<violation number="1" location="gemini/Dockerfile:1">
P2: Builder stage uses a floating Go image tag, making release artifacts non-reproducible across rebuilds.</violation>
</file>

<file name="claude-code/Dockerfile">

<violation number="1" location="claude-code/Dockerfile:1">
P2: New builder stage uses an unpinned `golang` image tag, making shipped binary builds non-deterministic and vulnerable to upstream image drift.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 5 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="cmd/kelos-token-refresher/Dockerfile">

<violation number="1" location="cmd/kelos-token-refresher/Dockerfile:10">
P2: The Dockerfile now builds `kelos-token-refresher` twice: once via `go build` and again via `make build`, which overwrites the same output. This makes the new build step redundant and risks different build flags being used in the final binary.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ knechtionscoding
❌ tmarshall
_{You have signed the CLA already but the status is still pending? Let us recheck it.}