ci: fix wrong-arch build from stale alpine image tag

The binfmt check pulls alpine:3.23 for both arm64 and arm/v7, leaving the
single local tag pointing at the last-pulled arch. On runners using the
classic docker image store, 'docker run --platform linux/arm64' then
reuses that stale arm/v7 image: the aarch64 iteration silently built
32-bit binaries into out/armhf and 'cp out/aarch64/*' failed.

- build-static.sh: 'docker pull --platform' before each run so the local
  tag matches the requested platform; pass ARCH_LABEL explicitly.
- build-in-container.sh: use $ARCH_LABEL (fall back to uname only for
  manual runs) and assert it matches the container's uname, so a
  wrong-platform image fails loudly instead of mislabeling binaries.

Signed-off-by: ravindu644 <droidcasts@protonmail.com>

Author: ravindu644

scripts/build-in-container.sh

@@ -14,14 +14,26 @@
 # Output -> /work/out, build scratch -> /work/.src-cache
 set -e
 
-# Derive the arch label from the (emulated) container arch. build-static.sh runs
-# this once per --platform; output is kept in a per-arch subdir.
-case "$(uname -m)" in
-    aarch64)                 ARCH_LABEL=aarch64 ;;
-    armv7l|armv7|armhf|arm)  ARCH_LABEL=armhf ;;
-    *) echo "unsupported build arch: $(uname -m)"; exit 1 ;;
+# Arch label drives the per-arch output subdir. build-static.sh passes it via
+# $ARCH_LABEL (authoritative - it knows the requested --platform). Fall back to
+# `uname -m` only for standalone/manual runs; uname is unreliable under emulation.
+if [ -z "${ARCH_LABEL:-}" ]; then
+    case "$(uname -m)" in
+        aarch64)                 ARCH_LABEL=aarch64 ;;
+        armv7l|armv7|armhf|arm)  ARCH_LABEL=armhf ;;
+        *) echo "unsupported build arch: $(uname -m)"; exit 1 ;;
+    esac
+fi
+echo "### Target arch: $ARCH_LABEL (uname -m: $(uname -m))"
+
+# Sanity-check: the toolchain's actual word size must match the requested arch,
+# so a wrong-platform container (stale image cache) fails loudly instead of
+# silently producing mislabeled binaries.
+case "$ARCH_LABEL:$(uname -m)" in
+    aarch64:aarch64) ;;
+    armhf:armv7l|armhf:armv7|armhf:armhf|armhf:arm) ;;
+    *) echo "ERROR: ARCH_LABEL=$ARCH_LABEL but container is $(uname -m) - wrong-platform image?"; exit 1 ;;
 esac
-echo "### Target arch: $ARCH_LABEL ($(uname -m))"
 
 OUT="/work/out/$ARCH_LABEL"
 SRC="/work/.src-cache/$ARCH_LABEL"

scripts/build-static.sh

@@ -37,9 +37,18 @@ fi
 for pair in $ARCHES; do
     label="${pair%%:*}"; platform="${pair##*:}"
     echo "[*] Building $label ($platform) in $IMAGE ..."
-    # :z relabels the bind mount for SELinux (Fedora/RHEL hosts). externals/ is
-    # mounted read-only; the container copies sources out before building.
+    # Pull the image for THIS platform right before running. alpine:3.23 is a
+    # single local tag, so the earlier binfmt check (which pulled both arches)
+    # leaves it pointing at whichever it pulled last - `docker run --platform`
+    # then silently reuses that wrong-arch image. Re-pulling per iteration keeps
+    # the local tag in sync with $platform.
+    docker pull --quiet --platform "$platform" "$IMAGE" >/dev/null
+    # ARCH_LABEL is passed explicitly so the container never has to guess its arch
+    # from `uname -m` (unreliable under emulation). :z relabels the bind mount for
+    # SELinux (Fedora/RHEL); externals/ is mounted read-only and copied out before
+    # building.
     docker run --rm --platform "$platform" \
+        -e ARCH_LABEL="$label" \
         -v "$HERE":/work:z \
         -v "$REPO/externals":/externals:ro,z \
         "$IMAGE" sh /work/build-in-container.sh