chore(deps): Pin Go builder image by digest

[iRayans]

Pins the Go builder image by digest, matching Dockerfile.dist and the final image in this file.
Digest taken from the manifest list, so all platforms in BUILD_LIST still resolve. Other FROM in this file is already pinned.
Fixes #3358

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 1f17a524-6a96-4173-9b63-bbeca5331aa0

📥 Commits

Reviewing files that changed from the base of the PR and between c81ad1e and b94fbe8.

📒 Files selected for processing (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile build stage now uses a SHA256-pinned Golang 1.26.3 image reference, with the existing build alias unchanged.

Changes

Builder image pinning

Layer / File(s)	Summary
Pin the build-stage image Dockerfile	The build-stage FROM instruction uses a SHA256-pinned Golang 1.26.3 image while preserving AS build.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: simonbaird

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly states the main change: pinning the Go builder image by digest.
Description check	✅ Passed	The description matches the change by explaining the digest pin and its Dockerfile impact.
Linked Issues check	✅ Passed	The PR satisfies #3358 by pinning the Dockerfile Go builder image by digest and keeping the change localized.
Out of Scope Changes check	✅ Passed	The change stays scoped to the Dockerfile builder FROM line with no unrelated edits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 3:11 AM UTC · Ended 3:15 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review — approve

Scope: Dockerfile (1 line changed)

Summary

This PR pins the Go builder image in Dockerfile by digest, changing:

FROM docker.io/library/golang:1.26.3 AS build

to:

FROM docker.io/library/golang:1.26.3@sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1a AS build

Analysis

Dimension	Assessment
Correctness	✅ The image:tag@sha256:digest syntax is valid Docker notation. The digest is well-formed (64 hex characters). If the digest were incorrect, the build would fail safely rather than silently pulling the wrong image.
Security	✅ Positive supply-chain hardening. Pinning by digest prevents tag mutation attacks. This aligns the builder FROM line with the existing digest-pinned final image (ubi9/ubi-minimal on line 46) and Dockerfile.dist.
Intent & coherence	✅ The change directly addresses issue #3358, which was opened as a follow-up from PR #3357. The scope is exactly what the issue requested — localized to the builder FROM line.
Style & conventions	✅ Follows the existing digest-pinning pattern used elsewhere in the repo.
Documentation	✅ No documentation updates needed.
Cross-repo contracts	✅ No API or interface changes.

The PR body's claim that the digest comes from the manifest list (preserving multi-architecture resolution for BUILD_LIST) is consistent with correct practice for multi-arch Docker builds.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• Dockerfile

---

Labels: PR pins a Docker base image digest in the Dockerfile

[st3penta]

Checked with:

$ skopeo inspect docker://docker.io/library/golang:1.26.3 | jq -r .Digest
sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1a

$ make build-image
...

$ make verify-image
...

Confirmed working. Thanks @iRayans!

[st3penta]

/ok-to-test

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.26% <ø> (ø)
generative	16.80% <ø> (ø)
integration	27.97% <ø> (ø)
unit	71.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:56 AM UTC · Completed 10:03 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

PR #3423 was a trivial 1-line Dockerfile change pinning a Go builder image by digest (fixing issue #3358). The review agent ran successfully in ~95 seconds, produced a thorough and accurate review, and correctly approved with no findings. The post-script correctly detected the Dockerfile as a protected path and downgraded the approval to a comment, requiring human review. However, two known infrastructure issues affected this run: (1) the status comment displayed 'Terminated' despite the review completing successfully, due to a token minting validation bug (fullsend#4983, fixed same day); (2) the pr-review sub-agent orchestration was silently skipped because skill directory resolution doesn't include subdirectories (fullsend#5305, open). The human reviewer (st3penta) verified the digest with skopeo 2 days later and approved. The review quality was good for this simple change, but the sub-agent bypass means the multi-agent review pipeline was never exercised. No new proposals warranted — all identified issues are already tracked in existing open issues.