FIPS images: Add ARM64 docker images TT-16216 (#7576)

### **User description**
## Description

add arm64 builds for fips docker images

## Related Issue

[TT-16216](https://tyktech.atlassian.net/browse/TT-16216)

## Motivation and Context

Adds arm64 architecture as required by customers.

## Types of changes

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why


[TT-16216]:
https://tyktech.atlassian.net/browse/TT-16216?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ


___

### **PR Type**
Enhancement


___

### **Description**
- Add ARM64 platform to FIPS images

- Introduce dashboard image resolution workflow

- Conditional dashboard build and ECR publish

- Pass resolved dashboard image into tests


___

### Diagram Walkthrough


```mermaid
flowchart LR
  gore["goreleaser builds (amd64 + arm64 FIPS)"]
  pushci["Docker push FIPS CI (amd64, arm64)"]
  pushprod["Docker push FIPS Prod (amd64, arm64)"]
  resolve["Resolve dashboard image strategy"]
  builddash["Build and push dashboard image (per-arch)"]
  tests["API tests with resolved dashboard image"]

  gore -- "produces dist artifacts" --> pushci
  gore -- "produces dist artifacts" --> pushprod
  gore -- "needs" --> resolve
  resolve -- "needs_build=true" --> builddash
  resolve -- "outputs dashboard_image" --> tests
  builddash -- "image tag: tyk-<PR#>" --> tests
```



<details> <summary><h3> File Walkthrough</h3></summary>

<table><thead><tr><th></th><th align="left">Relevant
files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table>
<tr>
  <td>
    <details>
<summary><strong>release.yml</strong><dd><code>ARM64 FIPS push and
PR-based dashboard image flow</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

.github/workflows/release.yml

<ul><li>Enable linux/arm64 for FIPS image pushes.<br> <li> Add
resolve-dashboard-image job with strategy logic.<br> <li> Add
conditional build-dashboard-image job targeting current arch.<br> <li>
Feed resolved dashboard image into api-tests environment.</ul>


</details>


  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/7576/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34">+364/-2</a>&nbsp;
</td>

</tr>

<tr>
  <td>
    <details>
<summary><strong>goreleaser.yml</strong><dd><code>Add FIPS ARM64 build
and packaging</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary>
<hr>

ci/goreleaser/goreleaser.yml

<ul><li>Add fips-arm64 build with boringcrypto flags.<br> <li> Configure
cross-CC for arm64 (aarch64 gcc).<br> <li> Include fips-arm64 in nfpm
package IDs.</ul>


</details>


  </td>
<td><a
href="https://github.com/TykTechnologies/tyk/pull/7576/files#diff-fb944a05459e4d713bc7541efd6e721cbe992a556353c09c4eb66a8eae9b856e">+18/-0</a>&nbsp;
&nbsp; </td>

</tr>
</table></td></tr></tr></tbody></table>

</details>

___

---------

Co-authored-by: Gromit <policy@gromit>

Author: Razeen-Abdal-Rahman

.github/workflows/release.yml

@@ -219,7 +219,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: "dist"
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           file: ci/Dockerfile.distroless
           provenance: mode=max
           sbom: true
@@ -252,7 +252,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: "dist"
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           file: ci/Dockerfile.distroless
           provenance: mode=max
           sbom: true

ci/goreleaser/goreleaser.yml

@@ -74,6 +74,23 @@ builds:
     goarch:
       - amd64
     binary: tyk
+  - id: fips-arm64
+    flags:
+      - -tags=goplugin,ee,fips,boringcrypto
+    env:
+      - NOP=nop # ignore this, it is jsut to avoid a complex conditional in the templates
+      - CC=aarch64-linux-gnu-gcc
+      - GOEXPERIMENT=boringcrypto
+    ldflags:
+      - -X github.com/TykTechnologies/tyk/internal/build.Version={{.Version}}
+      - -X github.com/TykTechnologies/tyk/internal/build.Commit={{.FullCommit}}
+      - -X github.com/TykTechnologies/tyk/internal/build.BuildDate={{.Date}}
+      - -X github.com/TykTechnologies/tyk/internal/build.BuiltBy=goreleaser
+    goos:
+      - linux
+    goarch:
+      - arm64
+    binary: tyk
   - id: std-amd64
     flags:
       - -tags=goplugin
@@ -194,6 +211,7 @@ nfpms:
     file_name_template: "{{ .ConventionalFileName }}"
     ids:
       - fips-amd64
+      - fips-arm64
     formats:
       - deb
       - rpm