ci: Enable ci tests on arm64

[seungukshin]

This changes enables CI tests on arm64 runner.

Ther guest-components's CI is as following: (${\color{red}red}$ parts are added by this change, links are test results on forked repo.)

• aa_basic.yml (on amd64, s390x, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12910598245/job/36000990431
• aa_cc_kbc.yml (on amd64, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12910903728/job/36002045320
• aa_crypto.yml (on amd64, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12928771208
• aa_occlum_sgx.yml (on amd64)
• aa_release.yml (on amd64, but generate amd64, ${\color{red}arm64}$ image using docker-buildx)
  • https://github.com/seungukshin/guest-components/actions/runs/12928098948/job/36054642982
• aa_sample_keyprovider.yml (on amd64, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12928903563/job/36057187914
• aa_sev_kbc.yml (on amd64)
• api-server-rest-basic.yml (on amd64, s390x, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12929118555/job/36057839641
• cdh_basic.yml (on amd64, s390x, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12929229686/job/36058180157
• dco.yml (on amd64)
• image_rs_build.yml (on amd64, s390x, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12930750435
• links.yml (on amd64)
• ocicrypt_rs_build.yml (on amd64, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12929520660
• publish-artifacts.yml (on amd64, s390x, but generate amd64, s390x, arm64 image using cross-compile)
• trustee-attester.yml (on amd64, s390x, ${\color{red}arm64}$)
  • https://github.com/seungukshin/guest-components/actions/runs/12930773078/job/36063085501
• vendor_release.yml (on amd64)

[seungukshin]

rust on aarch64-unknown-linux-gnu has a bug which faces SIGSEGV intermittently (rust-lang/rust#135867) with 1.83.0 or later. I added a commit to use rust 1.82.0 instead.

PR test results in the forked repo.: seungukshin#4

[seungukshin]

Retest with new rust stable (1.84.0 -> 1.84.1) passed, so I removed the commit to force 1.82.0.

PR test results in the forked repo.: seungukshin#5

[seungukshin]

Possibility is reduced, but getting SIGSEGV happened from time to time.

• stable (1.84.1): https://github.com/seungukshin/guest-components/actions/runs/13139003516/job/36661266810?pr=5
• 1.83.0: https://github.com/confidential-containers/guest-components/actions/runs/13137895973/job/36657587210?pr=890

Added a commit to make arm64 uses 1.82.0 only and the rest of architecture use the same (stable and 1.83.0)

PR test results in the forked repo.: seungukshin#5

[seungukshin]

It seems one random test case kept failing at Code Checkout step every retry.

• 1st try: ocicrypt_rs_build
• 2nd try: aa_crypto
• 3rd try: trustee-attester

It does not contain any error message and it couldn't be reproduced in the forked repo. Could anyone help me to retry with debug enabled?

[seungukshin]

The symptom is reproduced in my forked repository with debug messages - https://github.com/seungukshin/guest-components/actions/runs/13181422832/job/36844956217
The Code checkout failed without any error message with 139 exit code, but the checkout proceeded.
It seems node got a segfault some reason, but there is no message about it (nodejs/node#5769)

[seungukshin]

@stevenhorsman , @zvonkok and @fidencio , could you take a look on this? Now all CI test cases passed.

[mkulke]

nit: maybe it would be more concise if we'd have ternary construct picking an arm-runner in runs-on for cca-attester and a similar exception for rust?

[huoqifeng]

LGTM
thank you very much! @seungukshin