fix: remove ARG TARGETARCH default in Dockerfile.test-tools

doc/changelog/CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **`Dockerfile.test-tools` `ARG TARGETARCH=amd64` default shadowed BuildKit's per-platform auto-inject** ([moby/buildkit#3403](https://github.com/moby/buildkit/issues/3403)). Every multi-arch build published via `release-test-tools.yaml` (v0.9.13, v0.10.0-rc1) therefore fell back to `amd64` and shipped x86_64 `shellcheck` / `hadolint` binaries inside the arm64 image variant. Symptom downstream: `shellcheck: Exec format error` on arm64 CI (ros1_bridge PR #27 first surfaced it). Fix: declare `ARG TARGETARCH` without default so BuildKit's injected value drives the `case` branch. Regression test added: `Dockerfile.test-tools ARG TARGETARCH has no default value`. Requires a new tag + `release-test-tools.yaml` re-run to reissue `:v0.10.0-rc2` + `:latest` on GHCR.
+
 ## [v0.10.0-rc1] - 2026-04-24
 
 Release candidate for v0.10.0. BREAKING: `run.sh` arg semantics realigned.

doc/test/TEST.md

@@ -1,6 +1,6 @@
 # TEST.md
 
-Template self-tests: **674 tests** total (631 unit + 43 integration).
+Template self-tests: **675 tests** total (632 unit + 43 integration).
 
 ## Test Files
 
@@ -188,7 +188,7 @@ conditional GPU deploy block + GUI env/volumes + extra volumes from
 | `runtime detection is robust against weird whitespace` | regex tolerance |
 | `runtime detection ignores non-runtime stage names` | strict match |
 
-### test/unit/template_spec.bats (115)
+### test/unit/template_spec.bats (116)
 
 | Test | Description |
 |------|-------------|
@@ -266,6 +266,7 @@ conditional GPU deploy block + GUI env/volumes + extra volumes from
 | `exec.sh --dry-run skips precheck and prints compose command` | dry-run e2e |
 | `script/docker/i18n.sh exists` | i18n module exists |
 | `Dockerfile.test-tools includes bats-mock` | bats-mock available in test image |
+| `Dockerfile.test-tools ARG TARGETARCH has no default value (must not shadow BuildKit auto-inject)` | multi-arch build regression |
 | `i18n.sh defines _detect_lang function` | _detect_lang in i18n.sh |
 | `build.sh sources _lib.sh` | build.sh uses shared lib |
 | `run.sh sources _lib.sh` | run.sh uses shared lib |

dockerfile/Dockerfile.test-tools

@@ -20,10 +20,13 @@ RUN apk add --no-cache git && \
 
 FROM alpine:latest AS lint-tools
 # TARGETARCH is auto-populated by BuildKit (docker 23+) with "amd64" /
-# "arm64" / etc. The default handles the rare case where a legacy
-# builder doesn't provide it; override via --build-arg TARGETARCH=<arch>
-# if you build outside BuildKit.
-ARG TARGETARCH=amd64
+# "arm64" / etc. Do NOT set a default — a default value shadows
+# BuildKit's auto-inject (moby/buildkit#3403), which caused every
+# multi-arch build of this file to fall back to amd64 and ship
+# x86_64 shellcheck / hadolint inside the arm64 image variant
+# (visible symptom: `shellcheck: Exec format error` on arm64 downstream
+# CI). If invoked outside BuildKit, pass `--build-arg TARGETARCH=<arch>`.
+ARG TARGETARCH
 RUN apk add --no-cache curl xz && \
     case "${TARGETARCH}" in \
       amd64)  sc_arch="x86_64";  hd_arch="x86_64" ;; \

test/unit/template_spec.bats

@@ -470,6 +470,20 @@ EOF
   assert_success
 }
 
+@test "Dockerfile.test-tools ARG TARGETARCH has no default value (must not shadow BuildKit auto-inject)" {
+  # Regression guard: `ARG TARGETARCH=amd64` with a default shadows
+  # BuildKit's per-platform auto-inject (moby/buildkit#3403), which
+  # caused every multi-arch build to fall back to amd64 — arm64 image
+  # variants shipped x86_64 shellcheck / hadolint binaries. Symptom
+  # downstream: `shellcheck: Exec format error` on arm64 CI.
+  run grep -E '^ARG TARGETARCH=' /source/dockerfile/Dockerfile.test-tools
+  assert_failure
+  # But the bare declaration must still be there so the stage can
+  # consume the BuildKit-injected value.
+  run grep -E '^ARG TARGETARCH$' /source/dockerfile/Dockerfile.test-tools
+  assert_success
+}
+
 @test "Dockerfile.test-tools branches case for amd64 and arm64" {
   # Must handle both common arches; amd64 → x86_64 binaries,
   # arm64 → aarch64 (shellcheck) + arm64 (hadolint) binaries.