fix(ci): Docker build image mirrors and concurrent output race

.github/workflows/build.yml

@@ -50,14 +50,15 @@ jobs:
 
       - name: "Docker Build"
         id: build
-        uses: cloudposse/github-action-docker-build-push@f06d0f4bd286898b613412d2fcc6622e5b68bbdc # v3.0.0
+        uses: cloudposse/github-action-docker-build-push@02993d675b44dcc7082e6de7485c1ff8740bce9d # v3.1.0
         with:
           registry: ghcr.io
           organization: "${{ github.event.repository.owner.login }}"
           repository: "${{ github.event.repository.name }}"
           login: "${{ github.actor }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
           platforms: linux/amd64,linux/arm64
+          binfmt-image: mirror.gcr.io/tonistiigi/binfmt:qemu-v7.0.0
           file: Dockerfile
           build-args: |
             ATMOS_VERSION=${{ github.event.release.tag_name }}

pkg/io/line_prefix_writer.go

@@ -65,6 +65,13 @@ func (w *LinePrefixWriter) Write(p []byte) (int, error) {
 	}
 
 	w.buffer = append(w.buffer, p...)
+
+	// Hold writeMu for the whole flush so that every line produced by this
+	// single Write call reaches the shared writer as one contiguous block.
+	// Locking per-line let a concurrent node's writer interleave a line in
+	// between two lines emitted from the same Write call.
+	w.writeMu.Lock()
+	defer w.writeMu.Unlock()
 	if err := w.flushCompleteLinesLocked(); err != nil {
 		return 0, err
 	}
@@ -81,6 +88,10 @@ func (w *LinePrefixWriter) Flush() error {
 	if len(w.buffer) == 0 {
 		return nil
 	}
+
+	w.writeMu.Lock()
+	defer w.writeMu.Unlock()
+
 	if err := w.flushCompleteLinesLocked(); err != nil {
 		return err
 	}
@@ -95,7 +106,7 @@ func (w *LinePrefixWriter) Flush() error {
 	return nil
 }
 
-// flushCompleteLinesLocked writes buffered complete lines while w.mu is held.
+// flushCompleteLinesLocked writes buffered complete lines while w.mu and w.writeMu are held.
 func (w *LinePrefixWriter) flushCompleteLinesLocked() error {
 	for {
 		idx := lineEndIndex(w.buffer)
@@ -115,12 +126,11 @@ func (w *LinePrefixWriter) flushCompleteLinesLocked() error {
 }
 
 // writeLine writes one already-delimited line with the configured prefix.
+// Callers must hold w.writeMu.
 func (w *LinePrefixWriter) writeLine(line []byte) error {
 	if w.w == nil {
 		return nil
 	}
-	w.writeMu.Lock()
-	defer w.writeMu.Unlock()
 
 	line = bytes.ReplaceAll(line, crlfBytes, lfBytes)
 	line = bytes.ReplaceAll(line, crBytes, lfBytes)