jcoffey-dev
c60028aad1
Two Dependabot PRs are stuck behind the same number. #35 raises the go directive to 1.26.0 in six modules, because golang.org/x/crypto v0.56.0 requires it -- x/crypto tracks the two most recent Go releases and 0.56 dropped 1.25. A module that says 1.26 cannot be built by the 1.25 this repository pins in two places, so that PR fails every Go job. #29 raises actions/setup-go to v7, which sets GOTOOLCHAIN=local. With that set, `go install golang.org/x/vuln/cmd/govulncheck@latest` cannot quietly fetch a newer toolchain, and stops with golang.org/x/[email protected] requires go >= 1.26.0 (running go 1.25.14) Under setup-go v5 the same install succeeded by downloading 1.26 behind our backs, which is its own reason to be on 1.26 deliberately instead. So: security-scan's go-version and all eight Dockerfiles move together, 1.25 -> 1.26. Nothing else needs to. A newer toolchain builds an older directive happily, so this stands on its own before #35 lands, and the go.mod files stay where they are here. Checked by building rather than by reading: the api and ingest images both build on golang:1.26-alpine, and api, ingest and enterprise still `go build ./...` clean against their existing 1.25 directives.
17 lines
534 B
Docker
17 lines
534 B
Docker
# Build context must be the repo root (cairnobs/), since this needs both
|
|
# api/ and proto/ (api now speaks gRPC to /search, using proto's checked-in
|
|
# Go bindings via the `replace` directive in api/go.mod):
|
|
# docker build -f api/Dockerfile -t cairnobs-api .
|
|
|
|
FROM golang:1.26-alpine AS builder
|
|
WORKDIR /src
|
|
COPY proto ./proto
|
|
COPY api ./api
|
|
WORKDIR /src/api
|
|
RUN go mod download
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -o /out/api ./cmd/api
|
|
|
|
FROM gcr.io/distroless/static-debian12
|
|
COPY --from=builder /out/api /api
|
|
ENTRYPOINT ["/api"]
|