[suresh-hashicorp]

Changes proposed in this PR:

• Pin the go-discover stage of the Dockerfile to $BUILDPLATFORM and cross-compile discover for the target platform (GOOS, GOARCH, and GOARM for 32-bit arm).
• Previously this stage ran as the target platform, so for arm and arm64 the Go compiler ran under QEMU emulation. In the last build run on main, that single step took about 1372s (arm), 671s (arm64) and about 100s (amd64) of the Docker job time.
• A cross-compiled go install writes the binary to /go/bin/<os>_<arch>/, so it is moved to /go/bin/ and the final COPY --from=go-discover /go/bin/discover /bin/ is unchanged.
• No CHANGELOG entry: this only changes how the image is built; the resulting binary and image contents are the same.

How I've tested this PR:

Built the go-discover stage locally with docker buildx build --target go-discover --platform <p> --load for linux/amd64, linux/arm64, linux/386, linux/arm/v6, linux/arm/v7 and linux/arm. file and go version -m on each extracted binary show the expected GOOS/GOARCH/GOARM, CGO_ENABLED=0 and go-discover v1.5.0. Passed for all.

Also built the full release-default image for linux/arm/v7 and linux/arm64, then ran docker run --platform <p> --entrypoint /bin/discover <image> -h. Both images built and printed the usage text.

Build time comparison:

Docker job durations from the build workflow. Before is the last full run on main (run 39953679234, 83643d6); after is this PR's pull_request run (41021844924).

Job	Before	After
arm default	1413s (about 23.5 min)	131s
arm64 default	701s	136s
arm64 FIPS	737s	120s
amd64 default	140s	145s
amd64 FIPS	100s	140s
386 default	155s	96s

The slowest Docker job drops from about 23.5 minutes to about 2.4 minutes. The push run for this branch gives similar numbers (arm 131s, arm64 134s, arm64 FIPS 134s). amd64 and 386 are unaffected; their differences are normal run-to-run variance.

How I expect reviewers to test this PR:

• Confirm the build workflow passes and the ARM Docker jobs take about 2-3 minutes.
• Confirm CRT Artifact Validation Results passes after merge (artifact names don't change).

Checklist:

• Tests added (not applicable, build change)
• CHANGELOG entry added (not applicable, no user-facing change)

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request. (Revert the PR.)
• If applicable, I've documented the impact of any changes to security controls. (None. The Go version and go-discover version are unchanged.)

[github-actions]

Go Test Coverage: 74.1%

Patch coverage: N/A (no coverable Go lines changed)

See the workflow run for the full per-package breakdown and downloadable HTML report.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.34%. Comparing base (e6d65cc) to head (013d0ca).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #409   +/-   ##
=======================================
  Coverage   59.34%   59.34%           
=======================================
  Files          34       34           
  Lines        2890     2890           
=======================================
  Hits         1715     1715           
  Misses        978      978           
  Partials      197      197           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.