From 8a90214737b2721607fe7d0298761be2f7693e3b Mon Sep 17 00:00:00 2001
From: Jeff Heller <jeffrey.l.heller@gmail.com>
Date: Sun, 14 Jun 2026 20:12:26 -0600
Subject: [PATCH] build(goreleaser): publish multi-arch (arm64)
 osv-scanner-action image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `ghcr.io/google/osv-scanner-action` image is published amd64-only, so
the `google/osv-scanner-action` action fails on linux/arm64 GitHub-hosted
runners (now GA for public + private repos) with "exec format error".

Mirror the multi-arch setup already used for the `osv-scanner` scanner
image:
- build the `osv-scanner-action` and `osv-reporter` binaries for
  linux/arm64 in addition to linux/amd64,
- build an arm64 `osv-scanner-action` image (suffix the existing amd64
  image with `-amd64`),
- combine them under `:{{ .Tag }}` / `:v{{ .Major }}` docker_manifests.

No Dockerfile change needed — goreleaser-action.dockerfile copies the
goreleaser-provided per-arch binary. `goreleaser check` passes.
---
 .goreleaser.yml | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index e05cd3fcbe3..d18397b4834 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -55,6 +55,7 @@ builds:
       - linux
     goarch:
       - amd64
+      - arm64
   - main: ./cmd/osv-reporter/
     id: osv-reporter
     binary: osv-reporter
@@ -73,6 +74,7 @@ builds:
       - linux
     goarch:
       - amd64
+      - arm64
 
 dockers:
   # Arch: amd64
@@ -110,10 +112,9 @@ dockers:
       - "--label=org.opencontainers.image.url={{.GitURL}}"
       - "--platform=linux/arm64"
     goarch: arm64
-  # GitHub Action
+  # GitHub Action (amd64)
   - image_templates:
-      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}"
-      - "ghcr.io/google/osv-scanner-action:v{{ .Major }}"
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-amd64"
     dockerfile: goreleaser-action.dockerfile
     use: buildx
     extra_files:
@@ -131,6 +132,26 @@ dockers:
       - "--label=org.opencontainers.image.url={{.GitURL}}"
       - "--platform=linux/amd64"
     goarch: amd64
+  # GitHub Action (arm64)
+  - image_templates:
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-arm64"
+    dockerfile: goreleaser-action.dockerfile
+    use: buildx
+    extra_files:
+      - exit_code_redirect.sh
+    build_flag_templates:
+      - "--pull"
+      - "--label=org.opencontainers.image.title=osv-scanner-action"
+      - "--label=org.opencontainers.image.description=Vulnerability scanner written in Go which uses the data provided by https://osv.dev"
+      - "--label=org.opencontainers.image.licenses=Apache-2.0"
+      - "--label=org.opencontainers.image.created={{.Date}}"
+      - "--label=org.opencontainers.image.name={{.ProjectName}}"
+      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
+      - "--label=org.opencontainers.image.version={{.Version}}"
+      - "--label=org.opencontainers.image.source={{.GitURL}}"
+      - "--label=org.opencontainers.image.url={{.GitURL}}"
+      - "--platform=linux/arm64"
+    goarch: arm64
 
 docker_manifests:
   - name_template: "ghcr.io/google/osv-scanner:{{ .Tag }}"
@@ -150,6 +171,14 @@ docker_manifests:
       - "ghcr.io/google/osv-scanner:{{ .Tag }}-amd64"
       - "ghcr.io/google/osv-scanner:{{ .Tag }}-arm64"
     skip_push: "{{ ne .Env.STABLE `true` }}"
+  - name_template: "ghcr.io/google/osv-scanner-action:{{ .Tag }}"
+    image_templates:
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-amd64"
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-arm64"
+  - name_template: "ghcr.io/google/osv-scanner-action:v{{ .Major }}"
+    image_templates:
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-amd64"
+      - "ghcr.io/google/osv-scanner-action:{{ .Tag }}-arm64"
 
 archives:
   - formats: binary