feat(mojaloop/#3656): add support to arm64 docker image

.circleci/config.yml

@@ -420,7 +420,8 @@ jobs:
             docker build -t ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local --build-arg NODE_VERSION=$DOCKER_NODE_VERSION .
       - run:
           name: Save docker image to workspace
-          command: docker save -o /tmp/docker-image.tar ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local
+          command: |
+            docker save -o /tmp/docker-image.tar ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local
       - persist_to_workspace:
           root: /tmp
           paths:
@@ -496,6 +497,10 @@ jobs:
           command: |
             echo "Pulling docker image: node:$NVMRC_VERSION-alpine"
             docker pull node:$NVMRC_VERSION-alpine
+      - run:
+          name: inspect the docker image
+          command: |
+            docker image inspect ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local
       ## Analyze the base and derived image
       ## Note: It seems images are scanned in parallel, so preloading the base image result doesn't give us any real performance gain
       - anchore/analyze_local_image:
@@ -609,6 +614,8 @@ jobs:
       <<: *defaults_environment
     steps:
       - checkout
+      - run:
+          <<: *defaults_configure_nvmrc
       - run:
           name: Setup for LATEST release
           command: |
@@ -617,6 +624,7 @@ jobs:
 
             PACKAGE_VERSION=$(cat package-lock.json | jq -r .version)
             echo "export PACKAGE_VERSION=${PACKAGE_VERSION}" >> $BASH_ENV
+            echo "export DOCKER_NODE_VERSION=$NVMRC_VERSION-alpine" >> $BASH_ENV
             echo "PACKAGE_VERSION=${PACKAGE_VERSION}"
       - run:
           name: Setup Slack config
@@ -639,13 +647,19 @@ jobs:
           name: Re-tag pre built image
           command: |
             docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG
-            docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
       - run:
-          name: Publish Docker image $CIRCLE_TAG & Latest tag to Docker Hub
+          name: Build Docker image for multiple platforms architectures and push to registry
           command: |
-            echo "Publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG"
-            docker push ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG
+            source ~/.profile
+            export DOCKER_NODE_VERSION="$NVMRC_VERSION-alpine"
+            echo "export DOCKER_NODE_VERSION=$NVMRC_VERSION-alpine" >> $BASH_ENV
+            echo "Setting up docker buildx environment"
+            docker buildx create --use --platform=linux/arm64,linux/amd64 --name multi-platform-builder
+            docker buildx inspect --bootstrap
+            echo "Building and publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG"
+            docker buildx build --progress plain --platform linux/amd64,linux/arm64 --push -t ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG --build-arg NODE_VERSION=$DOCKER_NODE_VERSION .
             echo "Publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG"
+            docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
             docker push ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
       - run:
           name: Set Image Digest
@@ -671,6 +685,8 @@ jobs:
       <<: *defaults_environment
     steps:
       - checkout
+      - run:
+          <<: *defaults_configure_nvmrc
       - run:
           name: Setup for SNAPSHOT release
           command: |
@@ -701,13 +717,19 @@ jobs:
           name: Re-tag pre built image
           command: |
             docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG
-            docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:local ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
       - run:
-          name: Publish Docker image $CIRCLE_TAG & Latest tag to Docker Hub
+          name: Build Docker image for multiple platforms architectures and push to registry
           command: |
-            echo "Publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG"
-            docker push ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG
+            source ~/.profile
+            export DOCKER_NODE_VERSION="$NVMRC_VERSION-alpine"
+            echo "export DOCKER_NODE_VERSION=$NVMRC_VERSION-alpine" >> $BASH_ENV
+            echo "Setting up docker buildx environment"
+            docker buildx create --use --platform=linux/arm64,linux/amd64 --name multi-platform-builder
+            docker buildx inspect --bootstrap
+            echo "Building and publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG"
+            docker buildx build --progress plain --platform linux/amd64,linux/arm64 --push -t ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG --build-arg NODE_VERSION=$DOCKER_NODE_VERSION .
             echo "Publishing ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG"
+            docker tag ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$CIRCLE_TAG ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
             docker push ${DOCKER_ORG:-mojaloop}/$CIRCLE_PROJECT_REPONAME:$RELEASE_TAG
       - run:
           name: Set Image Digest
@@ -934,4 +956,4 @@ workflows:
               only: /v[0-9]+(\.[0-9]+)*\-snapshot+((\.[0-9]+)?)/
             branches:
               ignore:
-                - /.*/
+                - /.*/

audit-ci.jsonc

@@ -12,6 +12,9 @@
     "GHSA-qwph-4952-7xr6", // https://github.com/advisories/GHSA-qwph-4952-7xr6
     // request-provise-native, no fix available
     "GHSA-p8p7-x288-28g6", // https://github.com/advisories/GHSA-p8p7-x288-28g6
-    "GHSA-72xf-g2v4-qvf3"  // https://github.com/advisories/GHSA-72xf-g2v4-qvf3
+    "GHSA-72xf-g2v4-qvf3",  // https://github.com/advisories/GHSA-72xf-g2v4-qvf3
+    // babel vulnerable to arbitrary code execution - dev dependency
+    "GHSA-67hx-6x53-jw92"   // https://github.com/advisories/GHSA-67hx-6x53-jw92
+
   ]
 }