ci(publish): scan every published platform before push (Trivy W3)

Build amd64 and arm64 separately with --load, run the Trivy gate on each, then
push from the buildx cache so the published images are exactly the ones scanned.
Closes the gap where only a locally-built amd64 was gated while a rebuilt
multi-arch image (incl. an unscanned arm64) was pushed. arm64 stays best-effort
(amd64-only bases fall back to an amd64-only, scanned publish).

Author: ypriverol

.github/workflows/publish.yml

@@ -85,11 +85,20 @@ jobs:
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
 
-      - name: Build image (amd64) for validation
-        run: docker buildx build --load --platform linux/amd64 -t bcimg:local "$C/$V"
+      # Build each target platform locally so Trivy can gate the EXACT images that get
+      # published. buildx caches these builds, so the later `--push` reuses the same
+      # layers — the pushed image is byte-for-byte what was scanned. arm64 is
+      # best-effort: many legacy base images are amd64-only, so its build fails fast.
+      - name: Build amd64 image
+        run: docker buildx build --load --platform linux/amd64 -t bcimg:amd64 "$C/$V"
+
+      - name: Build arm64 image (best-effort)
+        id: arm64
+        continue-on-error: true
+        run: docker buildx build --load --platform linux/arm64 -t bcimg:arm64 "$C/$V"
 
       - name: Extract labels
-        run: docker inspect --format '{{json .Config.Labels}}' bcimg:local > labels.json
+        run: docker inspect --format '{{json .Config.Labels}}' bcimg:amd64 > labels.json
 
       - name: Check labels and compute tag
         id: check
@@ -107,26 +116,25 @@ jobs:
             cmd="${cmd%$'\r'}"                    # tolerate CRLF line endings
             case "$cmd" in ''|\#*) continue ;; esac  # skip blank and comment lines
             echo "::group::TEST $cmd"
-            if docker run --rm bcimg:local $cmd; then echo "ok"; else echo "FAILED"; status=1; fi
+            if docker run --rm bcimg:amd64 $cmd; then echo "ok"; else echo "FAILED"; status=1; fi
             echo "::endgroup::"
           done < "$TESTS"
           exit $status
 
-      # --- Security gate: scan the locally-built image BEFORE pushing. ---
-      # A fixable HIGH/CRITICAL CVE fails the job, so nothing is pushed. Unfixable
-      # OS-level CVEs are ignored. Maintainers can accept specific CVEs by adding a
-      # `.trivyignore` (CVE IDs, one per line) in the container's version directory.
+      # --- Security gate: scan every platform that WILL be published, before push. ---
+      # A fixable HIGH/CRITICAL CVE fails the job so nothing is pushed. Unfixable OS
+      # CVEs are ignored; a per-container `.trivyignore` (CVE IDs) can accept specific ones.
       - name: Prepare Trivy ignore file
         run: |
           if [ -f "$C/$V/.trivyignore" ]; then
             cp "$C/$V/.trivyignore" .trivyignore
             echo "Using per-container .trivyignore:"; cat .trivyignore
           fi
 
-      - name: Trivy security scan (gate on fixable HIGH/CRITICAL)
+      - name: Trivy gate (amd64)
         uses: aquasecurity/trivy-action@0.35.0
         with:
-          image-ref: bcimg:local
+          image-ref: bcimg:amd64
           format: sarif
           output: trivy.sarif
           severity: HIGH,CRITICAL
@@ -141,30 +149,37 @@ jobs:
           sarif_file: trivy.sarif
           category: trivy-${{ env.C }}
 
+      - name: Trivy gate (arm64)
+        if: ${{ steps.arm64.outcome == 'success' }}
+        uses: aquasecurity/trivy-action@0.35.0
+        with:
+          image-ref: bcimg:arm64
+          format: table
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: '1'
+
       - name: Log in to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push (multi-arch, amd64 fallback)
+      - name: Push scanned image(s)
         env:
           TAG: ${{ steps.check.outputs.tag }}   # validated [A-Za-z0-9._-]; used only as "$TAG"
+          ARM64_OK: ${{ steps.arm64.outcome }}
         run: |
           IMG="biocontainers/${C}:${TAG}"
-          # No --pull: reuse the exact amd64 base/layers that the Trivy gate scanned
-          # above (bcimg:local was built from the same context/cache), so the amd64
-          # image we publish is the one that passed the gate. The arm64 image is built
-          # fresh and is not independently scanned; it uses the same Dockerfile/packages.
-          # Many legacy base images are amd64-only, so the arm64 leg may fail fast at the
-          # FROM pull — fall back to amd64-only in that case.
-          if docker buildx build --platform linux/amd64,linux/arm64 --push -t "$IMG" "$C/$V"; then
-            echo "Published multi-arch (amd64+arm64): $IMG"
-            echo "- \`$IMG\` — **multi-arch** (amd64 + arm64)" >> "$GITHUB_STEP_SUMMARY"
+          # --push reuses the buildx cache from the --load builds above, so the pushed
+          # images are exactly the ones Trivy just gated.
+          if [ "$ARM64_OK" = "success" ]; then
+            docker buildx build --platform linux/amd64,linux/arm64 --push -t "$IMG" "$C/$V"
+            echo "Published multi-arch (amd64+arm64, both scanned): $IMG"
+            echo "- \`$IMG\` — **multi-arch** (amd64 + arm64, both scanned)" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "arm64 build failed (base likely amd64-only); publishing amd64-only."
             docker buildx build --platform linux/amd64 --push -t "$IMG" "$C/$V"
-            echo "Published amd64-only: $IMG"
+            echo "Published amd64-only (scanned): $IMG"
             echo "- \`$IMG\` — **amd64-only** (base has no arm64)" >> "$GITHUB_STEP_SUMMARY"
           fi