From 72679fb51f951d17775f53068b920a42dd7abf76 Mon Sep 17 00:00:00 2001
From: Ronni Skansing <rskansing@gmail.com>
Date: Wed, 3 Jun 2026 18:03:31 +0200
Subject: [PATCH] improve ARM build time

Signed-off-by: Ronni Skansing <rskansing@gmail.com>
---
 .github/workflows/test-build.yml | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index c11e456..8834247 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -65,15 +65,19 @@ jobs:
           -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
           -tags production -o ../build/amd64/phishingclub main.go"
 
-          # build arm64 binary — run natively under QEMU (already set up above)
+          # build arm64 binary — cross-compile with musl.cc toolchain, pinned by SHA512
           sudo docker run --rm \
-          --platform linux/arm64 \
           -v "$(pwd)":/app \
           -w /app/backend \
-          golang:1.25.10-alpine \
-          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
-          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
-          -tags production -o ../build/arm64/phishingclub main.go"
+          golang:1.25.10 \
+          bash -c "set -e && \
+            curl -fsSL https://musl.cc/aarch64-linux-musl-cross.tgz -o /tmp/cross.tgz && \
+            echo '8695ff86979cdf30fbbcd33061711f5b1ebc3c48a87822b9ca56cde6d3a22abd4dab30fdcd1789ac27c6febbaeb9e5bde59d79d66552fae53d54cc1377a19272  /tmp/cross.tgz' | sha512sum -c && \
+            tar -xzf /tmp/cross.tgz -C /tmp && \
+            CGO_ENABLED=1 GOOS=linux GOARCH=arm64 CC=/tmp/aarch64-linux-musl-cross/bin/aarch64-linux-musl-gcc \
+            go build -trimpath \
+            -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+            -tags production -o ../build/arm64/phishingclub main.go"
 
       - name: Fix build directory permissions
         run: |