fix(scanner): pin ramparts builder to rust:1-slim-bookworm (MCP-2395) (#665)

* fix(scanner): pin ramparts builder to rust:1-slim-bookworm (MCP-2395)

The unpinned rust:1-slim builder tag now resolves to Debian trixie
(glibc 2.41) while the runtime stage stays on debian:bookworm-slim
(glibc 2.36). The binary compiled on trixie links GLIBC_2.39 symbols
that bookworm cannot satisfy, causing every ramparts scan to fail with:
  ramparts: /lib/aarch64-linux-gnu/libc.so.6: version GLIBC_2.39 not found

Fix: pin the builder to rust:1-slim-bookworm so both build and runtime
stages share glibc 2.36.

Verified: docker build succeeds; `ramparts --version` exits 0 on the
resulting image (no GLIBC error). Noted separately that the ramparts
v0.8.x CLI has switched from file-based to URL-based scanning
(entrypoint CLI compat tracked as follow-up issue).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix(scanner): unblock hanging ramparts image build (MCP-2395)

The rust:1-slim-bookworm pin invalidated the buildx cache, forcing a cold
cargo build of ramparts. Combined with the QEMU-emulated linux/arm64 leg
(~5-10x slower), the cold build exceeds the runner budget and the job is
cancelled mid-compile (last live line: Compiling want v0.3.1). Build
ramparts for linux/amd64 only via a per-scanner matrix platforms override;
the other (Python) scanners keep multi-arch.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: Dumbris

.github/workflows/scanner-images.yml

@@ -37,19 +37,29 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # `platforms` defaults to multi-arch. ramparts overrides to linux/amd64
+        # only: it is the lone Rust-from-source wrapper, and `cargo install
+        # ramparts` for an emulated linux/arm64 leg runs under QEMU (~5-10x
+        # slower). A cold build of both arches blows past the runner budget and
+        # the job gets cancelled mid-compile (MCP-2395). amd64-only finishes in
+        # time; the binary is consumed on the host arch by Docker isolation.
         include:
           - id: snyk
             image: ghcr.io/smart-mcp-proxy/scanner-snyk
             context: docker/scanners/snyk
+            platforms: linux/amd64,linux/arm64
           - id: cisco
             image: ghcr.io/smart-mcp-proxy/scanner-cisco
             context: docker/scanners/cisco
+            platforms: linux/amd64,linux/arm64
           - id: ramparts
             image: ghcr.io/smart-mcp-proxy/scanner-ramparts
             context: docker/scanners/ramparts
+            platforms: linux/amd64
           - id: proximity
             image: ghcr.io/smart-mcp-proxy/scanner-proximity
             context: docker/scanners/proximity
+            platforms: linux/amd64,linux/arm64
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
@@ -88,7 +98,7 @@ jobs:
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # v6.9.0
         with:
           context: ${{ matrix.context }}
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platforms }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.tags.outputs.tags }}
           cache-from: type=gha,scope=scanner-${{ matrix.id }}

docker/scanners/ramparts/Dockerfile

@@ -7,7 +7,13 @@
 #
 # We use a two-stage build: a Rust builder installs the `ramparts` crate
 # and the final image ships a slim Debian with just the binary.
-FROM rust:1-slim AS builder
+#
+# IMPORTANT: the builder's Debian release MUST match the runtime stage
+# (`debian:bookworm-slim`, glibc 2.36). The unpinned `rust:1-slim` tag now
+# resolves to Debian trixie (glibc 2.39+), so the binary it produces fails
+# at runtime on bookworm with `GLIBC_2.39 not found` (MCP-2395). Pinning the
+# builder to `-bookworm` keeps both stages on the same glibc.
+FROM rust:1-slim-bookworm AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends \
         pkg-config libssl-dev ca-certificates git && \
     rm -rf /var/lib/apt/lists/*