Description:

STO supports Linux arm64 across infrastructure types, but GitHub Advanced Security, Aqua Security and Mend are listed as exceptions in Supported Infra - https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/shared/supported-infrastructures?utm_source=kapa

On a Linux arm64 stage, the GHAS step in orchestration mode fails with exec /bin/start.sh: exec format error, because the github-advanced-security-job-runner image is not built for arm64. In ingestion mode, the STO plugin starts and runs on the same arm64 stage.

Request:

Publish an arm64-compatible (multi-arch) GHAS job-runner image so the GHAS step works in orchestration mode on Linux arm64 build infrastructure.

Impact:

Teams are moving build workloads to arm64 for performance, sustainability and cost reasons. They often use a single stage template covering source scan, build, package and artifact scan on one architecture. Without arm64 support for GHAS, they must split scanning into a separate AMD64 stage, which means maintaining multiple stage templates and is hard to enforce across teams. The ingestion-mode workaround doesn’t help, because the CodeQL SARIF would still need to be generated on a separate AMD64 stage.