use scratch container to run, update CI

.github/workflows/build-push.yaml

@@ -26,6 +26,7 @@ jobs:
         id: tags
         run: |
           BRANCH_NAME="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
+          echo "using branch: ${BRANCH_NAME}"
           if [ "${BRANCH_NAME}" == "main" ]; then
             echo "tag_latest=true" >> $GITHUB_OUTPUT
             echo "tag_cargo=true" >> $GITHUB_OUTPUT

.github/workflows/cargo.yaml

@@ -1,4 +1,4 @@
-name: Cargo lint and test
+name: Cargo lint
 
 on:
   push:

Dockerfile

@@ -1,15 +1,16 @@
-FROM rust:1.80 as builder
+FROM rust:1.80-alpine as builder
 
 WORKDIR /tembo-metrics
 
 COPY . .
 
-RUN cargo build --release
+RUN apk update && apk upgrade && apk add --no-cache musl-dev openssl ca-certificates
 
-FROM debian:bookworm-slim
+RUN cargo build --release --target x86_64-unknown-linux-musl
 
-RUN apt-get update && apt-get upgrade -y && apt-get clean && rm -rf /var/lib/apt/lists/*
+FROM scratch
 
-COPY --from=builder /tembo-metrics/target/release/tembo-metrics /usr/local/bin/tembo-metrics
+COPY --from=builder /tembo-metrics/target/x86_64-unknown-linux-musl/release/tembo-metrics /tembo-metrics
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 
-CMD ["tembo-metrics"]
+CMD ["/tembo-metrics"]

sample-aws-iam-policy.json

@@ -0,0 +1,23 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "Stmt1722444480676",
+      "Action": [
+        "cloudformation:ListStacks"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    },
+    {
+      "Sid": "Stmt1722444523636",
+      "Action": [
+        "servicequotas:GetServiceQuota",
+        "servicequotas:ListServiceQuotas",
+        "servicequotas:ListServices"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}