### **1. Change Impact Analysis**

#### **What this PR accomplishes**

This pull request introduces the capability to build and release FIPS-compliant, multi-architecture Docker images for `tyk-pump`. Responding to a customer request, it extends FIPS support beyond the existing `amd64` architecture to include `arm64` and `s390x`. This is achieved by using Go's `boringcrypto` library to compile FIPS-compliant binaries for each architecture and then packaging them into separate Docker images. Finally, these images are grouped under a single multi-architecture manifest, simplifying distribution and usage for consumers on different platforms. The PR also adds `s390x` support for the standard (non-FIPS) Docker image.

#### **Key Technical Changes**

The core of the changes lies in the CI/CD configuration files:

1.  **GoReleaser Configuration (`ci/goreleaser/goreleaser.yml`):**
    *   **New Build Definitions:** Two new build IDs, `fips-arm64` and `fips-s390x`, are added. These builds are configured with the `fips,boringcrypto` tags and the `GOEXPERIMENT=boringcrypto` environment variable, which instructs the Go compiler to use the FIPS 140-2 validated BoringCrypto module.
    *   **Multi-Arch Docker Builds:** The `dockers` section is expanded to create architecture-specific Docker images for `fips-arm64` and `fips-s390x`.
    *   **Multi-Arch Manifests:** The `docker_manifests` section is updated to group the newly created `arm64` and `s390x` images with the existing `amd64` image. This allows users to pull a tag like `tykio/tyk-pump-fips:vX.Y.Z-fips` and have the container runtime automatically select the correct image for their machine's architecture.

2.  **GitHub Actions Workflow (`.github/workflows/release.yml`):**
    *   The `docker/build-push-action` steps are modified to build for multiple platforms simultaneously by changing `platforms: linux/amd64` to `platforms: linux/amd64,linux/arm64,linux/s390x`. This enables the workflow to produce the multi-architecture images required by the GoReleaser configuration.

#### **Affected System Components**

*   **CI/CD Release Pipeline:** The primary impact is on the release process. The pipeline will now execute additional build steps for the new architectures, create corresponding Docker images, and publish multi-arch manifests to the container registry.
*   **Release Artifacts:** The set of release artifacts is expanded to include:
    *   FIPS-compliant binaries for `linux/arm64` and `linux/s390x`.
    *   Multi-architecture Docker images for both FIPS (`tykio/tyk-pump-fips`) and standard (`tykio/tyk-pump-docker-pub`) builds.

### **2. Architecture Visualization**

The following diagram illustrates the updated build and release process for FIPS-compliant Docker images.

```mermaid
flowchart TD
    subgraph "GoReleaser Build Process"
        A[Trigger Release] --> B{Build Binaries};
        B --> C1[Build fips-amd64];
        B --> C2[Build fips-arm64];
        B --> C3[Build fips-s390x];
    end

    subgraph "Docker Image Creation (via buildx)"
        C1 --> D1[Create tyk-pump-fips:tag-fips-amd64 Image];
        C2 --> D2[Create tyk-pump-fips:tag-fips-arm64 Image];
        C3 --> D3[Create tyk-pump-fips:tag-fips-s390x Image];
    end

    subgraph "Docker Manifest Publication"
        D1 --> E{Combine into Multi-Arch Manifest};
        D2 --> E;
        D3 --> E;
        E -- "tykio/tyk-pump-fips:tag-fips" --> F[Push to Container Registry];
    end

    subgraph "End User"
        G[User on amd64] -- "docker pull" --> F;
        H[User on arm64] -- "docker pull" --> F;
        I[User on s390x] -- "docker pull" --> F;
    end

    style F fill:#cde4ff,stroke:#333,stroke-width:2px
```

This diagram shows how GoReleaser now builds binaries for three different architectures in parallel. Each binary is then used to create a platform-specific Docker image. Finally, these individual images are linked together by a single multi-architecture manifest, which is pushed to the container registry. This allows users on any of the supported platforms to pull the correct image using a single, consistent tag.