Please address the comments from this code review:

## Overall Comments
- Consider extracting the QEMU and Buildx setup into a shared step or composite action so you don’t need to repeat it across arches and jobs.
- The new push-operator-manifests job has a lot of overlap with your existing multi-arch manifest push logic—consider refactoring common parts into a reusable workflow or action.
- Since you now require TARGET_ARCH for local builds via GOARCH, add a default (e.g. defaulting to amd64) so 'make docker-build' still works outside CI without extra env vars.

## Individual Comments

### Comment 1
<location> `operator/Makefile:337` </location>
<code_context>
 docker-build: build/Dockerfile.gen test smuggled-status-sh ## Build docker image with the operator.
 	DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker build \
 		-t ${IMG} \
+		--build-arg TARGET_ARCH=$(GOARCH) \
 		-f $< \
 		..
</code_context>

<issue_to_address>
**suggestion (bug_risk):** TARGET_ARCH build argument is passed from GOARCH.

Make sure GOARCH is always set or provide a default to prevent build failures.
</issue_to_address>

### Comment 2
<location> `.github/workflows/build.yaml:603` </location>
<code_context>
        uses: docker/setup-qemu-action@v3
</code_context>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

### Comment 3
<location> `.github/workflows/build.yaml:606` </location>
<code_context>
        uses: docker/setup-buildx-action@v3
</code_context>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `.github/workflows/build.yaml:654` </location>
<code_context>
+            if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then
+              push_context="merge-to-master"
+            fi
+            push_operator_image_set "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}"
+
+      - name: Push bundle image
</code_context>

<issue_to_address>
**suggestion:** Custom push logic replaces previous make-based push for operator images.

Please verify that error handling and logging in the custom push function are sufficient, particularly for multi-arch pushes, and that any failures are clearly reported in CI.

Suggested implementation:

```
            echo "Starting operator image push for context: $push_context, branding: ${{ env.ROX_PRODUCT_BRANDING }}, arch: ${{ matrix.arch }}"
            set -o pipefail
            if ! push_operator_image_set "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}"; then
              echo "ERROR: push_operator_image_set failed for context: $push_context, branding: ${{ env.ROX_PRODUCT_BRANDING }}, arch: ${{ matrix.arch }}" >&2
              exit 1
            fi
            echo "Operator image push completed successfully for context: $push_context, branding: ${{ env.ROX_PRODUCT_BRANDING }}, arch: ${{ matrix.arch }}"

```

- Ensure that the `push_operator_image_set` function in `./scripts/ci/lib.sh` itself logs errors and outputs relevant information for multi-arch pushes.
- If the function does not already print detailed error messages, update it to do so.
- If the function does not return a non-zero exit code on failure, update it to ensure CI can detect failures.
</issue_to_address>

### Comment 2
<location> `scripts/ci/lib.sh:324` </location>
<code_context>
     fi
 }

+push_operator_image_set() {
+    info "Pushing stackrox-operator image"
+
</code_context>

<issue_to_address>
**suggestion:** Function expects exactly three arguments; consider validating input types.

Currently, only the number of arguments is checked. Please add validation for argument values to ensure they are not empty or invalid.
</issue_to_address>

### Comment 3
<location> `.github/workflows/build.yaml:603` </location>
<code_context>
        uses: docker/setup-qemu-action@v3
</code_context>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>

### Comment 4
<location> `.github/workflows/build.yaml:606` </location>
<code_context>
        uses: docker/setup-buildx-action@v3
</code_context>

<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

*Source: opengrep*
</issue_to_address>