ci: run the built image on macOS too (Intel runner + Docker via Colima)

- macOS matrix entry is now macos-15-intel: GitHub's Apple-silicon macOS
  runners can't run Docker/Colima (no nested virtualization), Intel ones can
- set up Docker on macOS (docker/setup-docker-action) and run the image on
  Linux + macOS via 'crane pull' + 'docker load' (the daemon, a VM on macOS,
  can't reach the host's localhost registry, but crane on the host can)

Co-authored-by: Jason Hall <imjasonh@users.noreply.github.com>

.github/workflows/pymage.yaml

@@ -10,12 +10,17 @@ jobs:
   ci:
     # Runs on Linux, macOS, and Windows to prove pymage can build a multi-arch
     # *linux* image index from any host OS (it never needs a Docker daemon to
-    # build). The Docker-only demonstration steps are gated to Linux, where the
-    # daemon is available.
+    # build).
+    #
+    # We then RUN the built image with Docker on Linux and macOS. The macOS
+    # runner is Intel (macos-15-intel) on purpose: GitHub's Apple-silicon macOS
+    # runners can't run Docker/Colima (no nested virtualization), whereas Intel
+    # macOS runners can. Windows hosts can't run Linux containers, so the run is
+    # skipped there.
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-15-intel, windows-latest]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -104,18 +109,29 @@ jobs:
           fi
           echo "reproducible: $d1"
 
-      # The remaining steps require a Docker daemon, which is only available on
-      # the Linux runners.
+      # Running the built image needs a Docker daemon. Linux runners have one;
+      # on the Intel macOS runner we install Docker (Colima). Windows can't run
+      # Linux containers, so this is skipped there.
+      - name: Set up Docker (macOS)
+        if: runner.os == 'macOS'
+        uses: docker/setup-docker-action@v5
+
       - name: Run the example image with Docker
-        if: runner.os == 'Linux'
+        if: runner.os != 'Windows'
         run: |
           set -euo pipefail
-          docker pull "$REGISTRY/example:multi"
-          cid=$(docker run -d -p 18080:8080 "$REGISTRY/example:multi")
-          trap 'docker rm -f "$cid"' EXIT
-          for _ in $(seq 1 30); do
-            curl -fsS http://127.0.0.1:18080/healthz && break
-            sleep 1
+          arch=$(go env GOARCH)
+          # crane runs on the host and can reach the host registry; we load the
+          # image into the daemon so we don't depend on the daemon (a VM on
+          # macOS) being able to reach the host's localhost registry.
+          crane pull --insecure --platform "linux/$arch" "$REGISTRY/example:multi" /tmp/example.tar
+          loaded=$(docker load -i /tmp/example.tar | sed -E 's/^Loaded image( ID)?: //' | tail -1)
+          echo "loaded image: $loaded"
+          cid=$(docker run -d -p 18080:8080 "$loaded")
+          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
+          for _ in $(seq 1 60); do
+            curl -fsS http://127.0.0.1:18080/healthz >/dev/null 2>&1 && break
+            sleep 2
           done
           curl -fsS http://127.0.0.1:18080/healthz | grep -q healthy